@helloleo/plugins 0.1.9 → 0.1.11

package/dist/index.js

@@ -12908,6 +12908,63 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
   </React.StrictMode>,
 )`;
 }
+async function writeBaseScaffold(opts, dir) {
+  const name = opts.name ?? "leo-project";
+  const primary = normalizePrimaryColor(opts.primaryColor ?? "221.2 83.2% 53.3%");
+  const font = opts.fontFamily ?? "Inter";
+  const radius = opts.borderRadius ?? "0.5rem";
+  await mkdir(path2.join(dir, "src", "lib"), { recursive: true });
+  const files = [
+    ["package.json", packageJson(name)],
+    ["index.html", indexHtml(font)],
+    ["vite.config.js", viteConfig()],
+    ["tailwind.config.js", tailwindConfig()],
+    ["postcss.config.js", postcssConfig()],
+    [path2.join("src", "index.css"), indexCss(primary, font, radius)],
+    [path2.join("src", "lib", "utils.ts"), utilsTs()],
+    [path2.join("src", "lib", "proxy.ts"), proxyTs()],
+    [path2.join("src", "main.tsx"), mainTsx()]
+  ];
+  const created = [];
+  for (const [filePath, content] of files) {
+    await Bun.write(path2.join(dir, filePath), content);
+    created.push(filePath);
+  }
+  return created;
+}
+var scaffold = tool({
+  description: "Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " + "Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " + "vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " + "light+dark), src/lib/utils.ts (cn helper), src/lib/proxy.ts, and src/main.tsx. " + "Call this FIRST for any new project before writing App.tsx and components. " + "For NetSuite projects (NetSuite MCP in the live list), call `setup_netsuite` " + "INSTEAD -- it bundles base scaffold + OAuth wiring in one call. Do not call both.",
+  args: {
+    name: tool.schema.string().optional().describe("Project name for package.json (default: leo-project)"),
+    primaryColor: tool.schema.string().optional().describe("Primary brand color. Prefer raw HSL triplet (no hsl() wrapper, no # prefix), " + 'e.g. "221.2 83.2% 53.3%". Hex like "#3b82f6" is also accepted and will ' + "be auto-converted. Default: blue."),
+    fontFamily: tool.schema.string().optional().describe('Google Font family name, e.g. "Inter", "Poppins" (default: Inter)'),
+    borderRadius: tool.schema.string().optional().describe('Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)')
+  },
+  async execute(args, context) {
+    const created = await writeBaseScaffold(args, context.directory);
+    return [
+      `Scaffolded ${created.length} files:`,
+      ...created.map((f) => `  - ${f}`),
+      "",
+      "Next: create src/App.tsx with your application code.",
+      "Design system reference: read the header comment in src/index.css",
+      "  before adding tokens or styling primitives.",
+      "Integration calls: use callIntegration() from src/lib/proxy.ts.",
+      "  Header comment in that file documents slugs, response unwrapping,",
+      "  pagination, and frontend-only vs HelloLeo Cloud routing.",
+      "Update package.json with any extra packages you need after scaffolding."
+    ].join(`
+`);
+  }
+});
+var ScaffoldPlugin = async () => {
+  return {
+    tool: { scaffold }
+  };
+};
+// src/tools/setup-netsuite.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import path3 from "path";
 function netsuiteTs() {
   return `/*
  * NetSuite OAuth client helper (bearer-token-in-fragment).
@@ -12969,6 +13026,22 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
   }
   const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
   url.searchParams.set('return_to', returnTo);
+  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
+  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
+  // Worker (which 302s to NetSuite) ends up loading a page the browser
+  // refuses to render -- looks like "nothing happens" to the user. Navigate
+  // the top frame instead so the OAuth flow runs at the top level and the
+  // callback redirect lands on the same top frame, which then reads the
+  // #nssid= fragment. Fallback to same-frame navigation if the top window
+  // is cross-origin and can't be reassigned.
+  try {
+    if (window.top && window.top !== window) {
+      window.top.location.assign(url.toString());
+      return;
+    }
+  } catch {
+    /* top window not accessible \u2014 fall through to same-frame navigation */
+  }
   window.location.assign(url.toString());
 }
 
@@ -13099,7 +13172,7 @@ import { getNetSuiteSession, type NetSuiteSession } from '../../lib/netsuite';
  *   export default function App() {
  *     return (
  *       <AuthGate>
- *         <Dashboard />   {/* your authenticated content */}
+ *         <Dashboard />   // your authenticated content
  *       </AuthGate>
  *     );
  *   }
@@ -13145,82 +13218,73 @@ export default function App() {
 }
 `;
 }
-var scaffold = tool({
-  description: "Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " + "Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " + "vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " + "light+dark), src/lib/utils.ts (cn helper), and src/main.tsx. " + "Call this FIRST for any new project before writing App.tsx and components.",
-  args: {
-    name: tool.schema.string().optional().describe("Project name for package.json (default: leo-project)"),
-    primaryColor: tool.schema.string().optional().describe("Primary brand color. Prefer raw HSL triplet (no hsl() wrapper, no # prefix), " + 'e.g. "221.2 83.2% 53.3%". Hex like "#3b82f6" is also accepted and will ' + "be auto-converted. Default: blue."),
-    fontFamily: tool.schema.string().optional().describe('Google Font family name, e.g. "Inter", "Poppins" (default: Inter)'),
-    borderRadius: tool.schema.string().optional().describe('Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)'),
-    integrations: tool.schema.array(tool.schema.string()).optional().describe("Connected integration slugs for this project (live MCP list). " + 'Pass ["netsuite"] when the project uses NetSuite -- the scaffold ' + "will add src/lib/netsuite.ts (OAuth client helper), " + "src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx " + "and a src/App.tsx wrapped in <AuthGate>. OAuth is wired from " + "day one. Forbids hardcoded password gates -- the gate IS the " + "real flow against the project's Worker.")
