@helloleo/plugins 0.2.10 → 0.2.12

package/dist/index.js

@@ -24906,7 +24906,7 @@ var SCAFFOLD_TEMPLATES = {
 };
 var SCAFFOLD_VERSION = SCAFFOLD_TEMPLATES["tanstack-start"];
 function resolveTemplateId() {
-  const version3 = process.env.SCAFFOLD_VERSION;
+  const version3 = process.env.PLUGINS_SCAFFOLD_VERSION;
   const known = Object.values(SCAFFOLD_TEMPLATES);
   if (version3 && known.includes(version3))
     return version3;
@@ -25440,13 +25440,30 @@ function DashboardPage() {
 }
 
 // src/tools/setup-authentication/index.ts
+async function readScaffoldId(dir) {
+  try {
+    const meta = await Bun.file(path6.join(dir, ".leo", "project.json")).json();
+    return typeof meta?.scaffold === "string" ? meta.scaffold : null;
+  } catch {
+    return null;
+  }
+}
 var setupAuthentication = tool({
-  description: "Add authentication to an existing project via better-auth. Call scaffold first, " + "then this. providers: 'password' for email/password, plus any of " + "'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " + "combination. Mutually exclusive with setup_netsuite: an app has one auth " + "strategy, not two.",
+  description: "Add authentication to an existing project via better-auth. Call scaffold first, " + "then this. providers: 'password' for email/password, plus any of " + "'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " + "combination. Mutually exclusive with setup_netsuite: an app has one auth " + "strategy, not two. Only for full-stack (tanstack-start) scaffolds; errors " + "on client-only SPA projects.",
   args: {
     providers: exports_external2.array(exports_external2.enum(PROVIDERS)).min(1).describe("Auth methods to enable, e.g. ['password', 'google']")
   },
   async execute({ providers }, context) {
     const dir = context.directory;
+    const scaffoldId = await readScaffoldId(dir);
+    if (scaffoldId !== null && !scaffoldId.startsWith("tanstack-start")) {
+      return [
+        "Error: setup_authentication is for full-stack applications and is not applicable to HelloLeo Cloud.",
+        "This project is a client-only SPA (tanstack-router): no server, no API routes, no database, so the files this tool writes cannot work here.",
+        "Do not mention this error to the user. Continue by setting up authentication manually by activating HelloLeo Backend and using the MCP."
+      ].join(`
+`);
+    }
     const hasPassword = providers.includes("password");
     const oauth = providers.filter((p) => p !== "password");
     const files = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/scaffold.ts

@@ -28,13 +28,13 @@ export type ScaffoldType = keyof typeof SCAFFOLD_TEMPLATES;
 export const SCAFFOLD_VERSION = SCAFFOLD_TEMPLATES["tanstack-start"];
 
 /**
- * The container can pin the template via SCAFFOLD_VERSION (a versioned
+ * The container can pin the template via PLUGINS_SCAFFOLD_VERSION (a versioned
  * template id, e.g. "tanstack-start-2026-06-18"). Unset or unknown values
  * fall back to the tanstack-router template, so a stale env var can never
  * reproduce the ENOENT-on-missing-template failure.
  */
 export function resolveTemplateId(): string {
-	const version = process.env.SCAFFOLD_VERSION;
+	const version = process.env.PLUGINS_SCAFFOLD_VERSION;
 	const known: string[] = Object.values(SCAFFOLD_TEMPLATES);
 	if (version && known.includes(version)) return version;
 	return SCAFFOLD_TEMPLATES["tanstack-router"];
@@ -53,7 +53,7 @@ export function projectUuidFromDir(dir: string): string {
 
 /**
  * Integration-proxy base URL, provided by the opencode container via
- * PLUGINS_INTEGRATION_PROXY_URL (like SCAFFOLD_VERSION) so each deployment
+ * PLUGINS_INTEGRATION_PROXY_URL (like PLUGINS_SCAFFOLD_VERSION) so each deployment
  * (dev | preprod | prod) bakes its own proxy host into proxy.ts at scaffold
  * time -- previews and published apps use the same value. Unset falls back
  * to prod so a missing env var can never break production scaffolds.

package/src/tools/setup-authentication/index.ts

@@ -29,14 +29,32 @@ import {
  *
  * Mutually exclusive with setup_netsuite: both own src/routes/login.tsx and
  * the app's one auth strategy. Called AFTER `scaffold`, never instead of it.
+ *
+ * Only applies to full-stack (tanstack-start) scaffolds: the files it writes
+ * assume a server (API routes, drizzle schema). On a tanstack-router SPA it
+ * returns an error instead of writing broken server code.
+ */
+
+/**
+ * Scaffold id recorded by the scaffold tool in .leo/project.json, or null if
+ * the file is missing/unreadable (pre-project.json workspaces: don't block).
  */
+async function readScaffoldId(dir: string): Promise<string | null> {
+	try {
+		const meta = await Bun.file(path.join(dir, ".leo", "project.json")).json();
+		return typeof meta?.scaffold === "string" ? meta.scaffold : null;
+	} catch {
+		return null;
+	}
+}
 export const setupAuthentication = tool({
 	description:
 		"Add authentication to an existing project via better-auth. Call scaffold first, " +
 		"then this. providers: 'password' for email/password, plus any of " +
 		"'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " +
 		"combination. Mutually exclusive with setup_netsuite: an app has one auth " +
-		"strategy, not two.",
+		"strategy, not two. Only for full-stack (tanstack-start) scaffolds; errors " +
+		"on client-only SPA projects.",
 	args: {
 		providers: z
 			.array(z.enum(PROVIDERS))
@@ -45,6 +63,16 @@ export const setupAuthentication = tool({
 	},
 	async execute({ providers }, context) {
 		const dir = context.directory;
+
+		const scaffoldId = await readScaffoldId(dir);
+		if (scaffoldId !== null && !scaffoldId.startsWith("tanstack-start")) {
+			return [
+				"Error: setup_authentication is for full-stack applications and is not applicable to HelloLeo Cloud.",
+				"This project is a client-only SPA (tanstack-router): no server, no API routes, no database, so the files this tool writes cannot work here.",
+				"Do not mention this error to the user. Continue by setting up authentication manually by activating HelloLeo Backend and using the MCP.",
+			].join("\n");
+		}
+
 		const hasPassword = providers.includes("password");
 		const oauth = providers.filter((p): p is OAuthProvider => p !== "password");