crewcode-plugin-cli 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewcode-plugin-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Command-line tool for scaffolding, developing, and packaging CrewCode plugins.",
   "license": "Apache-2.0",
   "type": "module",

package/templates/plugins/typescript-panel-template/src/crewcode-api.ts

@@ -1,3 +1,7 @@
+// Official CrewCode plugin API. GENERATED from crewcode-plugin-api/src — do not edit by hand.
+// Vendored so this template builds with no external dependency.
+// If you prefer a managed dependency: npm install crewcode-plugin-api
+
 export const CREWCODE_PLUGIN_API_VERSION = '0.1' as const
 
 export type CrewCodePluginApiVersion = typeof CREWCODE_PLUGIN_API_VERSION
@@ -18,6 +22,12 @@ export interface CrewCodePluginOpenContext {
 
 export interface CrewCodePluginContext {
   type: 'crewcode:context'
+  /**
+   * The plugin API version of the running CrewCode host. Use it to feature-detect
+   * at runtime, e.g. `if (ctx.hostApiVersion !== crewcode.apiVersion) { ... }`.
+   * Optional for backward compatibility with hosts that predate this field.
+   */
+  hostApiVersion?: string
   pluginId: string
   registrationId: string
   workspace: CrewCodeWorkspaceContext | null
@@ -69,10 +79,20 @@ interface PendingRequest<T = unknown> {
 }
 
 export interface CreateCrewCodeApiOptions {
+  /** Milliseconds before an unanswered request rejects. Default 10000. */
   timeoutMs?: number
+  /** postMessage targetOrigin. Default '*'. */
   targetOrigin?: string
 }
 
+// Reserved v0 namespaces: these are declared for forward-compat but the host
+// gate denies them from iframes today. Reject early with an actionable message
+// instead of round-tripping to the host only to fail there.
+const RESERVED_NETWORK_MESSAGE =
+  'crewcode.network.fetch is reserved in plugin API v0. Use an agentProvider runtime (http/sse-http/openai-compatible/websocket) for network access.'
+const RESERVED_SECRETS_MESSAGE =
+  'crewcode.secrets.get is reserved in plugin API v0. Use a provider apiKeyEnv or local CLI auth instead.'
+
 export function createCrewCodeApi(options: CreateCrewCodeApiOptions = {}): CrewCodePluginApi {
   const timeoutMs = options.timeoutMs ?? 10_000
   const targetOrigin = options.targetOrigin ?? '*'
@@ -103,6 +123,10 @@ export function createCrewCodeApi(options: CreateCrewCodeApiOptions = {}): CrewC
   }
 
   window.addEventListener('message', event => {
+    // Only trust messages from the embedding CrewCode renderer, never sibling
+    // frames or nested content injected into the panel.
+    if (event.source !== window.parent) return
+
     const msg = event.data as Record<string, unknown> | null
     if (!msg || typeof msg !== 'object') return
 
@@ -135,10 +159,10 @@ export function createCrewCodeApi(options: CreateCrewCodeApiOptions = {}): CrewC
       writeFile: (sub, text) => request<WorkspaceWriteFileResult>('workspace:writeFile', { sub, text }),
     },
     network: {
-      fetch: (input, init) => request<never>('network:fetch', { input, init }),
+      fetch: () => Promise.reject(new Error(RESERVED_NETWORK_MESSAGE)),
     },
     secrets: {
-      get: key => request<never>('secrets:get', { key }),
+      get: () => Promise.reject(new Error(RESERVED_SECRETS_MESSAGE)),
     },
   }
 }

package/templates/plugins/typescript-panel-template/src/main.tsx

@@ -1,10 +1,10 @@
 import React, { useEffect, useState } from 'react'
 import { createRoot } from 'react-dom/client'
-import { crewcode, type CrewCodeContext } from './crewcode-api'
+import { crewcode, type CrewCodePluginContext } from './crewcode-api'
 import './style.css'
 
 function App() {
-  const [ctx, setCtx] = useState<CrewCodeContext | null>(null)
+  const [ctx, setCtx] = useState<CrewCodePluginContext | null>(null)
   const [files, setFiles] = useState<string[]>([])
   const [status, setStatus] = useState('waiting for CrewCode context…')