-  },
-  async execute(args, context) {
+var setupNetsuite = tool({
+  description: "Bootstrap a NetSuite-backed React + Vite + Tailwind project in one call. " + "Writes the full HelloLeo base scaffold AND the NetSuite OAuth wiring " + "(src/lib/netsuite.ts, src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx, " + "src/App.tsx wrapped in <AuthGate>). " + "Use this INSTEAD of `scaffold` for any project that needs NetSuite. " + "Uses default theme (Inter font, blue primary, 0.5rem radius) -- edit " + "src/index.css afterwards to customise. Real OAuth is wired from day " + "one -- never replace the gate with a password placeholder.",
+  args: {},
+  async execute(_args, context) {
     const dir = context.directory;
-    const name = args.name ?? "leo-project";
-    const primary = normalizePrimaryColor(args.primaryColor ?? "221.2 83.2% 53.3%");
-    const font = args.fontFamily ?? "Inter";
-    const radius = args.borderRadius ?? "0.5rem";
-    const integrations = (args.integrations ?? []).map((s) => s.toLowerCase());
-    const hasNetsuite = integrations.includes("netsuite");
-    await mkdir(path2.join(dir, "src", "lib"), { recursive: true });
-    if (hasNetsuite) {
-      await mkdir(path2.join(dir, "src", "components", "auth"), {
-        recursive: true
-      });
-    }
-    const files = [
-      ["package.json", packageJson(name)],
-      ["index.html", indexHtml(font)],
-      ["vite.config.js", viteConfig()],
-      ["tailwind.config.js", tailwindConfig()],
-      ["postcss.config.js", postcssConfig()],
-      [path2.join("src", "index.css"), indexCss(primary, font, radius)],
-      [path2.join("src", "lib", "utils.ts"), utilsTs()],
-      [path2.join("src", "lib", "proxy.ts"), proxyTs()],
-      [path2.join("src", "main.tsx"), mainTsx()]
-    ];
-    if (hasNetsuite) {
-      files.push([path2.join("src", "lib", "netsuite.ts"), netsuiteTs()], [
-        path2.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+    const base = await writeBaseScaffold({}, dir);
+    await mkdir2(path3.join(dir, "src", "components", "auth"), {
+      recursive: true
+    });
+    const nsFiles = [
+      [path3.join("src", "lib", "netsuite.ts"), netsuiteTs()],
+      [
+        path3.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
         signInButtonTsx()
-      ], [
-        path2.join("src", "components", "auth", "LoginPage.tsx"),
+      ],
+      [
+        path3.join("src", "components", "auth", "LoginPage.tsx"),
         netsuiteLoginPageTsx()
-      ], [
-        path2.join("src", "components", "auth", "AuthGate.tsx"),
+      ],
+      [
+        path3.join("src", "components", "auth", "AuthGate.tsx"),
         netsuiteAuthGateTsx()
-      ], [path2.join("src", "App.tsx"), netsuiteAppTsx()]);
-    }
-    const created = [];
-    for (const [filePath, content] of files) {
-      await Bun.write(path2.join(dir, filePath), content);
-      created.push(filePath);
-    }
-    const out = [
-      `Scaffolded ${created.length} files:`,
-      ...created.map((f) => `  - ${f}`),
+      ],
+      [path3.join("src", "App.tsx"), netsuiteAppTsx()]
+    ];
+    const nsCreated = [];
+    for (const [filePath, content] of nsFiles) {
+      await Bun.write(path3.join(dir, filePath), content);
+      nsCreated.push(filePath);
+    }
+    const all = [...base, ...nsCreated];
+    return [
+      `Scaffolded ${all.length} files (base + NetSuite OAuth):`,
+      ...all.map((f) => `  - ${f}`),
       "",
-      "Next: create src/App.tsx with your application code.",
+      "Next: build your dashboard INSIDE <AuthGate> in src/App.tsx.",
       "Design system reference: read the header comment in src/index.css",
       "  before adding tokens or styling primitives.",
-      "Integration calls: use callIntegration() from src/lib/proxy.ts.",
-      "  Header comment in that file documents slugs, response unwrapping,",
-      "  pagination, and frontend-only vs HelloLeo Cloud routing.",
-      "Update package.json with any extra packages you need after scaffolding."
