@ryuhq/sdk 0.1.14 → 0.2.2

package/src/manifest-schema.test.ts

@@ -7,6 +7,7 @@
 import { describe, expect, test } from "bun:test";
 import {
 	CompanionSurfaceSchema,
+	ChatWidgetTemplateSchema,
 	labelImpersonatesSystemChrome,
 	PluginManifestSchema,
 	RunnableMetaSchema,
@@ -22,6 +23,34 @@ function baseManifest(overrides: Record<string, unknown> = {}) {
 	};
 }
 
+test("chat widget templates keep host rendering data-only and forward compatible", () => {
+	const available = ChatWidgetTemplateSchema.safeParse({
+		id: "meetings.chat",
+		title: "Meetings widget",
+		triggers: ["meetings widget"],
+		examples: ["Show my meetings"],
+		backing: { view_id: "surface:meetings" },
+		display_mode: "inline",
+		safe_action_ids: ["refresh"],
+	}).success;
+	const comingSoon = ChatWidgetTemplateSchema.safeParse({
+		id: "future.chat",
+		title: "Future widget",
+		backing: {},
+		display_mode: "compact-future-mode",
+		availability: "coming-soon",
+	}).success;
+	const unsafe = ChatWidgetTemplateSchema.safeParse({
+		id: "future/chat",
+		title: "Unsafe",
+		backing: { tool_id: "future.render" },
+		display_mode: "inline",
+	}).success;
+	expect(available).toBe(true);
+	expect(comingSoon).toBe(true);
+	expect(unsafe).toBe(false);
+});
+
 // ── semver regex ──────────────────────────────────────────────────────────────
 
 describe("PluginManifest version (semver regex)", () => {
@@ -171,7 +200,7 @@ describe("RunnableMetaSchema", () => {
 			id: "x",
 			name: "X",
 			kind: "tool",
-			config: { widget: true, slug: "x__render" },
+			config: { widget: true, slug: "x.render" },
 		});
 		expect(parsed.success).toBe(true);
 		if (!parsed.success) {

package/src/manifest.fixtures.test.ts

@@ -17,7 +17,8 @@
  *
  * The set is read from Core's tree so a new shipped plugin is covered the moment it
  * lands, without touching this file. It spans BOTH homes: the packaged manifests
- * live in `apps-store/<x>/manifest.json` and `plugins-store/<x>/manifest.json` (Core
+ * live in `apps-store/<x>/manifest.json` and
+ * `plugins-store/{plugins,lsp,external_plugins}/<x>/manifest.json` (Core
  * `include_str!`s them from there), and only the ~13 Core-only ones remain under
  * `apps/core/src/plugin_manifest/fixtures/`. Reading just the fixtures dir would
  * still pass — on 13 files instead of 71 — so both roots are walked deliberately.
@@ -39,7 +40,12 @@ import {
 const REPO_ROOT = join(import.meta.dir, "../../..");
 const FIXTURES_DIR = join(REPO_ROOT, "apps/core/src/plugin_manifest/fixtures");
 /** The package roots whose `manifest.json` Core compiles in directly. */
-const PACKAGE_ROOTS = ["apps-store", "plugins-store"];
+const PACKAGE_ROOTS = [
+	"apps-store",
+	"plugins-store/plugins",
+	"plugins-store/lsp",
+	"plugins-store/external_plugins",
+];
 
 interface RawManifest {
 	companion?: { label?: unknown };
@@ -127,18 +133,28 @@ const SDK_KNOWN_KINDS = new Set([
 const VALID_HOOK_PHASES = new Set([
 	"post_assistant_turn",
 	"pre_user_turn",
+	"pre_model_select",
+	"action",
 	"session_start",
 	"stop",
 	"pre_tool_use",
 	"post_tool_use",
+	"tool_result",
 	"subagent_stop",
 	"session_end",
 	"notification",
+	"context",
+	"message_end",
+	"session_before_compact",
+	"session_compact",
+	"model_select",
+	"session_tree",
 	// Kernel lifecycle phases fired by Core's own subsystems (the workflow
 	// executor), not by any app.
 	"workflow_run_started",
 	"workflow_run_finished",
 	"workflow_run_failed",
+	"delegation_lifecycle",
 ]);
 
