@helloleo/plugins 0.2.17 → 0.2.20

package/dist/templates/tanstack-router-2026-06-15/src/lib/proxy.ts

@@ -7,6 +7,14 @@
  * user already configured in Project Settings -- you NEVER pass an API key
  * from frontend code, and you NEVER call third-party hosts directly.
  *
+ * EXCEPTION -- NetSuite: never route it through this proxy. This proxy
+ * refreshes tokens per PROJECT (one shared credential for every end user).
+ * NetSuite runtime calls must stay per USER: the app signs each visitor in
+ * via its own /auth/netsuite/* + /api server routes and calls NetSuite with
+ * THAT visitor's session (see setup_netsuite / src/lib/netsuite-server.ts,
+ * netsuiteFetch(bearer(request), ...)). The proxy rejects "netsuite" with a
+ * 400 -- that's intentional, not a gap to fill in.
+ *
  * Two modes:
  *   A) Frontend-only project -> import callIntegration() from this file.
  *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
@@ -44,6 +52,29 @@ export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
 export const BACKEND_URL = (import.meta.env.VITE_WORKER_URL as string | undefined) ?? '';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -61,7 +92,14 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- use the setup_netsuite auth flow (its ' +
+        '/auth/netsuite + /api routes) with the signed-in user\'s session, ' +
+        'not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/dist/templates/tanstack-start-2026-06-18/src/lib/proxy.ts

@@ -7,6 +7,14 @@
  * user already configured in Project Settings -- you NEVER pass an API key
  * from frontend code, and you NEVER call third-party hosts directly.
  *
+ * EXCEPTION -- NetSuite: never route it through this proxy. This proxy
+ * refreshes tokens per PROJECT (one shared credential for every end user).
+ * NetSuite runtime calls must stay per USER: the app signs each visitor in
+ * via its own /auth/netsuite/* + /api server routes and calls NetSuite with
+ * THAT visitor's session (see setup_netsuite / src/lib/netsuite-server.ts,
+ * netsuiteFetch(bearer(request), ...)). The proxy rejects "netsuite" with a
+ * 400 -- that's intentional, not a gap to fill in.
+ *
  * Two modes:
  *   A) Frontend-only project -> import callIntegration() from this file.
  *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
@@ -41,6 +49,29 @@
 
 export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -58,7 +89,13 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
+        '/api server routes with the signed-in user\'s session, not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/dist/templates/tanstack-start-2026-07-30/src/lib/proxy.ts

@@ -41,6 +41,29 @@
 
 export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -58,7 +81,13 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
+        '/api server routes with the signed-in user\'s session, not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.17",
+  "version": "0.2.20",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-router-2026-06-15/src/lib/proxy.ts

@@ -7,6 +7,14 @@
  * user already configured in Project Settings -- you NEVER pass an API key
  * from frontend code, and you NEVER call third-party hosts directly.
  *
+ * EXCEPTION -- NetSuite: never route it through this proxy. This proxy
+ * refreshes tokens per PROJECT (one shared credential for every end user).
+ * NetSuite runtime calls must stay per USER: the app signs each visitor in
+ * via its own /auth/netsuite/* + /api server routes and calls NetSuite with
+ * THAT visitor's session (see setup_netsuite / src/lib/netsuite-server.ts,
+ * netsuiteFetch(bearer(request), ...)). The proxy rejects "netsuite" with a
+ * 400 -- that's intentional, not a gap to fill in.
+ *
  * Two modes:
  *   A) Frontend-only project -> import callIntegration() from this file.
  *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
@@ -44,6 +52,29 @@ export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
 export const BACKEND_URL = (import.meta.env.VITE_WORKER_URL as string | undefined) ?? '';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -61,7 +92,14 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- use the setup_netsuite auth flow (its ' +
+        '/auth/netsuite + /api routes) with the signed-in user\'s session, ' +
+        'not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/src/templates/tanstack-start-2026-06-18/src/lib/proxy.ts