-    ];
-    if (hasNetsuite) {
-      out.push("", "NetSuite project -- auth is already wired:", "  - App.tsx wraps everything in <AuthGate>. Build your dashboard", "    INSIDE the gate. NEVER remove the gate or build a password", "    placeholder -- real OAuth is the only allowed login.", "  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated", "    view. Customise the copy / imagery, keep <SignInWithNetSuite/>", "    as the call-to-action.", "  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at", "    /auth/netsuite/start. Deploy the Worker via cloudflare-backend", "    MCP with routes:", "      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth", "      GET  /auth/netsuite/callback  -- code -> token exchange", "      GET  /api/me                   -- current session", "      POST /auth/netsuite/logout    -- clear session", "    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,", "    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).", "  - VITE_WORKER_URL must be set in the project env so the frontend", "    knows where to send users. The HelloLeo Cloud provisioner", "    seeds this automatically.");
-    }
-    return out.join(`
+      "",
+      "NetSuite auth -- already wired:",
+      "  - App.tsx wraps everything in <AuthGate>. NEVER remove the gate",
+      "    or build a password placeholder -- real OAuth is the only login.",
+      "  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated",
+      "    view. Customise the copy / imagery, keep <SignInWithNetSuite/>",
+      "    as the call-to-action.",
+      "  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at",
+      "    /auth/netsuite/start. Deploy the Worker via cloudflare-backend",
+      "    MCP with routes:",
+      "      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth",
+      "      GET  /auth/netsuite/callback  -- code -> token exchange",
+      "      GET  /api/me                   -- current session",
+      "      POST /auth/netsuite/logout    -- clear session",
+      "    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,",
+      "    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).",
+      "  - VITE_WORKER_URL must be set so the frontend knows where to",
+      "    send users. The HelloLeo Cloud provisioner seeds this."
+    ].join(`
 `);
   }
 });
-var ScaffoldPlugin = async () => {
+var SetupNetsuitePlugin = async () => {
   return {
-    tool: { scaffold }
+    tool: { setup_netsuite: setupNetsuite }
   };
 };
 export {
+  SetupNetsuitePlugin,
   ScaffoldPlugin,
   RemovePlugin,
   InspectHttpPlugin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/index.ts

@@ -1,6 +1,7 @@
 export { InspectHttpPlugin } from "./tools/inspect-http.ts";
 export { RemovePlugin } from "./tools/remove.ts";
 export { ScaffoldPlugin } from "./tools/scaffold.ts";
+export { SetupNetsuitePlugin } from "./tools/setup-netsuite.ts";
 // export { CreatePlanPlugin } from "./tools/create-plan.ts";
 // export { ListPlansPlugin } from "./tools/list-plans.ts";
 // export { ModifyPlanPlugin } from "./tools/modify-plan.ts";

package/src/tools/scaffold.ts

@@ -387,246 +387,49 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 )`;
 }
 
-function netsuiteTs() {
-	return `/*
- * NetSuite OAuth client helper (bearer-token-in-fragment).
- *
- * Two NetSuite Integration Records back this:
- *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
- *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
- * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
- * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
- * the browser. Cookies are NOT used -- frontend ↔ Worker are cross-site
- * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
- * third-party cookies in the HelloLeo preview iframe.
- *
- * Flow:
- *   1. User clicks "Sign in with NetSuite".
- *   2. Browser navigates to the Worker /auth/netsuite/start.
- *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
- *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
- *   5. Worker exchanges the code, mints a session id, then redirects to
- *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
- *   6. This module reads the fragment on load, stashes the sid in
- *      sessionStorage, and sends it as Authorization: Bearer on every
- *      Worker call.
- *
- * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
- * authoritative auth state -- the only acceptable check is /api/me on the
- * Worker. sessionStorage here is just a cache of the bearer token.
- */
-
-export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
-const TOKEN_KEY = 'nssid';
-
-// Capture-and-strip the #nssid=... fragment as early as possible so URLs
-// shown to the user stay clean. Runs once at module load.
-(function bootstrapTokenFromHash() {
-  if (typeof window === 'undefined') return;
-  const hash = window.location.hash.replace(/^#/, '');
-  if (!hash) return;
-  const params = new URLSearchParams(hash);
-  const sid = params.get(TOKEN_KEY);
-  if (sid) {
-    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
-    params.delete(TOKEN_KEY);
-    const remaining = params.toString();
-    const newHash = remaining ? '#' + remaining : '';
-    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
-  }
-})();
-
-export function getSessionToken(): string | null {
-  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
-}
-
-export function signInWithNetSuite(returnTo: string = window.location.href) {
-  if (!WORKER_URL) {
-    throw new Error(
-      'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
-    );
-  }
-  const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
-  url.searchParams.set('return_to', returnTo);
-  window.location.assign(url.toString());
-}
-
-export interface NetSuiteSession {
-  authenticated: boolean;
-  account_id?: string;
-  user_id?: string;
-  email?: string;
-}
-
-export async function getNetSuiteSession(): Promise<NetSuiteSession> {
-  if (!WORKER_URL) return { authenticated: false };
-  const sid = getSessionToken();
-  if (!sid) return { authenticated: false };
-  const res = await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/api/me\`, {
-    headers: { Authorization: 'Bearer ' + sid },
-  });
-  if (!res.ok) return { authenticated: false };
-  const data = await res.json();
-  return { authenticated: Boolean(data?.account_id), ...data };
-}
-
-export async function signOutNetSuite(): Promise<void> {
-  if (!WORKER_URL) return;
-  const sid = getSessionToken();
-  if (sid) {
-    try {
-      await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
-        method: 'POST',
-        headers: { Authorization: 'Bearer ' + sid },
-      });
-    } catch {}
-  }
-  try { sessionStorage.removeItem(TOKEN_KEY); } catch {}
-  window.location.reload();
-}
-
-/**
- * Helper for ALL other Worker calls (your dashboard endpoints, etc.).