 /** An **app event** — a phase some app declares in `contributes.hook_events`,
@@ -303,15 +319,15 @@ describe("glob_match oracle (ported from Core)", () => {
 		expect(globMatch("bash", "bashx")).toBe(false);
 	});
 	it("trailing star is a prefix match", () => {
-		expect(globMatch("bash*", "bash__run")).toBe(true);
+		expect(globMatch("bash*", "bash.run")).toBe(true);
 		expect(globMatch("bash*", "sh")).toBe(false);
 	});
 	it("leading star is a suffix match", () => {
-		expect(globMatch("*write", "fs__write")).toBe(true);
+		expect(globMatch("*write", "fs.write")).toBe(true);
 		expect(globMatch("*write", "writer")).toBe(false);
 	});
 	it("double star is a substring match", () => {
-		expect(globMatch("*edit*", "editor__do_edit")).toBe(true);
+		expect(globMatch("*edit*", "editor.do_edit")).toBe(true);
 		expect(globMatch("*edit*", "read_only")).toBe(false);
 	});
 	it("an interior star degrades to an exact-literal match (Core has no compile step)", () => {
@@ -409,7 +425,7 @@ describe("PluginManifestSchema preserves turn_hook.match", () => {
 			// `tool-firewall` is a packaged plugin, so its manifest lives in its
 			// package directory — there is no fixture copy any more.
 			readFileSync(
-				join(REPO_ROOT, "plugins-store/tool-firewall/manifest.json"),
+				join(REPO_ROOT, "plugins-store/plugins/tool-firewall/manifest.json"),
 				"utf8"
 			)
 		);

package/src/manifest.test.ts

@@ -26,6 +26,7 @@ import { join } from "node:path";
 import { agent, app, PluginBuilder, skill, tool, workflow } from "./builder.ts";
 import { PluginManifestSchema } from "./manifest.ts";
 import { defineApp } from "./runnable/app.ts";
+import { defineTool } from "./runnable/tool.ts";
 
 // ── builder unit tests ────────────────────────────────────────────────────────
 
@@ -302,7 +303,7 @@ describe("defineApp", () => {
 		const widgets = manifest.contributes?.widgets ?? [];
 
 		expect(widgets).toHaveLength(1);
-		expect(widgets[0]?.tool_id).toBe("checklist__render");
+		expect(widgets[0]?.tool_id).toBe("checklist.render");
 		expect(widgets[0]?.uri).toBe("ui://widget/checklist.html");
 		expect(widgets[0]?.ui_entry).toBe("src/checklist.tsx");
 		expect(widgets[0]?.mime).toBe("text/html+skybridge");
@@ -314,9 +315,9 @@ describe("defineApp", () => {
 		expect(manifest.runnables).toHaveLength(2);
 		expect(manifest.runnables.every((r) => r.kind === "tool")).toBe(true);
 
-		const render = manifest.runnables.find((r) => r.id === "checklist__render");
+		const render = manifest.runnables.find((r) => r.id === "checklist.render");
 		expect(render?.config).toMatchObject({
-			slug: "checklist__render",
+			slug: "checklist.render",
 			// The manifest is the only channel for a packed app: description +
 			// input_schema must survive so Core can rebuild a driveable tool.
 			description: "Render a checklist",
@@ -332,9 +333,9 @@ describe("defineApp", () => {
 			invoked: "Ready",
 		});
 
-		const toggle = manifest.runnables.find((r) => r.id === "checklist__toggle");
+		const toggle = manifest.runnables.find((r) => r.id === "checklist.toggle");
 		expect(toggle?.config).toMatchObject({
-			slug: "checklist__toggle",
+			slug: "checklist.toggle",
 			widget: false,
 			widget_accessible: true,
 		});
@@ -350,19 +351,62 @@ describe("defineApp", () => {
 			uiEntry: "src/chart.tsx",
 			tools: [{ name: "render", description: "Render a chart" }],
 		});
-		const render = manifest.runnables.find((r) => r.id === "chart__render");
+		const render = manifest.runnables.find((r) => r.id === "chart.render");
 		expect(render?.config).toMatchObject({
 			widget: true,
 			widget_accessible: false,
 		});
 		// `server` override qualifies the tool id and the widget binding.
-		expect(manifest.contributes?.widgets[0]?.tool_id).toBe("chart__render");
+		expect(manifest.contributes?.widgets[0]?.tool_id).toBe("chart.render");
 		// The widget uri still derives from the slug, not the server.
 		expect(manifest.contributes?.widgets[0]?.uri).toBe(
 			"ui://widget/chart-studio.html"
 		);
 	});
 
