@helloleo/plugins 0.2.8 → 0.2.10

package/dist/index.js

@@ -24915,6 +24915,10 @@ function resolveTemplateId() {
 function projectUuidFromDir(dir) {
   return path3.basename(dir);
 }
+function integrationProxyUrl(projectUuid) {
+  const base = (process.env.PLUGINS_INTEGRATION_PROXY_URL || "https://api.app.helloleo.dev").replace(/\/+$/, "");
+  return `${base}/api/integration-proxy/${projectUuid}`;
+}
 var scaffoldOptionsSchema = exports_external2.object({
   name: exports_external2.string().describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
   description: exports_external2.string().describe("One sentence describing the app. Used as the meta description.")
@@ -24924,11 +24928,13 @@ function slugify(name) {
 }
 async function writeBaseScaffold({ name, description }, dir) {
   const templateId = resolveTemplateId();
+  const projectUuid = projectUuidFromDir(dir);
   const created = await renderTemplate(templateId, {
     LEO_NAME: name,
     LEO_SLUG: slugify(name),
     LEO_DESCRIPTION: description,
-    LEO_PROJECT_UUID: projectUuidFromDir(dir)
+    LEO_PROJECT_UUID: projectUuid,
+    LEO_INTEGRATION_PROXY_URL: integrationProxyUrl(projectUuid)
   }, dir);
   await mkdir(path3.join(dir, ".leo"), { recursive: true });
   const leoPath = path3.join(".leo", "project.json");
@@ -25568,28 +25574,51 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
     );
   }
+  const workerOrigin = new URL(WORKER_URL).origin;
   const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
   url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
-  // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
-  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
-  // throws a SecurityError, which would drop us into the same-frame fallback
-  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
-  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
-  try {
-    if (window.top && window.top !== window) {
-      window.top.location.href = url.toString();
-      return;
+  // popup=1 tells the Worker callback to postMessage the session id back to
+  // THIS window (then close) instead of a #nssid= redirect.
+  url.searchParams.set('popup', '1');
+
+  // Open OAuth in a POPUP -- not the iframe, not the top frame. NetSuite's OAuth
+  // page is X-Frame-Options: DENY (can't load in an iframe), and navigating the
+  // TOP frame replaces the HelloLeo preview and lands the session in a DIFFERENT
+  // browsing context -- so back in the preview iframe (its own partitioned
+  // sessionStorage) you still see the login even after signing in. A popup keeps
+  // the app + preview intact and hands the token back to this exact context.
+  const popup = window.open(
+    url.toString(),
+    'netsuite-oauth',
+    'width=600,height=760,menubar=no,toolbar=no',
+  );
+
+  if (!popup) {
+    // Popup blocked -> fall back to top-frame navigation (works first-party / in
+    // a standalone tab; the callback then uses the #nssid= redirect).
+    try {
+      if (window.top && window.top !== window) {
+        window.top.location.href = url.toString();
+        return;
+      }
+    } catch {
+      /* top window not accessible */
     }
-  } catch {
-    /* top window not accessible \u2014 fall through to same-frame navigation */
+    window.location.href = url.toString();
+    return;
   }
-  window.location.href = url.toString();
+
+  const onMessage = (event: MessageEvent) => {
+    if (event.origin !== workerOrigin) return;
+    const data = event.data as { type?: string; nssid?: string } | null;
+    if (!data || data.type !== 'netsuite-auth' || !data.nssid) return;
+    try { sessionStorage.setItem(TOKEN_KEY, data.nssid); } catch {}
+    window.removeEventListener('message', onMessage);
+    try { popup.close(); } catch {}
+    // Re-render as signed-in -- the auth provider re-checks /api/me on load.
+    window.location.reload();
+  };
+  window.addEventListener('message', onMessage);
 }
 