- * Always go through this instead of bare fetch -- it injects the bearer
- * token and routes through the Worker so NetSuite tokens stay server-side.
- */
-export async function workerFetch(pathOrUrl: string, init: RequestInit = {}): Promise<Response> {
-  if (!WORKER_URL) throw new Error('VITE_WORKER_URL is not set');
-  const url = pathOrUrl.startsWith('http')
-    ? pathOrUrl
-    : \`\${WORKER_URL.replace(/\\/$/, '')}\${pathOrUrl.startsWith('/') ? '' : '/'}\${pathOrUrl}\`;
-  const sid = getSessionToken();
-  const headers = new Headers(init.headers ?? {});
-  if (sid) headers.set('Authorization', 'Bearer ' + sid);
-  return fetch(url, { ...init, headers });
-}
-`;
-}
-
-function signInButtonTsx() {
-	return `import { signInWithNetSuite } from '../../lib/netsuite';
-
-export function SignInWithNetSuite() {
-  return (
-    <button
-      onClick={() => signInWithNetSuite()}
-      className="inline-flex items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-    >
-      Sign in with NetSuite
-    </button>
-  );
+export interface BaseScaffoldOptions {
+	name?: string;
+	primaryColor?: string;
+	fontFamily?: string;
+	borderRadius?: string;
 }
-`;
-}
-
-function netsuiteLoginPageTsx() {
-	return `import { SignInWithNetSuite } from './SignInWithNetSuite';
 
 /**
- * Default unauthenticated landing page. Replaces any password gate.
- * Customise copy / imagery freely but keep <SignInWithNetSuite /> as the
- * only call-to-action -- it points to the Worker's /auth/netsuite/start.
+ * Write the 9 base scaffold files (no integrations). Shared between
+ * `scaffold` (frontend-only) and `setup_netsuite` (base + OAuth files).
+ * Returns the list of relative file paths written.
  */
-export function LoginPage() {
-  return (
-    <div className="min-h-screen bg-background text-foreground flex">
-      <div className="hidden lg:flex lg:w-1/2 bg-primary text-primary-foreground p-12 flex-col justify-between">
-        <div className="text-xl font-semibold">NetSuite App</div>
-        <div>
-          <h1 className="text-4xl font-bold leading-tight">
-            Connect your NetSuite account
-          </h1>
-          <p className="mt-4 text-primary-foreground/80 max-w-md">
-            Sign in with your NetSuite credentials to access your data securely.
-            Tokens stay server-side on HelloLeo Cloud -- they never reach the
-            browser.
-          </p>
-        </div>
-        <div className="text-xs text-primary-foreground/60">
-          Powered by HelloLeo
-        </div>
-      </div>
-      <div className="flex-1 flex items-center justify-center px-6 py-12">
-        <div className="w-full max-w-sm space-y-6">
-          <div>
-            <h2 className="text-2xl font-semibold">Welcome</h2>
-            <p className="mt-2 text-sm text-muted-foreground">
-              Use the button below to sign in. You'll be redirected to NetSuite
-              to authorise access, then back here.
-            </p>
-          </div>
-          <SignInWithNetSuite />
-        </div>
-      </div>
-    </div>
-  );
-}
-`;
-}
-
-function netsuiteAuthGateTsx() {
-	return `import { useEffect, useState } from 'react';
-import { LoginPage } from './LoginPage';
-import { getNetSuiteSession, type NetSuiteSession } from '../../lib/netsuite';
-
-/**
- * Mandatory auth gate for NetSuite projects. Wrap your real App content with
- * <AuthGate>...</AuthGate>. Never render NetSuite data without this gate -- it
- * is the ONLY supported authentication for a NetSuite project (no password
- * gates, no sessionStorage flags, no shared credential).
