openwriter 0.3.1 → 0.5.0

package/dist/server/plugin-discovery.js

@@ -1,19 +1,21 @@
 /**
- * Plugin discovery: scans the plugins/ directory for available plugins.
- * Reads package.json metadata without importing or loading the plugin code.
+ * Plugin discovery: scans bundled plugins/ directory and user ~/.openwriter/plugins/
+ * for available plugins. Reads package.json metadata without importing plugin code.
  */
 import { existsSync, readdirSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { dirname } from 'path';
+import { homedir } from 'os';
+import { createRequire } from 'module';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+const USER_PLUGINS_DIR = join(homedir(), '.openwriter', 'plugins');
 /**
- * Scan the plugins/ directory at the monorepo root.
- * Returns metadata from each plugin's package.json without importing code.
- * Returns [] if plugins/ doesn't exist (e.g. npm install scenario).
+ * Scan the bundled plugins/ directory at the monorepo root.
+ * Returns [] if plugins/ doesn't exist (e.g. npx install scenario).
  */
-export function discoverPlugins() {
+function discoverBundledPlugins() {
     // At runtime: dist/server/ → ../../../.. → monorepo root → /plugins/
     const pluginsDir = join(__dirname, '..', '..', '..', '..', 'plugins');
     if (!existsSync(pluginsDir))
@@ -29,11 +31,15 @@ export function discoverPlugins() {
             const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
             if (!pkg.name)
                 continue;
+            const manifest = pkg.openwriter;
             results.push({
                 name: pkg.name,
                 dirName: entry.name,
                 version: pkg.version || '0.0.0',
                 description: pkg.description || '',
+                source: 'bundled',
+                displayName: manifest?.displayName,
+                category: manifest?.category,
             });
         }
         catch {
@@ -42,13 +48,99 @@ export function discoverPlugins() {
     }
     return results;
 }
+/**
+ * Scan ~/.openwriter/plugins/node_modules/ for user-installed plugins.
+ * Matches packages with `openwriter` field in package.json or matching naming conventions.
+ */
+function discoverUserPlugins() {
+    const nodeModules = join(USER_PLUGINS_DIR, 'node_modules');
+    if (!existsSync(nodeModules))
+        return [];
+    const results = [];
+    const scanDir = (dir) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            // Handle scoped packages (@scope/package-name)
+            if (entry.name.startsWith('@')) {
+                const scopeDir = join(dir, entry.name);
+                for (const scoped of readdirSync(scopeDir, { withFileTypes: true })) {
+                    if (!scoped.isDirectory())
+                        continue;
+                    tryAddPlugin(join(scopeDir, scoped.name), `${entry.name}/${scoped.name}`, results);
+                }
+            }
+            else {
+                tryAddPlugin(join(dir, entry.name), entry.name, results);
+            }
+        }
+    };
+    scanDir(nodeModules);
+    return results;
+}
+function tryAddPlugin(pkgDir, fullName, results) {
+    const pkgPath = join(pkgDir, 'package.json');
+    if (!existsSync(pkgPath))
+        return;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        if (!pkg.name)
+            return;
+        const manifest = pkg.openwriter;
+        const isOpenWriterPlugin = manifest ||
+            /^openwriter-plugin-/.test(pkg.name) ||
+            /^@openwriter\/plugin-/.test(pkg.name) ||
+            /^@[\w-]+\/openwriter-plugin-/.test(pkg.name);
+        if (!isOpenWriterPlugin)
+            return;
+        results.push({
+            name: pkg.name,
+            dirName: fullName,
+            version: pkg.version || '0.0.0',
+            description: pkg.description || '',
+            source: 'user',
+            displayName: manifest?.displayName,
+            category: manifest?.category,
+        });
+    }
+    catch {
+        // Skip malformed package.json
+    }
+}
+/**
+ * Discover all plugins from both bundled and user sources.
+ * Deduplicates by name (bundled takes priority).
+ */
+export function discoverPlugins() {
+    const bundled = discoverBundledPlugins();
+    const user = discoverUserPlugins();
+    // Deduplicate: bundled wins if same name exists in both
+    const seen = new Set(bundled.map(p => p.name));
+    const deduped = [...bundled];
+    for (const p of user) {
+        if (!seen.has(p.name)) {
+            deduped.push(p);
+            seen.add(p.name);
+        }
+    }
+    return deduped;
+}
 /**
  * Import a plugin by npm package name and extract its metadata.
  * Returns the plugin's configSchema and full module export.
  */
-export async function loadPluginModule(name) {
+export async function loadPluginModule(name, source = 'bundled') {
     try {
-        const mod = await import(name);
+        let mod;
+        if (source === 'user') {
+            // ESM import from non-standard node_modules requires path resolution
+            const userRequire = createRequire(join(USER_PLUGINS_DIR, 'package.json'));
+            const resolved = userRequire.resolve(name);
+            mod = await import(pathToFileURL(resolved).href);
+        }
+        else {
+            mod = await import(name);
+        }
         const plugin = mod.default || mod.plugin || mod;
         if (!plugin.name || !plugin.version)
             return null;
@@ -58,7 +150,7 @@ export async function loadPluginModule(name) {
         };
     }
     catch (err) {
-        console.error(`[PluginDiscovery] Failed to import "${name}":`, err.message);
+        console.error(`[PluginDiscovery] Failed to import "${name}" (${source}):`, err.message);
         return null;
     }
 }

