@helloleo/plugins 0.1.11 → 0.1.12

package/dist/index.js

@@ -12332,10 +12332,10 @@ function tool(input) {
 tool.schema = exports_external;
 // src/tools/inspect-http.ts
 var z = tool.schema;
-var ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
-var ALLOWED_HOST_SUFFIXES = [
-  ".augustin-d60.workers.dev",
-  ".live.helloleo.dev"
+var ALLOWED_BASE_HOSTS = [
+  "helloleo.dev",
+  "helloleo.app",
+  "augustin-d60.workers.dev"
 ];
 var DEFAULT_TIMEOUT_MS = 15000;
 var MAX_TIMEOUT_MS = 30000;
@@ -12343,7 +12343,7 @@ var MAX_RESPONSE_BYTES = 1e6;
 var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var METHODS_AUTO_JSON = new Set(["POST", "PUT", "PATCH"]);
 var argsShape = {
-  url: z.string().describe("Fully-qualified URL to request. Must be on the HelloLeo whitelist " + "(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev)."),
+  url: z.string().describe("Fully-qualified URL to request. Must be on the HelloLeo whitelist " + "(**.helloleo.dev, **.helloleo.app, **.augustin-d60.workers.dev)."),
   method: z.enum(METHODS).default("GET").describe(`HTTP method (${METHODS.join(", ")}). Defaults to GET.`),
   body: z.string().optional().describe("Request body as a string. Not valid for GET. Sent with " + "Content-Type: application/json on POST/PUT/PATCH unless a " + "different Content-Type is supplied via headers."),
   headers: z.record(z.string(), z.string()).default({}).describe("Optional additional request headers as key/value pairs (e.g. Authorization)."),
@@ -12351,7 +12351,7 @@ var argsShape = {
 };
 var argsSchema = z.object(argsShape);
 var inspectHttp = tool({
-  description: "Send an HTTP request to a HelloLeo endpoint and return the status code, " + "response headers, and response body. Use this to inspect the live behaviour " + "of HelloLeo workers, the production API, or preview deployments so you can " + "self-debug instead of operating blind. " + "Only URLs on the HelloLeo whitelist are allowed: " + "api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " + "Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+  description: "Send an HTTP request to a HelloLeo endpoint and return the status code, " + "response headers, and response body. Use this to inspect the live behaviour " + "of HelloLeo workers, the production API, or preview deployments so you can " + "self-debug instead of operating blind. ",
   args: argsShape,
   async execute(rawArgs, context) {
     const args = argsSchema.parse(rawArgs);
@@ -12437,17 +12437,12 @@ function parseTargetUrl(raw) {
   return url2;
 }
 function allowedHostsHuman() {
-  return [
-    ...ALLOWED_EXACT_HOSTS,
-    ...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`)
-  ].join(", ");
+  return ALLOWED_BASE_HOSTS.map((base) => `**.${base}`).join(", ");
 }
 function isAllowedHost(hostname3) {
   const host = hostname3.toLowerCase().replace(/\.$/, "");
-  if (ALLOWED_EXACT_HOSTS.has(host))
-    return true;
-  for (const suffix of ALLOWED_HOST_SUFFIXES) {
-    if (host.endsWith(suffix) && host.length > suffix.length)
+  for (const base of ALLOWED_BASE_HOSTS) {
+    if (host === base || host.endsWith(`.${base}`))
       return true;
   }
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/inspect-http.ts

@@ -3,10 +3,10 @@ import { tool } from "@opencode-ai/plugin";
 
 const z = tool.schema;
 
-const ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
-const ALLOWED_HOST_SUFFIXES = [
-	".augustin-d60.workers.dev",
-	".live.helloleo.dev",
+const ALLOWED_BASE_HOSTS = [
+	"helloleo.dev",
+	"helloleo.app",
+	"augustin-d60.workers.dev",
 ] as const;
 
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -22,7 +22,7 @@ const argsShape = {
 		.string()
 		.describe(
 			"Fully-qualified URL to request. Must be on the HelloLeo whitelist " +
-				"(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev).",
+				"(**.helloleo.dev, **.helloleo.app, **.augustin-d60.workers.dev).",
 		),
 	method: z
 		.enum(METHODS)
@@ -58,10 +58,7 @@ export const inspectHttp = tool({
 		"Send an HTTP request to a HelloLeo endpoint and return the status code, " +
 		"response headers, and response body. Use this to inspect the live behaviour " +
 		"of HelloLeo workers, the production API, or preview deployments so you can " +
-		"self-debug instead of operating blind. " +
-		"Only URLs on the HelloLeo whitelist are allowed: " +
-		"api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " +
-		"Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+		"self-debug instead of operating blind. ",
 	args: argsShape,
 	async execute(rawArgs, context) {
 		const args = argsSchema.parse(rawArgs);
@@ -180,17 +177,13 @@ function parseTargetUrl(raw: string): URL {
 }
 
 function allowedHostsHuman(): string {
-	return [
-		...ALLOWED_EXACT_HOSTS,
-		...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`),
-	].join(", ");
+	return ALLOWED_BASE_HOSTS.map((base) => `**.${base}`).join(", ");
 }
 
 function isAllowedHost(hostname: string): boolean {
 	const host = hostname.toLowerCase().replace(/\.$/, "");
-	if (ALLOWED_EXACT_HOSTS.has(host)) return true;
-	for (const suffix of ALLOWED_HOST_SUFFIXES) {
-		if (host.endsWith(suffix) && host.length > suffix.length) return true;
+	for (const base of ALLOWED_BASE_HOSTS) {
+		if (host === base || host.endsWith(`.${base}`)) return true;
 	}
 	return false;
 }

package/src/utils/try-catch.ts

@@ -1,22 +0,0 @@
-type Success<T> = {
-	data: T;
-	error: null;
-};
-
-type Failure<E> = {
-	data: null;
-	error: E;
-};
-
-type Result<T, E = Error> = Success<T> | Failure<E>;
-
-export async function tryCatch<T, E = Error>(
-	promise: Promise<T>,
-): Promise<Result<T, E>> {
-	try {
-		const data = await promise;
-		return { data, error: null };
-	} catch (error) {
-		return { data: null, error: error as E };
-	}
-}