- *
- * Pattern in src/App.tsx:
- *
- *   import { AuthGate } from './components/auth/AuthGate';
- *   export default function App() {
- *     return (
- *       <AuthGate>
- *         <Dashboard />   {/* your authenticated content */}
- *       </AuthGate>
- *     );
- *   }
- */
-export function AuthGate({ children }: { children: React.ReactNode }) {
-  const [session, setSession] = useState<NetSuiteSession | null>(null);
-
-  useEffect(() => { getNetSuiteSession().then(setSession); }, []);
-
-  if (session === null) {
-    return (
-      <div className="min-h-screen flex items-center justify-center bg-background">
-        <div className="h-8 w-8 rounded-full border-2 border-primary border-t-transparent animate-spin" />
-      </div>
-    );
-  }
-
-  if (!session.authenticated) return <LoginPage />;
-
-  return <>{children}</>;
-}
-`;
-}
-
-function netsuiteAppTsx() {
-	return `import { AuthGate } from './components/auth/AuthGate';
-
-/**
- * NetSuite project entry point. KEEP <AuthGate> as the outermost element --
- * removing it disables real OAuth and exposes NetSuite data to anonymous
- * users. Build your dashboard / pages inside the gate.
- */
-export default function App() {
-  return (
-    <AuthGate>
-      <div className="min-h-screen bg-background text-foreground p-8">
-        <h1 className="text-2xl font-bold">You are signed in to NetSuite.</h1>
-        <p className="text-muted-foreground mt-2">
-          Replace this placeholder with your dashboard.
-        </p>
-      </div>
-    </AuthGate>
-  );
-}
-`;
+export async function writeBaseScaffold(
+	opts: BaseScaffoldOptions,
+	dir: string,
+): Promise<string[]> {
+	const name = opts.name ?? "leo-project";
+	const primary = normalizePrimaryColor(
+		opts.primaryColor ?? "221.2 83.2% 53.3%",
+	);
+	const font = opts.fontFamily ?? "Inter";
+	const radius = opts.borderRadius ?? "0.5rem";
+
+	await mkdir(path.join(dir, "src", "lib"), { recursive: true });
+
+	const files: [string, string][] = [
+		["package.json", packageJson(name)],
+		["index.html", indexHtml(font)],
+		["vite.config.js", viteConfig()],
+		["tailwind.config.js", tailwindConfig()],
+		["postcss.config.js", postcssConfig()],
+		[path.join("src", "index.css"), indexCss(primary, font, radius)],
+		[path.join("src", "lib", "utils.ts"), utilsTs()],
+		[path.join("src", "lib", "proxy.ts"), proxyTs()],
+		[path.join("src", "main.tsx"), mainTsx()],
+	];
+
+	const created: string[] = [];
+	for (const [filePath, content] of files) {
+		await Bun.write(path.join(dir, filePath), content);
+		created.push(filePath);
+	}
+	return created;
 }
 
 export const scaffold = tool({
@@ -634,8 +437,10 @@ export const scaffold = tool({
 		"Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " +
 		"Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " +
 		"vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " +
-		"light+dark), src/lib/utils.ts (cn helper), and src/main.tsx. " +
-		"Call this FIRST for any new project before writing App.tsx and components.",
+		"light+dark), src/lib/utils.ts (cn helper), src/lib/proxy.ts, and src/main.tsx. " +
+		"Call this FIRST for any new project before writing App.tsx and components. " +
+		"For NetSuite projects (NetSuite MCP in the live list), call `setup_netsuite` " +
+		"INSTEAD -- it bundles base scaffold + OAuth wiring in one call. Do not call both.",
 	args: {
 		name: tool.schema
 			.string()
@@ -661,75 +466,10 @@ export const scaffold = tool({
 			.describe(
 				'Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)',
 			),
-		integrations: tool.schema
-			.array(tool.schema.string())
-			.optional()
-			.describe(
-				"Connected integration slugs for this project (live MCP list). " +
-					'Pass ["netsuite"] when the project uses NetSuite -- the scaffold ' +
-					"will add src/lib/netsuite.ts (OAuth client helper), " +
-					"src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx " +
-					"and a src/App.tsx wrapped in <AuthGate>. OAuth is wired from " +
-					"day one. Forbids hardcoded password gates -- the gate IS the " +
-					"real flow against the project's Worker.",
-			),
 	},
 	async execute(args, context) {
-		const dir = context.directory;
-		const name = args.name ?? "leo-project";
-		const primary = normalizePrimaryColor(
-			args.primaryColor ?? "221.2 83.2% 53.3%",
-		);
-		const font = args.fontFamily ?? "Inter";
-		const radius = args.borderRadius ?? "0.5rem";
-		const integrations = (args.integrations ?? []).map((s) => s.toLowerCase());
-		const hasNetsuite = integrations.includes("netsuite");
-
-		await mkdir(path.join(dir, "src", "lib"), { recursive: true });
-		if (hasNetsuite) {
-			await mkdir(path.join(dir, "src", "components", "auth"), {
-				recursive: true,
-			});
-		}
-
-		const files: [string, string][] = [
-			["package.json", packageJson(name)],
-			["index.html", indexHtml(font)],
-			["vite.config.js", viteConfig()],
-			["tailwind.config.js", tailwindConfig()],
-			["postcss.config.js", postcssConfig()],
-			[path.join("src", "index.css"), indexCss(primary, font, radius)],
-			[path.join("src", "lib", "utils.ts"), utilsTs()],
-			[path.join("src", "lib", "proxy.ts"), proxyTs()],
-			[path.join("src", "main.tsx"), mainTsx()],
-		];
-
-		if (hasNetsuite) {
-			files.push(
-				[path.join("src", "lib", "netsuite.ts"), netsuiteTs()],
-				[
-					path.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
-					signInButtonTsx(),
-				],
-				[
-					path.join("src", "components", "auth", "LoginPage.tsx"),
-					netsuiteLoginPageTsx(),
-				],
-				[
-					path.join("src", "components", "auth", "AuthGate.tsx"),
-					netsuiteAuthGateTsx(),
-				],
-				[path.join("src", "App.tsx"), netsuiteAppTsx()],
-			);
-		}
-
-		const created: string[] = [];
