gloomberb 0.11.2 → 0.12.0

package/src/public/react.ts

@@ -0,0 +1,62 @@
+/**
+ * Public React runtime surface for external plugins (`gloomberb/react`).
+ *
+ * These hooks are the renderer-neutral way for plugin panes to reach app
+ * services. Plugin render code must use them instead of importing OpenTUI,
+ * Electrobun, or DOM APIs directly — the renderer decides how each one is
+ * fulfilled, which is what lets the same plugin run in the terminal, on the
+ * desktop, and (for web-capable plugins) in the browser.
+ *
+ * Compatibility commitment: see the note in `./utils.ts`.
+ */
+
+export {
+  deletePluginPaneStateValue,
+  getPluginPaneStateValue,
+  setPluginPaneStateValue,
+  useCapabilityInvoker,
+  useAssetData,
+  useConnectionHealth,
+  useDebouncedPluginPaneState,
+  useMarketData,
+  usePluginAppActions,
+  usePluginBrokerActions,
+  usePluginConfigState,
+  usePluginPaneActions,
+  usePluginPaneState,
+  usePluginState,
+  usePluginTickerActions,
+  useSetPluginConfigStates,
+} from "../plugins/runtime";
+export type { PluginRuntimeAccess } from "../plugins/runtime";
+
+export { useInlineTickerOpener, useInlineTickers } from "../state/hooks/inline-tickers";
+
+// Any feed plugin needs to remember which items have been read, persisted and
+// capped. Substack and the news wire both use this; a third-party feed plugin
+// would otherwise reimplement it or copy it and drift.
+export {
+  DEFAULT_MAX_READ_IDS,
+  markPersistedReadId,
+  normalizePersistedReadIdState,
+  usePersistedReadIds,
+} from "../plugins/builtin/shared/read-state";
+export type { PersistedReadIdAdapter } from "../plugins/builtin/shared/read-state";
+export type { InlineTickerCatalogEntry, UseInlineTickersOptions } from "../state/hooks/inline-tickers";
+
+export {
+  AppContext,
+  PaneInstanceProvider,
+  useAppConfig,
+  useAppDispatch,
+  useAppSelector,
+  useBrokerAccounts,
+  useInputCapture,
+  usePaneCollection,
+  usePaneInstanceId,
+  usePaneTicker,
+  useTickers,
+} from "./pane-hooks";
+
+// Keyboard handling for plugin panes; the renderer decides how events arrive.
+export { useShortcut } from "../react/input";

package/src/public/test-support.ts

@@ -0,0 +1,23 @@
+/**
+ * Test helpers for external plugin repositories (`gloomberb/test-support`).
+ *
+ * Plugins live in their own repos and run their own `bun test`, so the fakes and
+ * render harness they need have to ship with the host rather than being copied
+ * per plugin and drifting.
+ *
+ * The harness is OpenTUI-backed. That is the host's business, not the plugin's:
+ * a plugin importing a renderer package directly stops working on the other
+ * renderers, which is exactly what going through this module avoids.
+ */
+
+export { MemoryPluginPersistence } from "../test-support/plugin-persistence";
+
+export { TestDialogProvider, testRender } from "../renderers/opentui/test-utils";
+
+export { AppContext, PaneInstanceProvider } from "../state/app/context";
+export { createInitialState } from "../core/state/app/state";
+
+// Broker plugins test against the real account cache and persistence rather
+// than a hand-rolled double that drifts from how the app actually stores rows.
+export { AppPersistence } from "../data/app-persistence";
+export * from "../brokers/account-cache";

package/src/public/time-series.ts

@@ -0,0 +1,8 @@
+/**
+ * Chart range and resolution vocabulary (`gloomberb/time-series`).
+ *
+ * Shared so a plugin producing history speaks the same range and resolution
+ * language as the charts that render it, instead of inventing a parallel one.
+ */
+export * from "../time-series/range";
+export * from "../time-series/resolution";

