@helloleo/plugins 0.1.11 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/index.ts

@@ -1,5 +1,6 @@
 export { InspectHttpPlugin } from "./tools/inspect-http.ts";
 export { RemovePlugin } from "./tools/remove.ts";
+// `scaffold` is now the TanStack scaffolder (replaced the legacy React+Vite one).
 export { ScaffoldPlugin } from "./tools/scaffold.ts";
 export { SetupNetsuitePlugin } from "./tools/setup-netsuite.ts";
 // export { CreatePlanPlugin } from "./tools/create-plan.ts";

package/src/tools/inspect-http.ts

@@ -3,10 +3,10 @@ import { tool } from "@opencode-ai/plugin";
 
 const z = tool.schema;
 
-const ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
-const ALLOWED_HOST_SUFFIXES = [
-	".augustin-d60.workers.dev",
-	".live.helloleo.dev",
+const ALLOWED_BASE_HOSTS = [
+	"helloleo.dev",
+	"helloleo.app",
+	"augustin-d60.workers.dev",
 ] as const;
 
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -22,7 +22,7 @@ const argsShape = {
 		.string()
 		.describe(
 			"Fully-qualified URL to request. Must be on the HelloLeo whitelist " +
-				"(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev).",
+				"(**.helloleo.dev, **.helloleo.app, **.augustin-d60.workers.dev).",
 		),
 	method: z
 		.enum(METHODS)
@@ -58,10 +58,7 @@ export const inspectHttp = tool({
 		"Send an HTTP request to a HelloLeo endpoint and return the status code, " +
 		"response headers, and response body. Use this to inspect the live behaviour " +
 		"of HelloLeo workers, the production API, or preview deployments so you can " +
-		"self-debug instead of operating blind. " +
-		"Only URLs on the HelloLeo whitelist are allowed: " +
-		"api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " +
-		"Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+		"self-debug instead of operating blind. ",
 	args: argsShape,
 	async execute(rawArgs, context) {
 		const args = argsSchema.parse(rawArgs);
@@ -180,17 +177,13 @@ function parseTargetUrl(raw: string): URL {
 }
 
 function allowedHostsHuman(): string {
-	return [
-		...ALLOWED_EXACT_HOSTS,
-		...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`),
-	].join(", ");
+	return ALLOWED_BASE_HOSTS.map((base) => `**.${base}`).join(", ");
 }
 
 function isAllowedHost(hostname: string): boolean {
 	const host = hostname.toLowerCase().replace(/\.$/, "");
-	if (ALLOWED_EXACT_HOSTS.has(host)) return true;
-	for (const suffix of ALLOWED_HOST_SUFFIXES) {
-		if (host.endsWith(suffix) && host.length > suffix.length) return true;
+	for (const base of ALLOWED_BASE_HOSTS) {
+		if (host === base || host.endsWith(`.${base}`)) return true;
 	}
 	return false;
 }