-		for (const [filePath, content] of files) {
-			await Bun.write(path.join(dir, filePath), content);
-			created.push(filePath);
-		}
-
-		const out: string[] = [
+		const created = await writeBaseScaffold(args, context.directory);
+		return [
 			`Scaffolded ${created.length} files:`,
 			...created.map((f) => `  - ${f}`),
 			"",
@@ -740,34 +480,7 @@ export const scaffold = tool({
 			"  Header comment in that file documents slugs, response unwrapping,",
 			"  pagination, and frontend-only vs HelloLeo Cloud routing.",
 			"Update package.json with any extra packages you need after scaffolding.",
-		];
-
-		if (hasNetsuite) {
-			out.push(
-				"",
-				"NetSuite project -- auth is already wired:",
-				"  - App.tsx wraps everything in <AuthGate>. Build your dashboard",
-				"    INSIDE the gate. NEVER remove the gate or build a password",
-				"    placeholder -- real OAuth is the only allowed login.",
-				"  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated",
-				"    view. Customise the copy / imagery, keep <SignInWithNetSuite/>",
-				"    as the call-to-action.",
-				"  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at",
-				"    /auth/netsuite/start. Deploy the Worker via cloudflare-backend",
-				"    MCP with routes:",
-				"      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth",
-				"      GET  /auth/netsuite/callback  -- code -> token exchange",
-				"      GET  /api/me                   -- current session",
-				"      POST /auth/netsuite/logout    -- clear session",
-				"    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,",
-				"    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).",
-				"  - VITE_WORKER_URL must be set in the project env so the frontend",
-				"    knows where to send users. The HelloLeo Cloud provisioner",
-				"    seeds this automatically.",
-			);
-		}
-
-		return out.join("\n");
+		].join("\n");
 	},
 });
 

package/src/tools/setup-netsuite.ts

@@ -0,0 +1,353 @@
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import type { Plugin } from "@opencode-ai/plugin";
+import { tool } from "@opencode-ai/plugin";
+import { writeBaseScaffold } from "./scaffold.ts";
+
+/**
+ * One-shot bootstrap for a NetSuite project. Writes the base HelloLeo
+ * scaffold (via writeBaseScaffold) plus the NetSuite OAuth wiring
+ * (AuthGate, LoginPage, sign-in button, netsuite client, auth-gated
+ * App.tsx). All NetSuite-specific templates live in this file -- one
+ * place to read or change anything NetSuite-related.
+ *
+ * Use INSTEAD of `scaffold` when the project needs NetSuite. The tool
+ * name carries the intent so the LLM can't accidentally ship a project
+ * without the auth files.
+ */
+
+function netsuiteTs(): string {
+	return `/*
+ * NetSuite OAuth client helper (bearer-token-in-fragment).
+ *
+ * Two NetSuite Integration Records back this:
+ *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
+ *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
+ * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
+ * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
+ * the browser. Cookies are NOT used -- frontend ↔ Worker are cross-site
+ * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
+ * third-party cookies in the HelloLeo preview iframe.
+ *
+ * Flow:
+ *   1. User clicks "Sign in with NetSuite".
+ *   2. Browser navigates to the Worker /auth/netsuite/start.
+ *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
+ *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
+ *   5. Worker exchanges the code, mints a session id, then redirects to
+ *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
+ *   6. This module reads the fragment on load, stashes the sid in
+ *      sessionStorage, and sends it as Authorization: Bearer on every
+ *      Worker call.
+ *
+ * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
+ * authoritative auth state -- the only acceptable check is /api/me on the
+ * Worker. sessionStorage here is just a cache of the bearer token.
+ */
+
+export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
+const TOKEN_KEY = 'nssid';
+
+// Capture-and-strip the #nssid=... fragment as early as possible so URLs
+// shown to the user stay clean. Runs once at module load.
+(function bootstrapTokenFromHash() {
+  if (typeof window === 'undefined') return;
+  const hash = window.location.hash.replace(/^#/, '');
+  if (!hash) return;
+  const params = new URLSearchParams(hash);
+  const sid = params.get(TOKEN_KEY);
+  if (sid) {
+    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
+    params.delete(TOKEN_KEY);
+    const remaining = params.toString();
+    const newHash = remaining ? '#' + remaining : '';
+    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+  }
+})();
+
+export function getSessionToken(): string | null {
+  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+}
+
+export function signInWithNetSuite(returnTo: string = window.location.href) {
+  if (!WORKER_URL) {
+    throw new Error(
+      'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
+    );
+  }
+  const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
+  url.searchParams.set('return_to', returnTo);
+  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
+  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
+  // Worker (which 302s to NetSuite) ends up loading a page the browser
+  // refuses to render -- looks like "nothing happens" to the user. Navigate
+  // the top frame instead so the OAuth flow runs at the top level and the
+  // callback redirect lands on the same top frame, which then reads the
+  // #nssid= fragment. Fallback to same-frame navigation if the top window
+  // is cross-origin and can't be reassigned.