+	it("embeds an executable ToolRunnable in the widget tool", () => {
+		const renderTool = defineTool({
+			id: "support.render",
+			name: "Support answer",
+			schema: {
+				type: "object",
+				properties: { message: { type: "string" } },
+				required: ["message"],
+			},
+			run: async (input) => ({
+				content: [{ type: "text", text: input.message }],
+				structuredContent: { answer: input.message },
+			}),
+		});
+		const manifest = defineApp({
+			id: "com.example.support",
+			title: "Support",
+			version: "1.0.0",
+			slug: "support",
+			uiEntry: "src/widget.html",
+			tools: [
+				{
+					name: "render",
+					description: "Answer a support question",
+					inputSchema: renderTool.schema as unknown as Record<string, unknown>,
+					runnable: renderTool,
+				},
+			],
+		});
+		const render = manifest.runnables[0];
+
+		expect(render?.config).toMatchObject({
+			backend: "inline_deno",
+			code: renderTool.code,
+			input_schema: renderTool.schema,
+			widget: true,
+		});
+		expect(manifest.permission_grants).toEqual([
+			"widget:render",
+			"tool:execute",
+		]);
+	});
+
 	it("round-trips through PluginManifestSchema without stripping widgets", () => {
 		// The load-bearing check: `contributes.widgets` is only preserved because it
 		// was added to `ContributesSchema`. A JSON round-trip proves the field
@@ -377,12 +421,12 @@ describe("defineApp", () => {
 		}
 		expect(parsed.data.contributes?.widgets).toHaveLength(1);
 		expect(parsed.data.contributes?.widgets[0]?.tool_id).toBe(
-			"checklist__render"
+			"checklist.render"
 		);
 		// description + input_schema survive the strict parse (the only channel for
 		// a packed app — no `generated.rs` on the Core side).
 		const render = parsed.data.runnables.find(
-			(r) => r.id === "checklist__render"
+			(r) => r.id === "checklist.render"
 		);
 		expect(render?.config?.description).toBe("Render a checklist");
 		expect(render?.config?.input_schema).toBeDefined();
@@ -423,7 +467,7 @@ describe("AppBuilder", () => {
 		expect(manifest.id).toBe("com.example.checklist");
 		expect(manifest.runnables).toHaveLength(2);
 		expect(manifest.contributes?.widgets).toHaveLength(1);
-		expect(manifest.contributes?.widgets[0]?.tool_id).toBe("checklist__render");
+		expect(manifest.contributes?.widgets[0]?.tool_id).toBe("checklist.render");
 		// The author's own grant, plus the `widget:render` the builder adds because
 		// this app synthesises a widget — without it Core silently degrades the
 		// widget to plain text.
@@ -774,3 +818,114 @@ describe("contributes.lsp_servers", () => {
 		expect(parsed.data.contributes?.lsp_servers).toEqual({});
 	});
 });
+
+describe("contributes.message_actions", () => {
+	it("preserves renderer-specific action args through the pack-path parse", () => {
+		const action = {
+			args: {
+				dispatch: "reactions.toggle",
+				renderer: "reaction-picker",
+			},
+			capability: "reactions.toggle",
+			id: "reactions.picker",
+			kind: "menu",
+			label: "Add reaction",
+			plugin: "@ryu/reactions",
+			target: "user",
+		};
+		const parsed = PluginManifestSchema.safeParse({
+			id: "com.example.reactions",
+			name: "Reactions",
+			version: "1.0.0",
+			runnables: [],
+			contributes: { message_actions: [action] },
+		});
+
+		expect(parsed.success).toBe(true);
+		if (!parsed.success) {
+			return;
+		}
+		expect(parsed.data.contributes?.message_actions).toEqual([action]);
+	});
+});
+
+describe("contributes.selection_actions", () => {
+	it("preserves host-owned selection dispatch args through the pack-path parse", () => {
+		const action = {
+			args: { dispatch: "side-chat.selection", intent: "explain" },
+			id: "side-chats.explain-selection",
+			kind: "button",
+			label: "Explain",
+			order: 110,
+		};
+		const parsed = PluginManifestSchema.safeParse({
+			id: "com.example.side-chats",
+			name: "Side Chats",
+			version: "1.0.0",
+			runnables: [],
+			contributes: { selection_actions: [action] },
+		});
+
+		expect(parsed.success).toBe(true);
+		if (!parsed.success) {
+			return;
+		}
+		expect(parsed.data.contributes?.selection_actions).toEqual([action]);
+	});
+});
+
+describe("mcp_servers OAuth", () => {
+	const manifest = {
+		id: "com.example.mail",
+		mcp_servers: {
+			mail: {
+				auth: { client_id: "public-client", type: "oauth" },
+				type: "streamable-http",
+				url: "https://mcp.example.com/mcp",
+			},
+		},
+		name: "Mail",
+		permission_grants: ["mcp:server", "identity.read"],
+		runnables: [],
+		version: "1.0.0",
+	};
+
+	it("preserves the public OAuth declaration through the pack-path parse", () => {
+		const parsed = PluginManifestSchema.parse(manifest);
+		expect(parsed.mcp_servers?.mail?.auth).toEqual({
+			client_id: "public-client",
+			type: "oauth",
+		});
+	});
+
+	it("rejects secret auth fields and non-loopback plaintext URLs", () => {
+		expect(
+			PluginManifestSchema.safeParse({
+				...manifest,
+				mcp_servers: {
+					mail: {
+						...manifest.mcp_servers.mail,
+						auth: { client_secret: "nope", type: "oauth" },
+					},
+				},
+			}).success
+		).toBe(false);
+		expect(
+			PluginManifestSchema.safeParse({
+				...manifest,
+				mcp_servers: {
+					mail: { auth: { type: "oauth" }, url: "http://mcp.example.com" },
+				},
+			}).success
+		).toBe(false);
+	});
+
+	it("requires both MCP and identity grants", () => {
+		expect(
+			PluginManifestSchema.safeParse({
+				...manifest,
+				permission_grants: ["mcp:server"],
+			}).success
+		).toBe(false);
+	});
+});