package/dist/server/plugin-install.js

@@ -0,0 +1,119 @@
+/**
+ * CLI plugin management: install, remove, list user plugins.
+ * User plugins live in ~/.openwriter/plugins/ with their own package.json and node_modules.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { execSync } from 'child_process';
+const PLUGINS_DIR = join(homedir(), '.openwriter', 'plugins');
+const PLUGINS_PKG = join(PLUGINS_DIR, 'package.json');
+const VALID_NAME = /^(@openwriter\/plugin-[\w-]+|openwriter-plugin-[\w-]+|@[\w-]+\/openwriter-plugin-[\w-]+)$/;
+/** Ensure ~/.openwriter/plugins/ exists with a package.json */
+export function ensureUserPluginsDir() {
+    if (!existsSync(PLUGINS_DIR)) {
+        mkdirSync(PLUGINS_DIR, { recursive: true });
+    }
+    if (!existsSync(PLUGINS_PKG)) {
+        writeFileSync(PLUGINS_PKG, JSON.stringify({
+            private: true,
+            type: 'module',
+            dependencies: {}
+        }, null, 2), 'utf-8');
+    }
+}
+/** Install a plugin package into the user plugins directory */
+export function installPlugin(packageName) {
+    if (!VALID_NAME.test(packageName)) {
+        console.error(`Invalid plugin name: ${packageName}`);
+        console.error('Plugin names must match: openwriter-plugin-*, @openwriter/plugin-*, or @scope/openwriter-plugin-*');
+        process.exit(1);
+    }
+    ensureUserPluginsDir();
+    console.error(`Installing ${packageName}...`);
+    try {
+        execSync(`npm install --save ${packageName}`, {
+            cwd: PLUGINS_DIR,
+            stdio: 'inherit',
+        });
+        console.error(`Installed ${packageName} successfully.`);
+    }
+    catch {
+        console.error(`Failed to install ${packageName}.`);
+        process.exit(1);
+    }
+}
+/** Remove a plugin package from the user plugins directory */
+export function removePlugin(packageName) {
+    ensureUserPluginsDir();
+    const pkg = readPkg();
+    if (!pkg.dependencies?.[packageName]) {
+        console.error(`Plugin ${packageName} is not installed.`);
+        process.exit(1);
+    }
+    console.error(`Removing ${packageName}...`);
+    try {
+        execSync(`npm uninstall ${packageName}`, {
+            cwd: PLUGINS_DIR,
+            stdio: 'inherit',
+        });
+        console.error(`Removed ${packageName} successfully.`);
+    }
+    catch {
+        console.error(`Failed to remove ${packageName}.`);
+        process.exit(1);
+    }
+}
+/** List installed user plugins */
+export function listInstalledPlugins() {
+    ensureUserPluginsDir();
+    const pkg = readPkg();
+    const deps = pkg.dependencies || {};
+    const names = Object.keys(deps);
+    if (names.length === 0) {
+        console.error('No user plugins installed.');
+        console.error('Install one with: openwriter plugin install <package-name>');
+        return;
+    }
+    console.error('Installed plugins:');
+    for (const name of names) {
+        console.error(`  ${name}@${deps[name]}`);
+    }
+}
+/** CLI router for plugin subcommands */
+export function handlePluginCommand(args) {
+    const sub = args[0];
+    const name = args[1];
+    switch (sub) {
+        case 'install':
+            if (!name) {
+                console.error('Usage: openwriter plugin install <package-name>');
+                process.exit(1);
+            }
+            installPlugin(name);
+            break;
+        case 'remove':
+        case 'uninstall':
+            if (!name) {
+                console.error('Usage: openwriter plugin remove <package-name>');
+                process.exit(1);
+            }
+            removePlugin(name);
+            break;
+        case 'list':
+        case 'ls':
+            listInstalledPlugins();
+            break;
+        default:
+            console.error('Usage: openwriter plugin <install|remove|list> [package-name]');
+            process.exit(1);
+    }
+}
+function readPkg() {
+    try {
+        return JSON.parse(readFileSync(PLUGINS_PKG, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}