package/src/public/utils.ts

@@ -0,0 +1,77 @@
+/**
+ * Public utility surface for external plugins (`gloomberb/utils`).
+ *
+ * Everything re-exported here is a compatibility commitment: plugins in other
+ * repositories import it, so removing or changing a signature is a breaking
+ * change for them. Internal helpers stay internal — add to this barrel only
+ * when a real plugin needs it, and prefer widening later over exporting
+ * speculatively.
+ *
+ * `scripts/check-public-api.ts` pins the exported names so the surface cannot
+ * grow by accident during an unrelated refactor.
+ */
+
+export { createThrottledFetch } from "../utils/throttled-fetch";
+export type {
+  ThrottledFetchClient,
+  ThrottledFetchOptions,
+  ThrottledFetchTransport,
+} from "../utils/throttled-fetch";
+
+export { normalizedHttpUrl } from "../utils/url";
+
+export { formatRelativeAge } from "../utils/relative-time";
+
+export { decodeHtmlEntities } from "../utils/html-entities";
+
+export { isPlainKey, isPlainKeyboardEvent } from "../utils/keyboard";
+export type { KeyboardModifierEventLike } from "../utils/keyboard";
+
+export {
+  displayWidth,
+  formatCompact,
+  formatCompactCurrency,
+  formatCurrency,
+  formatGrowthShort,
+  formatNumber,
+  formatPercent,
+  formatPercentRaw,
+  formatTimeAgo,
+  formatWithDivisor,
+  padTo,
+  pickUnit,
+  truncateToDisplayWidth,
+} from "../utils/format";
+
+// Broker and instrument helpers. IBKR needs all of these, and any broker plugin
+// will: instance lookup, currency minor units, venue normalization, and stable
+// hashing for cache keys.
+export {
+  buildBrokerPortfolioId,
+  createBrokerInstanceId,
+  getBrokerInstance,
+  getBrokerInstancesByType,
+  isBrokerPortfolioId,
+} from "../utils/broker-instances";
+export {
+  hasLikelyQuoteUnitMismatch,
+  normalizePriceValueByDivisor,
+  resolveCurrencyUnit,
+  resolveExchangeSubUnitCurrencyUnit,
+  resolvePriceHistoryCurrencyUnit,
+} from "../utils/currency-units";
+export type { CurrencyUnitInfo } from "../utils/currency-units";
+export {
+  canonicalExchange,
+  canonicalTickerKey,
+  normalizeSymbol,
+  parsePublicTickerKey,
+  publicExchange,
+  publicTickerKey,
+  resolveExchangeTimeZone,
+} from "../utils/exchanges";
+export { fnv1aHashString } from "../utils/hash";
+export { splitLongTextSegmentByDisplayWidth, truncateWithEllipsis, wrapTextLines } from "../utils/text-wrap";
+export { httpFetch, setHttpFetchTransport } from "../utils/http-transport";
+export type { HttpFetchTransport } from "../utils/http-transport";
+export { debugLog } from "../utils/debug-log";

package/src/remote/layout-helpers.ts

@@ -1,7 +1,9 @@
 import {
-  getDockedPaneIds,
-} from "../plugins/pane-manager";
-import type { DockLayoutNode, LayoutConfig, PaneInstanceConfig } from "../types/config";
+  getPlacedPaneInstanceIds,
+  type DockLayoutNode,
+  type LayoutConfig,
+  type PaneInstanceConfig,
+} from "../types/config";
 
 export function requirePaneInstance(layout: LayoutConfig, paneId: string): PaneInstanceConfig {
   const instance = layout.instances.find((entry) => entry.instanceId === paneId)
@@ -27,11 +29,7 @@ export function buildGridDockRoot(paneIds: string[], columns?: number): DockLayo
 }
 
 export function visiblePaneIds(layout: LayoutConfig): string[] {
-  const ids = new Set<string>();
-  getDockedPaneIds(layout).forEach((id) => ids.add(id));
-  layout.floating.forEach((entry) => ids.add(entry.instanceId));
-  (layout.detached ?? []).forEach((entry) => ids.add(entry.instanceId));
-  return [...ids];
+  return getPlacedPaneInstanceIds(layout);
 }
 