 export interface NetSuiteSession {
@@ -25868,6 +25897,7 @@ var setupNetsuite = tool({
       "- Read the session anywhere with useNetSuiteAuth() from src/lib/auth.tsx.",
       "- Never replace AuthLayout with a password gate. Real OAuth is the only supported login.",
       "- The auth worker (deployed via the cloudflare-backend MCP) serves /auth/netsuite/start, /auth/netsuite/callback, /api/me and /auth/netsuite/logout. It reads env.NETSUITE_ACCOUNT_ID, _CLIENT_ID and _CLIENT_SECRET. VITE_WORKER_URL must be set (HelloLeo Cloud seeds it).",
+      "- POPUP FLOW (required so login works inside the HelloLeo preview iframe): the client opens /auth/netsuite/start in a popup with ?popup=1. The worker MUST carry that flag through OAuth (persist it on the flow row in /start, read it back in /callback via state). In /auth/netsuite/callback, when the flow was popup, DO NOT redirect to return_to#nssid \u2014 instead return an HTML page whose script does: window.opener.postMessage({ type: 'netsuite-auth', nssid: SID }, '*'); window.close(); (fall back to the return_to#nssid redirect only when there is no opener / not a popup). Without this, the preview iframe (partitioned sessionStorage) keeps showing the login after sign-in.",
       "",
       "Next: in src/routes/__root.tsx, import AuthLayout and wrap <Outlet /> with it. Keep any existing providers.",
       "",

package/dist/templates/tanstack-router-2026-06-15/src/lib/proxy.ts

@@ -39,8 +39,10 @@
  * from a Worker. Never embed secrets in frontend code.
  */
 
-export const INTEGRATION_PROXY_URL =
-  'https://api.app.helloleo.dev/api/integration-proxy/{{LEO_PROJECT_UUID}}';
+
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
+
+export const BACKEND_URL = (import.meta.env.VITE_WORKER_URL as string | undefined) ?? '';
 
 export interface ProxyRequest {
   integration: string;

package/dist/templates/tanstack-start-2026-06-18/src/lib/proxy.ts

@@ -39,8 +39,7 @@
  * from a Worker. Never embed secrets in frontend code.
  */
 
-export const INTEGRATION_PROXY_URL =
-  'https://api.app.helloleo.dev/api/integration-proxy/{{LEO_PROJECT_UUID}}';
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
 export interface ProxyRequest {
   integration: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-router-2026-06-15/src/lib/proxy.ts

@@ -39,8 +39,10 @@
  * from a Worker. Never embed secrets in frontend code.
  */
 
-export const INTEGRATION_PROXY_URL =
-  'https://api.app.helloleo.dev/api/integration-proxy/{{LEO_PROJECT_UUID}}';
+
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
+
+export const BACKEND_URL = (import.meta.env.VITE_WORKER_URL as string | undefined) ?? '';
 
 export interface ProxyRequest {
   integration: string;

package/src/templates/tanstack-start-2026-06-18/src/lib/proxy.ts

@@ -39,8 +39,7 @@
  * from a Worker. Never embed secrets in frontend code.
  */
 
-export const INTEGRATION_PROXY_URL =
-  'https://api.app.helloleo.dev/api/integration-proxy/{{LEO_PROJECT_UUID}}';
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
 
 export interface ProxyRequest {
   integration: string;

package/src/tools/scaffold.ts

@@ -51,6 +51,21 @@ export function projectUuidFromDir(dir: string): string {
 	return path.basename(dir);
 }
 
+/**
+ * Integration-proxy base URL, provided by the opencode container via
+ * PLUGINS_INTEGRATION_PROXY_URL (like SCAFFOLD_VERSION) so each deployment
+ * (dev | preprod | prod) bakes its own proxy host into proxy.ts at scaffold
+ * time -- previews and published apps use the same value. Unset falls back
+ * to prod so a missing env var can never break production scaffolds.
+ */
+export function integrationProxyUrl(projectUuid: string): string {
+	const base = (
+		process.env.PLUGINS_INTEGRATION_PROXY_URL || "https://api.app.helloleo.dev"
+	).replace(/\/+$/, "");
+
+	return `${base}/api/integration-proxy/${projectUuid}`;
+}
+
 const scaffoldOptionsSchema = z.object({
 	name: z
 		.string()
@@ -92,13 +107,15 @@ export async function writeBaseScaffold(
 	dir: string,
 ): Promise<string[]> {
 	const templateId = resolveTemplateId();
+	const projectUuid = projectUuidFromDir(dir);
 	const created = await renderTemplate(
 		templateId,
 		{
 			LEO_NAME: name,
 			LEO_SLUG: slugify(name),
 			LEO_DESCRIPTION: description,
-			LEO_PROJECT_UUID: projectUuidFromDir(dir),
+			LEO_PROJECT_UUID: projectUuid,
+			LEO_INTEGRATION_PROXY_URL: integrationProxyUrl(projectUuid),
 		},
 		dir,
 	);