@@ -7,6 +7,14 @@
  * user already configured in Project Settings -- you NEVER pass an API key
  * from frontend code, and you NEVER call third-party hosts directly.
  *
+ * EXCEPTION -- NetSuite: never route it through this proxy. This proxy
+ * refreshes tokens per PROJECT (one shared credential for every end user).
+ * NetSuite runtime calls must stay per USER: the app signs each visitor in
+ * via its own /auth/netsuite/* + /api server routes and calls NetSuite with
+ * THAT visitor's session (see setup_netsuite / src/lib/netsuite-server.ts,
+ * netsuiteFetch(bearer(request), ...)). The proxy rejects "netsuite" with a
+ * 400 -- that's intentional, not a gap to fill in.
+ *
  * Two modes:
  *   A) Frontend-only project -> import callIntegration() from this file.
  *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
@@ -41,6 +49,29 @@
 
 export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -58,7 +89,13 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
+        '/api server routes with the signed-in user\'s session, not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/src/templates/tanstack-start-2026-07-30/src/lib/proxy.ts

@@ -41,6 +41,29 @@
 
 export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
+// Multi-environment integrations: the published HelloLeo Cloud Worker has
+// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
+// makes the proxy resolve credentials from the project's PRODUCTION integration
+// connection (e.g. your production Odoo) instead of the development one, so a
+// published app talks to production while the preview keeps talking to staging.
+//
+// Reads the flag from the server runtime (Cloudflare Worker / Node) when
+// available; in the browser it's absent and we send no param — the proxy then
+// derives the environment from the request origin, so client-side calls from
+// the published app still resolve to production. Server-side calls (SSR / Cloud
+// Worker) carry no browser origin, which is exactly why the explicit param
+// matters there.
+function proxyUrl(): string {
+  // Read via globalThis only (no bare `process` reference) so this compiles in
+  // any scaffolded project regardless of whether node types are present.
+  const g = globalThis as {
+    HELLOLEO_ENV?: string;
+    process?: { env?: Record<string, string | undefined> };
+  };
+  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
+  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
+}
+
 export interface ProxyRequest {
   integration: string;
   endpoint: string;
@@ -58,7 +81,13 @@ export interface ProxyResponse<T = unknown> {
 export async function callIntegration<T = unknown>(
   req: ProxyRequest,
 ): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
+        '/api server routes with the signed-in user\'s session, not callIntegration().',
+    );
+  }
+  const res = await fetch(proxyUrl(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ method: 'POST', ...req }),

package/src/tools/scaffold.ts

@@ -24,20 +24,36 @@ export const SCAFFOLD_TEMPLATES = {
 
 export type ScaffoldType = keyof typeof SCAFFOLD_TEMPLATES;
 
+/**
+ * Older template ids that still ship under src/templates/ and stay valid
+ * PLUGINS_SCAFFOLD_VERSION pins (a deployment may hold back a version).
+ */
+export const LEGACY_TEMPLATES = ["tanstack-start-2026-06-18"] as const;
+
 /** Default template id, kept for callers that predate the `type` param. */
 export const SCAFFOLD_VERSION = SCAFFOLD_TEMPLATES["tanstack-start"];
 
 /**
+ * Resolve which template to render.
+ *
  * The container can pin the template via PLUGINS_SCAFFOLD_VERSION (a versioned
- * template id, e.g. "tanstack-start-2026-06-18"). Unset or unknown values
- * fall back to the tanstack-router template, so a stale env var can never
- * reproduce the ENOENT-on-missing-template failure.
+ * template id, e.g. "tanstack-start-2026-06-18"); unknown values are ignored
+ * so a stale env var can never reproduce the ENOENT-on-missing-template
+ * failure. An explicit `type` from the tool call wins the FAMILY (start vs
+ * router); the pin still supplies the version when it points inside that
+ * family. With neither, the pin decides, falling back to the router template.
  */
-export function resolveTemplateId(): string {
+export function resolveTemplateId(type?: ScaffoldType): string {
 	const version = process.env.PLUGINS_SCAFFOLD_VERSION;
-	const known: string[] = Object.values(SCAFFOLD_TEMPLATES);
-	if (version && known.includes(version)) return version;
-	return SCAFFOLD_TEMPLATES["tanstack-router"];
+	const known: string[] = [
+		...Object.values(SCAFFOLD_TEMPLATES),
+		...LEGACY_TEMPLATES,
+	];
+	const pinned = version && known.includes(version) ? version : undefined;
+	if (type) {
+		return pinned?.startsWith(type) ? pinned : SCAFFOLD_TEMPLATES[type];
+	}
+	return pinned ?? SCAFFOLD_TEMPLATES["tanstack-router"];
 }
 