 export function regionToDockPosition(region: string): "left" | "right" | "above" | "below" {

package/src/remote/resources.ts

@@ -1,5 +1,6 @@
 import type { Dispatch } from "react";
 import type { PluginRegistry } from "../plugins/registry";
+import { apiClient } from "../api-client";
 import type { AppAction, AppState } from "../state/app/context";
 import type { PaneRuntimeState } from "../core/state/app/state";
 import { setPaneSettings } from "../pane-settings";
@@ -99,6 +100,7 @@ export function createRemoteResources({
     if (resource === "app://command-bar") return commandBarSnapshot(state, uiNodes);
     if (resource === "app://command-bar/results") return commandBarResultsFromNodes(uiNodes);
     if (resource === "app://capabilities") return pluginRegistry.capabilities.manifests();
+    if (resource === "app://auth") return apiClient.describeAuthState();
     if (resource === "app://remote/help") return REMOTE_AGENT_HELP;
     if (resource === "ui://tree") return uiNodes;
     throw new Error(`Unknown remote resource "${resource}".`);

package/src/remote/schema.ts

@@ -14,6 +14,7 @@ export const REMOTE_RESOURCES: RemoteResourceSchema[] = [
   { uri: "app://command-bar", description: "Current command-bar state and semantic result rows." },
   { uri: "app://command-bar/results", description: "Current semantic command-bar result rows." },
   { uri: "app://capabilities", description: "Registered plugin capability manifests." },
+  { uri: "app://auth", description: "What the client believes about its cloud session: credential present, checked, cached user plan and verification. No secrets." },
   { uri: "app://remote/help", description: "Agent-oriented remote usage guide with efficient recipes and caveats." },
   { uri: "ui://tree", description: "Live semantic UI node tree populated by shared controls and interactive primitives." },
 ];

package/src/remote/semantic-tree.test.tsx

@@ -0,0 +1,105 @@
+import { afterEach, expect, test } from "bun:test";
+import { act, useState } from "react";
+import { testRender } from "../renderers/opentui/test-utils";
+import {
+  RemoteUiRegistryProvider,
+  createRemoteUiRegistry,
+  useRemoteUiNode,
+} from "./semantic-tree";
+
+let setup: Awaited<ReturnType<typeof testRender>> | undefined;
+let setValue: ((value: number) => void) | null = null;
+let metadataReads = 0;
+
+afterEach(async () => {
+  if (!setup) return;
+  await act(async () => setup?.renderer.destroy());
+  setup = undefined;
+  setValue = null;
+  metadataReads = 0;
+});
+
+function LazyMetadataNode() {
+  useRemoteUiNode({
+    role: "table",
+    getMetadata: () => {
+      metadataReads += 1;
+      return { rowCount: 200 };
+    },
+  });
+  return <text>table</text>;
+}
+
+function DynamicNode() {
+  const [value, updateValue] = useState(1);
+  setValue = updateValue;
+  useRemoteUiNode({
+    role: "button",
+    label: `Value ${value}`,
+    actions: { read: () => value },
+    metadata: { value },
+  });
+  return <text>{value}</text>;
+}
+
+test("semantic registry rejects non-function actions consistently", async () => {
+  const registry = createRemoteUiRegistry();
+  registry.register("invalid", {
+    role: "button",
+    actions: { broken: "not-a-function" as unknown as () => void },
+  });
+
+  expect(registry.snapshot()[0]?.actions).toEqual([]);
+  await expect(registry.invoke("invalid", "broken")).rejects.toThrow(
+    'UI node "invalid" does not expose action "broken".',
+  );
+});
+
+test("semantic metadata is projected only when a remote snapshot requests it", async () => {
+  const registry = createRemoteUiRegistry();
+  setup = await testRender(
+    <RemoteUiRegistryProvider registry={registry}>
+      <LazyMetadataNode />
+    </RemoteUiRegistryProvider>,
+    { width: 20, height: 4 },
+  );
+  await setup.renderOnce();
+
+  expect(metadataReads).toBe(0);
+  expect(registry.snapshot()[0]?.metadata).toEqual({ rowCount: 200 });
+  expect(metadataReads).toBe(1);
+});
+
+test("semantic nodes keep current behavior without re-registering on every render", async () => {
+  const registry = createRemoteUiRegistry();
+  const register = registry.register.bind(registry);
+  let registrations = 0;
+  registry.register = (id, registration) => {
+    registrations += 1;
+    register(id, registration);
+  };
+
+  setup = await testRender(
+    <RemoteUiRegistryProvider registry={registry}>
+      <DynamicNode />
+    </RemoteUiRegistryProvider>,
+    { width: 20, height: 4 },
+  );
+  await setup.renderOnce();
+
+  const nodeId = registry.snapshot()[0]!.id;
+  expect(registrations).toBe(1);
+  expect(await registry.invoke(nodeId, "read")).toBe(1);
+
+  await act(async () => {
+    setValue?.(2);
+    await setup!.renderOnce();
+  });
+
+  expect(registrations).toBe(1);
+  expect(registry.snapshot()[0]).toMatchObject({
+    label: "Value 2",
+    metadata: { value: 2 },
+  });
+  expect(await registry.invoke(nodeId, "read")).toBe(2);
+});