+  try {
+    if (window.top && window.top !== window) {
+      window.top.location.assign(url.toString());
+      return;
+    }
+  } catch {
+    /* top window not accessible — fall through to same-frame navigation */
+  }
+  window.location.assign(url.toString());
+}
+
+export interface NetSuiteSession {
+  authenticated: boolean;
+  account_id?: string;
+  user_id?: string;
+  email?: string;
+}
+
+export async function getNetSuiteSession(): Promise<NetSuiteSession> {
+  if (!WORKER_URL) return { authenticated: false };
+  const sid = getSessionToken();
+  if (!sid) return { authenticated: false };
+  const res = await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/api/me\`, {
+    headers: { Authorization: 'Bearer ' + sid },
+  });
+  if (!res.ok) return { authenticated: false };
+  const data = await res.json();
+  return { authenticated: Boolean(data?.account_id), ...data };
+}
+
+export async function signOutNetSuite(): Promise<void> {
+  if (!WORKER_URL) return;
+  const sid = getSessionToken();
+  if (sid) {
+    try {
+      await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
+        method: 'POST',
+        headers: { Authorization: 'Bearer ' + sid },
+      });
+    } catch {}
+  }
+  try { sessionStorage.removeItem(TOKEN_KEY); } catch {}
+  window.location.reload();
+}
+
+/**
+ * Helper for ALL other Worker calls (your dashboard endpoints, etc.).
+ * Always go through this instead of bare fetch -- it injects the bearer
+ * token and routes through the Worker so NetSuite tokens stay server-side.
+ */
+export async function workerFetch(pathOrUrl: string, init: RequestInit = {}): Promise<Response> {
+  if (!WORKER_URL) throw new Error('VITE_WORKER_URL is not set');
+  const url = pathOrUrl.startsWith('http')
+    ? pathOrUrl
+    : \`\${WORKER_URL.replace(/\\/$/, '')}\${pathOrUrl.startsWith('/') ? '' : '/'}\${pathOrUrl}\`;
+  const sid = getSessionToken();
+  const headers = new Headers(init.headers ?? {});
+  if (sid) headers.set('Authorization', 'Bearer ' + sid);
+  return fetch(url, { ...init, headers });
+}
+`;
+}
+
+function signInButtonTsx(): string {
+	return `import { signInWithNetSuite } from '../../lib/netsuite';
+
+export function SignInWithNetSuite() {
+  return (
+    <button
+      onClick={() => signInWithNetSuite()}
+      className="inline-flex items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+    >
+      Sign in with NetSuite
+    </button>
+  );
+}
+`;
+}
+
+function netsuiteLoginPageTsx(): string {
+	return `import { SignInWithNetSuite } from './SignInWithNetSuite';
+
+/**
+ * Default unauthenticated landing page. Replaces any password gate.
+ * Customise copy / imagery freely but keep <SignInWithNetSuite /> as the
+ * only call-to-action -- it points to the Worker's /auth/netsuite/start.
+ */
+export function LoginPage() {
+  return (
+    <div className="min-h-screen bg-background text-foreground flex">
+      <div className="hidden lg:flex lg:w-1/2 bg-primary text-primary-foreground p-12 flex-col justify-between">
+        <div className="text-xl font-semibold">NetSuite App</div>
+        <div>
+          <h1 className="text-4xl font-bold leading-tight">
+            Connect your NetSuite account
+          </h1>
+          <p className="mt-4 text-primary-foreground/80 max-w-md">
+            Sign in with your NetSuite credentials to access your data securely.
+            Tokens stay server-side on HelloLeo Cloud -- they never reach the
+            browser.
+          </p>
+        </div>
+        <div className="text-xs text-primary-foreground/60">
+          Powered by HelloLeo
+        </div>
+      </div>
+      <div className="flex-1 flex items-center justify-center px-6 py-12">
+        <div className="w-full max-w-sm space-y-6">
+          <div>
+            <h2 className="text-2xl font-semibold">Welcome</h2>
+            <p className="mt-2 text-sm text-muted-foreground">
+              Use the button below to sign in. You'll be redirected to NetSuite
+              to authorise access, then back here.
+            </p>
+          </div>
+          <SignInWithNetSuite />
+        </div>
+      </div>
+    </div>
+  );
+}
+`;
+}
+
+function netsuiteAuthGateTsx(): string {
+	return `import { useEffect, useState } from 'react';
+import { LoginPage } from './LoginPage';
+import { getNetSuiteSession, type NetSuiteSession } from '../../lib/netsuite';
+
+/**
+ * Mandatory auth gate for NetSuite projects. Wrap your real App content with
+ * <AuthGate>...</AuthGate>. Never render NetSuite data without this gate -- it
+ * is the ONLY supported authentication for a NetSuite project (no password
+ * gates, no sessionStorage flags, no shared credential).
