@helloleo/plugins 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/index.ts

@@ -1,5 +1,6 @@
-export { CreatePlanPlugin } from "./tools/create-plan.ts";
-export { ListPlansPlugin } from "./tools/list-plans.ts";
-export { ModifyPlanPlugin } from "./tools/modify-plan.ts";
+export { InspectHttpPlugin } from "./tools/inspect-http.ts";
 export { RemovePlugin } from "./tools/remove.ts";
-export { ScaffoldPlugin } from "./tools/scaffold.ts";
+// export { ScaffoldPlugin } from "./tools/scaffold.ts";
+// export { CreatePlanPlugin } from "./tools/create-plan.ts";
+// export { ListPlansPlugin } from "./tools/list-plans.ts";
+// export { ModifyPlanPlugin } from "./tools/modify-plan.ts";

package/src/tools/inspect-http.ts

@@ -0,0 +1,258 @@
+import type { Plugin } from "@opencode-ai/plugin";
+import { tool } from "@opencode-ai/plugin";
+
+const z = tool.schema;
+
+const ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
+const ALLOWED_HOST_SUFFIXES = [
+	".augustin-d60.workers.dev",
+	".live.helloleo.dev",
+] as const;
+
+const DEFAULT_TIMEOUT_MS = 15_000;
+const MAX_TIMEOUT_MS = 30_000;
+const MAX_RESPONSE_BYTES = 1_000_000;
+
+const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
+const METHODS_AUTO_JSON = new Set(["POST", "PUT", "PATCH"]);
+
+// tool() is an identity function; parse args explicitly so .default() applies.
+const argsShape = {
+	url: z
+		.string()
+		.describe(
+			"Fully-qualified URL to request. Must be on the HelloLeo whitelist " +
+				"(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev).",
+		),
+	method: z
+		.enum(METHODS)
+		.default("GET")
+		.describe(`HTTP method (${METHODS.join(", ")}). Defaults to GET.`),
+	body: z
+		.string()
+		.optional()
+		.describe(
+			"Request body as a string. Not valid for GET. Sent with " +
+				"Content-Type: application/json on POST/PUT/PATCH unless a " +
+				"different Content-Type is supplied via headers.",
+		),
+	headers: z
+		.record(z.string(), z.string())
+		.default({})
+		.describe(
+			"Optional additional request headers as key/value pairs (e.g. Authorization).",
+		),
+	timeout: z
+		.number()
+		.max(MAX_TIMEOUT_MS)
+		.default(DEFAULT_TIMEOUT_MS)
+		.describe(
+			`Optional timeout in milliseconds (max ${MAX_TIMEOUT_MS}, default ${DEFAULT_TIMEOUT_MS}).`,
+		),
+};
+
+const argsSchema = z.object(argsShape);
+
+export const inspectHttp = tool({
+	description:
+		"Send an HTTP request to a HelloLeo endpoint and return the status code, " +
+		"response headers, and response body. Use this to inspect the live behaviour " +
+		"of HelloLeo workers, the production API, or preview deployments so you can " +
+		"self-debug instead of operating blind. " +
+		"Only URLs on the HelloLeo whitelist are allowed: " +
+		"api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " +
+		"Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+	args: argsShape,
+	async execute(rawArgs, context) {
+		const args = argsSchema.parse(rawArgs);
+		const url = parseTargetUrl(args.url);
+
+		if (args.method === "GET" && args.body !== undefined) {
+			throw new Error("GET requests cannot have a body");
+		}
+
+		await context.ask({
+			permission: "inspect_http",
+			patterns: [url.toString()],
+			always: [`${url.protocol}//${url.hostname}/*`],
+			metadata: {
+				url: url.toString(),
+				method: args.method,
+				hasBody: args.body !== undefined,
+			},
+		});
+
+		const timeoutMs = Math.max(1, Math.min(args.timeout, MAX_TIMEOUT_MS));
+
+		const requestHeaders: Record<string, string> = {
+			Accept: "application/json, text/plain, */*",
+			"User-Agent": "helloleo-plugins-inspect-http/0.1",
+			Origin: "https://app.helloleo.dev",
+			...args.headers,
+		};
+
+		if (
+			METHODS_AUTO_JSON.has(args.method) &&
+			args.body !== undefined &&
+			!hasHeader(requestHeaders, "content-type")
+		) {
+			requestHeaders["Content-Type"] = "application/json";
+		}
+
+		const signal = AbortSignal.any([
+			context.abort,
+			AbortSignal.timeout(timeoutMs),
+		]);
+
+		let response: Response;
+		try {
+			response = await fetch(url, {
+				method: args.method,
+				headers: requestHeaders,
+				body: args.method === "GET" ? undefined : args.body,