package/src/remote/semantic-tree.tsx

@@ -17,11 +17,13 @@ export interface RemoteUiNodeRegistration {
   disabled?: boolean;
   actions?: Record<string, RemoteUiAction | undefined>;
   metadata?: Record<string, unknown>;
+  /** Defers expensive metadata projection until a remote snapshot requests it. */
+  getMetadata?: () => Record<string, unknown>;
 }
 
-interface RegisteredRemoteUiNode extends RemoteUiNodeRegistration {
+interface RegisteredRemoteUiNode {
   id: string;
-  actions: Record<string, RemoteUiAction>;
+  registration: RemoteUiNodeRegistration;
 }
 
 export interface RemoteUiRegistry {
@@ -33,46 +35,54 @@ export interface RemoteUiRegistry {
 
 const RemoteUiRegistryContext = createContext<RemoteUiRegistry | null>(null);
 
-function createRemoteUiRegistry(): RemoteUiRegistry {
+export function createRemoteUiRegistry(): RemoteUiRegistry {
   const nodes = new Map<string, RegisteredRemoteUiNode>();
 
   return {
     register(id, registration) {
-      nodes.set(id, {
-        ...registration,
-        id,
-        actions: Object.fromEntries(
-          Object.entries(registration.actions ?? {})
-            .filter((entry): entry is [string, RemoteUiAction] => typeof entry[1] === "function"),
-        ),
-      });
+      nodes.set(id, { id, registration });
     },
     unregister(id) {
       nodes.delete(id);
     },
     snapshot() {
-      return [...nodes.values()].map((node) => ({
-        id: node.id,
-        role: node.role,
-        label: node.label,
-        disabled: node.disabled,
-        actions: Object.keys(node.actions).sort(),
-        metadata: node.metadata,
-      }));
+      return [...nodes.values()].map((node) => {
+        const registration = node.registration;
+        return {
+          id: node.id,
+          role: registration.role,
+          label: registration.label,
+          disabled: registration.disabled,
+          actions: Object.entries(registration.actions ?? {})
+            .filter((entry): entry is [string, RemoteUiAction] => typeof entry[1] === "function")
+            .map(([action]) => action)
+            .sort(),
+          metadata: registration.getMetadata?.() ?? registration.metadata,
+        };
+      });
     },
     async invoke(nodeId, action, input) {
       const node = nodes.get(nodeId);
       if (!node) throw new Error(`Unknown UI node "${nodeId}".`);
-      if (node.disabled) throw new Error(`UI node "${nodeId}" is disabled.`);
-      const handler = node.actions[action];
-      if (!handler) throw new Error(`UI node "${nodeId}" does not expose action "${action}".`);
+      const registration = node.registration;
+      if (registration.disabled) throw new Error(`UI node "${nodeId}" is disabled.`);
+      const handler = registration.actions?.[action];
+      if (typeof handler !== "function") {
+        throw new Error(`UI node "${nodeId}" does not expose action "${action}".`);
+      }
       return await handler(input);
     },
   };
 }
 