+ *
+ * Pattern in src/App.tsx:
+ *
+ *   import { AuthGate } from './components/auth/AuthGate';
+ *   export default function App() {
+ *     return (
+ *       <AuthGate>
+ *         <Dashboard />   // your authenticated content
+ *       </AuthGate>
+ *     );
+ *   }
+ */
+export function AuthGate({ children }: { children: React.ReactNode }) {
+  const [session, setSession] = useState<NetSuiteSession | null>(null);
+
+  useEffect(() => { getNetSuiteSession().then(setSession); }, []);
+
+  if (session === null) {
+    return (
+      <div className="min-h-screen flex items-center justify-center bg-background">
+        <div className="h-8 w-8 rounded-full border-2 border-primary border-t-transparent animate-spin" />
+      </div>
+    );
+  }
+
+  if (!session.authenticated) return <LoginPage />;
+
+  return <>{children}</>;
+}
+`;
+}
+
+function netsuiteAppTsx(): string {
+	return `import { AuthGate } from './components/auth/AuthGate';
+
+/**
+ * NetSuite project entry point. KEEP <AuthGate> as the outermost element --
+ * removing it disables real OAuth and exposes NetSuite data to anonymous
+ * users. Build your dashboard / pages inside the gate.
+ */
+export default function App() {
+  return (
+    <AuthGate>
+      <div className="min-h-screen bg-background text-foreground p-8">
+        <h1 className="text-2xl font-bold">You are signed in to NetSuite.</h1>
+        <p className="text-muted-foreground mt-2">
+          Replace this placeholder with your dashboard.
+        </p>
+      </div>
+    </AuthGate>
+  );
+}
+`;
+}
+
+export const setupNetsuite = tool({
+	description:
+		"Bootstrap a NetSuite-backed React + Vite + Tailwind project in one call. " +
+		"Writes the full HelloLeo base scaffold AND the NetSuite OAuth wiring " +
+		"(src/lib/netsuite.ts, src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx, " +
+		"src/App.tsx wrapped in <AuthGate>). " +
+		"Use this INSTEAD of `scaffold` for any project that needs NetSuite. " +
+		"Uses default theme (Inter font, blue primary, 0.5rem radius) -- edit " +
+		"src/index.css afterwards to customise. Real OAuth is wired from day " +
+		"one -- never replace the gate with a password placeholder.",
+	args: {},
+	async execute(_args, context) {
+		const dir = context.directory;
+		const base = await writeBaseScaffold({}, dir);
+
+		await mkdir(path.join(dir, "src", "components", "auth"), {
+			recursive: true,
+		});
+
+		const nsFiles: [string, string][] = [
+			[path.join("src", "lib", "netsuite.ts"), netsuiteTs()],
+			[
+				path.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+				signInButtonTsx(),
+			],
+			[
+				path.join("src", "components", "auth", "LoginPage.tsx"),
+				netsuiteLoginPageTsx(),
+			],
+			[
+				path.join("src", "components", "auth", "AuthGate.tsx"),
+				netsuiteAuthGateTsx(),
+			],
+			[path.join("src", "App.tsx"), netsuiteAppTsx()],
+		];
+
+		const nsCreated: string[] = [];
+		for (const [filePath, content] of nsFiles) {
+			await Bun.write(path.join(dir, filePath), content);
+			nsCreated.push(filePath);
+		}
+
+		const all = [...base, ...nsCreated];
+		return [
+			`Scaffolded ${all.length} files (base + NetSuite OAuth):`,
+			...all.map((f) => `  - ${f}`),
+			"",
+			"Next: build your dashboard INSIDE <AuthGate> in src/App.tsx.",
+			"Design system reference: read the header comment in src/index.css",
+			"  before adding tokens or styling primitives.",
+			"",
+			"NetSuite auth -- already wired:",
+			"  - App.tsx wraps everything in <AuthGate>. NEVER remove the gate",
+			"    or build a password placeholder -- real OAuth is the only login.",
+			"  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated",
+			"    view. Customise the copy / imagery, keep <SignInWithNetSuite/>",
+			"    as the call-to-action.",
+			"  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at",
+			"    /auth/netsuite/start. Deploy the Worker via cloudflare-backend",
+			"    MCP with routes:",
+			"      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth",
+			"      GET  /auth/netsuite/callback  -- code -> token exchange",
+			"      GET  /api/me                   -- current session",
+			"      POST /auth/netsuite/logout    -- clear session",
+			"    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,",
+			"    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).",
+			"  - VITE_WORKER_URL must be set so the frontend knows where to",
+			"    send users. The HelloLeo Cloud provisioner seeds this.",
+		].join("\n");
+	},
+});
+
+export const SetupNetsuitePlugin: Plugin = async () => {
+	return {
+		tool: { setup_netsuite: setupNetsuite },
+	};
+};