 /**
@@ -73,18 +89,18 @@ const scaffoldOptionsSchema = z.object({
 	description: z
 		.string()
 		.describe("One sentence describing the app. Used as the meta description."),
-	// type: z
-	// 	.enum(["tanstack-start", "tanstack-router"])
-	// 	.optional()
-	// 	.describe(
-	// 		"Project type. 'tanstack-router': " +
-	// 			"client-only SPA with no server and no database — use it only for " +
-	// 			"pure frontends that talk to external APIs." +
-	// 			"'tanstack-start': SSR app with API routes and a " +
-	// 			"database, KV and bucket — use it whenever the app " +
-	// 			"needs to persist data or run server-side code (experimental, " +
-	// 			"use only if the user expresses a really complexe application idea).",
-	// 	),
+	type: z
+		.enum(["tanstack-start", "tanstack-router"])
+		.optional()
+		.describe(
+			"Project type. 'tanstack-start': SSR app with API routes and a " +
+				"database, KV and bucket — use it whenever the app needs to " +
+				"persist data or run server-side code, and always for " +
+				"setup_authentication (it needs server routes). " +
+				"'tanstack-router': client-only SPA with no server and no database " +
+				"— use it only for pure frontends that talk to external APIs. " +
+				"Omit to use the deployment's default.",
+		),
 });
 
 /** Kebab-case slug of the product name, for package.json. */
@@ -103,10 +119,10 @@ function slugify(name: string): string {
  * not part of the template tree). Returns the relative paths written.
  */
 export async function writeBaseScaffold(
-	{ name, description }: z.infer<typeof scaffoldOptionsSchema>,
+	{ name, description, type }: z.infer<typeof scaffoldOptionsSchema>,
 	dir: string,
 ): Promise<string[]> {
-	const templateId = resolveTemplateId();
+	const templateId = resolveTemplateId(type);
 	const projectUuid = projectUuidFromDir(dir);
 	const created = await renderTemplate(
 		templateId,
@@ -133,15 +149,17 @@ export async function writeBaseScaffold(
 export const scaffold = tool({
 	description:
 		"Scaffold a new project with React 19, file-based routing (TanStack), " +
-		"Tailwind v4, shadcn/ui, and react-query. Call this first for any new" +
-		" project, before writing routes or components.",
+		"Tailwind v4, shadcn/ui, and react-query. Two types: 'tanstack-start' " +
+		"(SSR, API routes, and a database, KV and bucket via @helloleo/runtime) " +
+		"or 'tanstack-router' (client-only SPA, no server, no database). Call " +
+		"this first for any new project, before writing routes or components.",
 	args: {
 		name: scaffoldOptionsSchema.shape.name,
 		description: scaffoldOptionsSchema.shape.description,
+		type: scaffoldOptionsSchema.shape.type,
 	},
 	async execute(args, context) {
-		const isStart =
-			resolveTemplateId() === SCAFFOLD_TEMPLATES["tanstack-start"];
+		const isStart = resolveTemplateId(args.type).startsWith("tanstack-start");
 		const created = await writeBaseScaffold(args, context.directory);
 		const uiComponents = created.filter((f) =>
 			f.startsWith("src/components/ui/"),