-export function RemoteUiRegistryProvider({ children }: { children: ReactNode }) {
-  const registryRef = useRef<RemoteUiRegistry | null>(null);
+export function RemoteUiRegistryProvider({
+  children,
+  registry,
+}: {
+  children: ReactNode;
+  registry?: RemoteUiRegistry;
+}) {
+  const registryRef = useRef<RemoteUiRegistry | null>(registry ?? null);
   if (!registryRef.current) {
     registryRef.current = createRemoteUiRegistry();
   }
@@ -91,22 +101,30 @@ export function useRemoteUiNode(registration: RemoteUiNodeRegistration | null |
   const registry = useRemoteUiRegistry();
   const generatedId = useId();
   const nodeId = useMemo(() => `ui:${generatedId.replace(/:/g, "")}`, [generatedId]);
+  const registrationRef = useRef(registration);
+  registrationRef.current = registration;
+  const dynamicRegistrationRef = useRef<RemoteUiNodeRegistration | null>(null);
+  if (!dynamicRegistrationRef.current) {
+    dynamicRegistrationRef.current = {
+      get role() { return registrationRef.current?.role ?? "unknown"; },
+      get label() { return registrationRef.current?.label; },
+      get disabled() { return registrationRef.current?.disabled; },
+      get actions() { return registrationRef.current?.actions; },
+      get metadata() { return registrationRef.current?.metadata; },
+      get getMetadata() { return registrationRef.current?.getMetadata; },
+    };
+  }
+  const registered = registration != null;
 
   useEffect(() => {
     if (!registry) return;
-    if (!registration) {
+    if (!registered) {
       registry.unregister(nodeId);
       return;
     }
-    registry.register(nodeId, registration);
-  });
-
-  useEffect(() => {
-    return () => registry?.unregister(nodeId);
-  }, [
-    nodeId,
-    registry,
-  ]);
+    registry.register(nodeId, dynamicRegistrationRef.current!);
+    return () => registry.unregister(nodeId);
+  }, [nodeId, registered, registry]);
 
-  return registry && registration ? nodeId : null;
+  return registry && registered ? nodeId : null;
 }

package/src/renderers/browser/main.tsx

@@ -1,4 +1,5 @@
 /** @jsxImportSource react */
+import { setCurrentPluginTarget } from "../../plugins/current-target";
 import "../electrobun/view/styles.css";
 import { createRoot } from "react-dom/client";
 import { App } from "../../app";
@@ -21,6 +22,10 @@ import { BROWSER_DATA_DIR, installBrowserConfigStore } from "./config-host";
 import { browserRendererHost, browserUiHost } from "./ui-host";
 import { createBrowserDeepLinkBridge } from "./deeplink-bridge";
 
+// Declared here rather than sniffed: the desktop view and the hosted browser
+// app are both browser contexts but differ in what plugins may do.
+setCurrentPluginTarget("web");
+
 const rootElement = document.getElementById("root");
 if (!rootElement) throw new Error("Missing root element");
 const appRootElement = rootElement;
@@ -48,6 +53,7 @@ async function boot(): Promise<void> {
                 plugins={getBrowserBuiltinPlugins()}
                 desktopDeepLinkBridge={deepLinkBridge}
                 updatesEnabled={false}
+                requireSignIn
               />
             </WebDialogHostProvider>
           </WebToastHostProvider>

package/src/renderers/browser/ui-host.tsx

@@ -27,6 +27,17 @@ export const browserRendererHost: RendererHost = {
   async readText() {
     return navigator.clipboard.readText();
   },
+  async saveTextFile({ name, text, mimeType }) {
+    const url = URL.createObjectURL(new Blob([text], { type: mimeType }));
+    const anchor = document.createElement("a");
+    anchor.href = url;
+    anchor.download = name;
+    document.body.appendChild(anchor);
+    anchor.click();
+    anchor.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 0);
+    return `Downloads/${name}`;
+  },
   async copyPngImage(pngBase64) {
     const ClipboardItemCtor = globalThis.ClipboardItem;
     if (!ClipboardItemCtor || !navigator.clipboard.write) {