+				signal,
+				redirect: "follow",
+			});
+		} catch (err) {
+			if (err instanceof DOMException && err.name === "TimeoutError") {
+				throw new Error(`Request timed out after ${timeoutMs}ms`);
+			}
+			if (err instanceof DOMException && err.name === "AbortError") {
+				throw new Error("Request aborted");
+			}
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`Request failed: ${message}`);
+		}
+
+		const { text, truncated } = await readBody(response);
+		const contentType = response.headers.get("content-type");
+		const formattedBody = formatBody(text, contentType);
+
+		const redirected = response.url && response.url !== url.toString();
+
+		const lines: string[] = [`${args.method} ${url.toString()}`];
+		if (redirected) {
+			lines.push(`Final URL: ${response.url}`);
+		}
+		lines.push(
+			`Status: ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`,
+			"",
+			"Response headers:",
+			formatHeaders(response.headers) || "(none)",
+			"",
+			"Response body:",
+			formattedBody.length > 0 ? formattedBody : "(empty)",
+		);
+
+		if (truncated) {
+			lines.push("", `(body truncated at ${MAX_RESPONSE_BYTES} bytes)`);
+		}
+
+		return lines.join("\n");
+	},
+});
+
+function parseTargetUrl(raw: string): URL {
+	let url: URL;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error(`Invalid URL: ${raw}`);
+	}
+
+	if (url.protocol !== "https:" && url.protocol !== "http:") {
+		throw new Error(
+			`URL must use http or https scheme (got "${url.protocol}")`,
+		);
+	}
+
+	if (url.username || url.password) {
+		throw new Error("URL must not contain embedded credentials");
+	}
+
+	if (!isAllowedHost(url.hostname)) {
+		throw new Error(
+			`Host "${url.hostname}" is not on the HelloLeo whitelist. Allowed: ${allowedHostsHuman()}`,
+		);
+	}
+
+	return url;
+}
+
+function allowedHostsHuman(): string {
+	return [
+		...ALLOWED_EXACT_HOSTS,
+		...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`),
+	].join(", ");
+}
+
+function isAllowedHost(hostname: string): boolean {
+	const host = hostname.toLowerCase().replace(/\.$/, "");
+	if (ALLOWED_EXACT_HOSTS.has(host)) return true;
+	for (const suffix of ALLOWED_HOST_SUFFIXES) {
+		if (host.endsWith(suffix) && host.length > suffix.length) return true;
+	}
+	return false;
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+	const target = name.toLowerCase();
+	for (const key of Object.keys(headers)) {
+		if (key.toLowerCase() === target) return true;
+	}
+	return false;
+}
+
+function formatHeaders(headers: Headers): string {
+	const entries: string[] = [];
+	headers.forEach((value, key) => {
+		entries.push(`${key}: ${value}`);
+	});
+	return entries.sort().join("\n");
+}
+
+function formatBody(raw: string, contentType: string | null): string {
+	const mime = contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+	if (mime.includes("application/json") || mime.endsWith("+json")) {
+		try {
+			return JSON.stringify(JSON.parse(raw), null, 2);
+		} catch {}
+	}
+	return raw;
+}
+
+async function readBody(response: Response): Promise<{
+	text: string;
+	truncated: boolean;
+}> {
+	if (!response.body) return { text: "", truncated: false };
+
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let total = 0;
+	let truncated = false;
+
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+
+		total += value.byteLength;
+		if (total > MAX_RESPONSE_BYTES) {
+			truncated = true;
+			await reader.cancel();
+			break;
+		}
+		text += decoder.decode(value, { stream: true });
+	}
+	text += decoder.decode();
+
+	return { text, truncated };
+}
+
+export const InspectHttpPlugin: Plugin = async () => {
+	return {
+		tool: { inspect_http: inspectHttp },
+	};
+};

package/src/utils/try-catch.ts

@@ -0,0 +1,22 @@
+type Success<T> = {
+	data: T;
+	error: null;
+};
+
+type Failure<E> = {
+	data: null;
+	error: E;
+};
+
+type Result<T, E = Error> = Success<T> | Failure<E>;
+
+export async function tryCatch<T, E = Error>(
+	promise: Promise<T>,
+): Promise<Result<T, E>> {
+	try {
+		const data = await promise;
+		return { data, error: null };
+	} catch (error) {
+		return { data: null, error: error as E };
+	}
+}