@helloleo/plugins 0.2.0-beta.3 → 0.2.0-beta.5

package/src/templates/tanstack-start-2026-06-18/src/routes/__root.tsx

@@ -19,6 +19,9 @@ export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()(
       { name: 'viewport', content: 'width=device-width, initial-scale=1.0' },
       { title: '{{LEO_NAME}}' },
       { name: 'description', content: '{{LEO_DESCRIPTION}}' },
+      { property: 'og:title', content: '{{LEO_NAME}}' },
+      { property: 'og:description', content: '{{LEO_DESCRIPTION}}' },
+      { property: 'og:type', content: 'website' },
     ],
     links: [
       { rel: 'stylesheet', href: appCss },
@@ -33,8 +36,6 @@ export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()(
         href: 'https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=Space+Grotesk:wght@400;500;600;700&display=swap',
       },
     ],
-    // Leo preview telemetry, do not delete
-    scripts: [{ src: '/leo-runtime.js' }],
   }),
   component: RootComponent,
 })

package/src/tools/inspect-http.ts

@@ -3,11 +3,17 @@ import { tool } from "@opencode-ai/plugin";
 
 const z = tool.schema;
 
-const ALLOWED_BASE_HOSTS = [
-	"helloleo.dev",
-	"helloleo.app",
-	"augustin-d60.workers.dev",
-] as const;
+const hosts = {
+	"helloleo.dev": {
+		private: true,
+	},
+	"helloleo.app": {
+		private: false,
+	},
+	"augustin-d60.workers.dev": {
+		private: false,
+	},
+} as const;
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 const MAX_TIMEOUT_MS = 30_000;
@@ -81,9 +87,15 @@ export const inspectHttp = tool({
 
 		const timeoutMs = Math.max(1, Math.min(args.timeout, MAX_TIMEOUT_MS));
 
+		const previewGateSecret = process.env.PREVIEW_INSPECT_SECRET;
+		const defaultUserAgent =
+			isPrivateHost(url.hostname) && previewGateSecret
+				? `LeoInspect/${previewGateSecret}`
+				: "leoInspect/0.1";
+
 		const requestHeaders: Record<string, string> = {
 			Accept: "application/json, text/plain, */*",
-			"User-Agent": "helloleo-plugins-inspect-http/0.1",
+			"User-Agent": defaultUserAgent,
 			Origin: "https://app.helloleo.dev",
 			...args.headers,
 		};
@@ -176,16 +188,39 @@ function parseTargetUrl(raw: string): URL {
 	return url;
 }
 
+type HostBase = keyof typeof hosts;
+
+function findHostBase(hostname: string): HostBase | null {
+	const host = hostname.toLowerCase().replace(/\.$/, "");
+	for (const base of Object.keys(hosts) as HostBase[]) {
+		if (host === base || host.endsWith(`.${base}`)) return base;
+	}
+	return null;
+}
+
 function allowedHostsHuman(): string {
-	return ALLOWED_BASE_HOSTS.map((base) => `**.${base}`).join(", ");
+	return (Object.keys(hosts) as HostBase[])
+		.map((base) => `**.${base}`)
+		.join(", ");
 }
 
 function isAllowedHost(hostname: string): boolean {
-	const host = hostname.toLowerCase().replace(/\.$/, "");
-	for (const base of ALLOWED_BASE_HOSTS) {
-		if (host === base || host.endsWith(`.${base}`)) return true;
-	}
-	return false;
+	return findHostBase(hostname) !== null;
+}
+
+function isPrivateHost(hostname: string): boolean {
+	const base = findHostBase(hostname);
+	return base !== null && hosts[base].private;
+}
+
+// leo-core's nginx preview gate returns a static 403 page (see
+// _PROXY_CONF_TMPL in sandbox/preview.py) when neither ?auth=<token>, the
+// leo_auth_* cookie, nor the LeoInspect UA match. Recognize that exact page
+// so a gated preview doesn't read as an app-level failure.
+function isPreviewGate403(status: number, body: string): boolean {
+	return (
+		status === 403 && body.includes("403 Forbidden") && body.includes("nginx/")
+	);
 }
 
 function hasHeader(headers: Record<string, string>, name: string): boolean {

package/src/tools/scaffold.ts

@@ -101,7 +101,7 @@ export const scaffold = tool({
 			"- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
 			"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
 			"- shadcn/ui components are already in src/components/ui.",
-			"- Design system: edit the tokens in src/styles.css (light and dark blocks).",
+			"- Design system: style exclusively with the token utilities, never hardcoded colors. To change the look, edit the token values in src/styles.css (light and dark blocks).",
 			"- The database schema lives in src/db/schema.ts. Migrations run automatically.",
 			"- Always fetch data with react-query (useQuery and useMutation).",
 			"",