package/src/tools/setup-netsuite.ts

@@ -74,28 +74,51 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
     );
   }
+  const workerOrigin = new URL(WORKER_URL).origin;
   const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
   url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
-  // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
-  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
-  // throws a SecurityError, which would drop us into the same-frame fallback
-  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
-  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
-  try {
-    if (window.top && window.top !== window) {
-      window.top.location.href = url.toString();
-      return;
+  // popup=1 tells the Worker callback to postMessage the session id back to
+  // THIS window (then close) instead of a #nssid= redirect.
+  url.searchParams.set('popup', '1');
+
+  // Open OAuth in a POPUP -- not the iframe, not the top frame. NetSuite's OAuth
+  // page is X-Frame-Options: DENY (can't load in an iframe), and navigating the
+  // TOP frame replaces the HelloLeo preview and lands the session in a DIFFERENT
+  // browsing context -- so back in the preview iframe (its own partitioned
+  // sessionStorage) you still see the login even after signing in. A popup keeps
+  // the app + preview intact and hands the token back to this exact context.
+  const popup = window.open(
+    url.toString(),
+    'netsuite-oauth',
+    'width=600,height=760,menubar=no,toolbar=no',
+  );
+
+  if (!popup) {
+    // Popup blocked -> fall back to top-frame navigation (works first-party / in
+    // a standalone tab; the callback then uses the #nssid= redirect).
+    try {
+      if (window.top && window.top !== window) {
+        window.top.location.href = url.toString();
+        return;
+      }
+    } catch {
+      /* top window not accessible */
     }
-  } catch {
-    /* top window not accessible — fall through to same-frame navigation */
+    window.location.href = url.toString();
+    return;
   }
-  window.location.href = url.toString();
+
+  const onMessage = (event: MessageEvent) => {
+    if (event.origin !== workerOrigin) return;
+    const data = event.data as { type?: string; nssid?: string } | null;
+    if (!data || data.type !== 'netsuite-auth' || !data.nssid) return;
+    try { sessionStorage.setItem(TOKEN_KEY, data.nssid); } catch {}
+    window.removeEventListener('message', onMessage);
+    try { popup.close(); } catch {}
+    // Re-render as signed-in -- the auth provider re-checks /api/me on load.
+    window.location.reload();
+  };
+  window.addEventListener('message', onMessage);
 }
 
 export interface NetSuiteSession {
@@ -388,6 +411,7 @@ export const setupNetsuite = tool({
 			"- Read the session anywhere with useNetSuiteAuth() from src/lib/auth.tsx.",
 			"- Never replace AuthLayout with a password gate. Real OAuth is the only supported login.",
 			"- The auth worker (deployed via the cloudflare-backend MCP) serves /auth/netsuite/start, /auth/netsuite/callback, /api/me and /auth/netsuite/logout. It reads env.NETSUITE_ACCOUNT_ID, _CLIENT_ID and _CLIENT_SECRET. VITE_WORKER_URL must be set (HelloLeo Cloud seeds it).",
+			"- POPUP FLOW (required so login works inside the HelloLeo preview iframe): the client opens /auth/netsuite/start in a popup with ?popup=1. The worker MUST carry that flag through OAuth (persist it on the flow row in /start, read it back in /callback via state). In /auth/netsuite/callback, when the flow was popup, DO NOT redirect to return_to#nssid — instead return an HTML page whose script does: window.opener.postMessage({ type: 'netsuite-auth', nssid: SID }, '*'); window.close(); (fall back to the return_to#nssid redirect only when there is no opener / not a popup). Without this, the preview iframe (partitioned sessionStorage) keeps showing the login after sign-in.",
 			"",
 			"Next: in src/routes/__root.tsx, import AuthLayout and wrap <Outlet /> with it. Keep any existing providers.",
 			"",