package/src/renderers/cloudflare/worker.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { handleRequest, SECURITY_HEADERS, type WorkerEnv } from "./worker";
+import { REGISTRY_ORIGIN } from "../../plugins/builtin/plugin-marketplace/feed";
 
 function fixture() {
   const requests: Request[] = [];
@@ -134,3 +135,21 @@ describe("static Cloudflare host", () => {
     expect(requests).toHaveLength(0);
   });
 });
+
+/**
+ * The hosted build can only reach origins listed in `connect-src`. A blocked
+ * fetch is not an error the user can act on: the plugin marketplace just shows
+ * an empty catalog. This shipped that way once, because the pane was verified
+ * on the terminal and desktop but not on the web build, so the two values are
+ * pinned to each other here.
+ */
+describe("content security policy", () => {
+  test("allows the plugin registry the marketplace fetches", () => {
+    const connectSrc = SECURITY_HEADERS["content-security-policy"]
+      .split(";")
+      .map((directive) => directive.trim())
+      .find((directive) => directive.startsWith("connect-src"));
+
+    expect(connectSrc).toContain(REGISTRY_ORIGIN);
+  });
+});

package/src/renderers/cloudflare/worker.ts

@@ -39,7 +39,7 @@ const API_METHODS = new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "O
 type ApiFetch = (request: Request) => Promise<Response>;
 
 export const SECURITY_HEADERS = {
-  "content-security-policy": "default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.github.com https://api.fiscaldata.treasury.gov; form-action 'self'; upgrade-insecure-requests",
+  "content-security-policy": "default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.github.com https://api.fiscaldata.treasury.gov https://plugins.gloom.sh; form-action 'self'; upgrade-insecure-requests",
   "cross-origin-opener-policy": "same-origin",
   "cross-origin-resource-policy": "same-origin",
   "permissions-policy": "camera=(), geolocation=(), microphone=(), payment=(), usb=()",

package/src/renderers/electrobun/bun/desktop/host-requests.ts

@@ -10,6 +10,7 @@ import type {
 import { safeExternalUrl } from "../../../../utils/external-url";
 import { getContextMenuRequestId, normalizeContextMenuItems } from "../context-menu/normalize";
 import { MAIN_WINDOW_RPC_KEY } from "../window/focus";
+import { saveTextFileToDownloads } from "../../../../utils/save-text-file";
 
 interface DesktopHostRequestOptions<TRpc> {
   clearMainWindow: () => void;
@@ -51,7 +52,7 @@ function normalizeWindowControlAction(action: unknown): DesktopWindowControlActi
   throw new Error("host.windowControl requires a valid action.");
 }
 
-export function handleDesktopHostRequest<TRpc>({
+export async function handleDesktopHostRequest<TRpc>({
   clearMainWindow,
   closeAllDetachedWindows,
   controlWindowForRpcKey,
@@ -63,7 +64,7 @@ export function handleDesktopHostRequest<TRpc>({
   rpc,
   teardownServices,
   trackContextMenuRequest,
-}: DesktopHostRequestOptions<TRpc>): DesktopBackendRequestResponse<DesktopHostRequest["method"]> {
+}: DesktopHostRequestOptions<TRpc>): Promise<DesktopBackendRequestResponse<DesktopHostRequest["method"]>> {
   switch (request.method) {
     case "host.restart":
       restartDesktopApp({
@@ -127,6 +128,12 @@ export function handleDesktopHostRequest<TRpc>({
     }
     case "host.readText":
       return Utils.clipboardReadText() ?? "";
+    case "host.saveTextFile": {
+      if (typeof request.payload.name !== "string" || typeof request.payload.text !== "string") {
+        throw new Error("host.saveTextFile requires a name and text.");
+      }
+      return saveTextFileToDownloads(request.payload.name, request.payload.text);
+    }
     case "host.notify":
       playNotificationSound(normalizeText(request.payload.sound));
       Utils.showNotification({