package/dist/server/plugin-manager.js

@@ -20,7 +20,7 @@ export class PluginManager {
         const savedPlugins = savedConfig.plugins || {};
         for (const d of discovered) {
             // Load module to get configSchema
-            const loaded = await loadPluginModule(d.name);
+            const loaded = await loadPluginModule(d.name, d.source);
             const saved = savedPlugins[d.name];
             this.plugins.set(d.name, {
                 discovered: d,
@@ -41,7 +41,7 @@ export class PluginManager {
             return { success: true };
         // Ensure plugin module is loaded
         if (!managed.plugin) {
-            const loaded = await loadPluginModule(name);
+            const loaded = await loadPluginModule(name, managed.discovered.source);
             if (!loaded)
                 return { success: false, error: `Failed to import "${name}"` };
             managed.plugin = loaded.plugin;
@@ -114,9 +114,12 @@ export class PluginManager {
             enabled: m.enabled,
             configSchema: m.configSchema,
             config: m.config,
+            source: m.discovered.source,
+            displayName: m.discovered.displayName,
+            category: m.discovered.category,
         }));
     }
-    /** Get enabled plugins' context menu items (backward-compatible with GET /api/plugins). */
+    /** Get enabled plugins' context menu items and sidebar menu items. */
     getEnabledPluginDescriptors() {
         const results = [];
         for (const managed of this.plugins.values()) {
@@ -124,7 +127,9 @@ export class PluginManager {
                 continue;
             results.push({
                 name: managed.plugin.name,
+                displayName: managed.discovered.displayName,
                 contextMenuItems: managed.plugin.contextMenuItems?.() || [],
+                sidebarMenuItems: managed.plugin.sidebarMenuItems?.() || [],
             });
         }
         return results;

package/dist/server/prompt-debug.js

@@ -0,0 +1,58 @@
+/**
+ * File: prompt-debug.ts
+ * Purpose: Write AV prompt debug data to timestamped .md files for inspection.
+ * Each enhance creates a new file in DATA_DIR, visible in the sidebar.
+ */
+import { DATA_DIR, ensureDataDir, atomicWriteFileSync } from './helpers.js';
+import { join } from 'path';
+/**
+ * Write prompt debug info to a timestamped markdown file.
+ * Returns the filename created.
+ */
+export function writePromptDebug(action, debug, metadata) {
+    ensureDataDir();
+    const now = new Date();
+    const ts = now.toISOString().replace(/[:.]/g, '-').slice(0, 19);
+    const filename = `_prompt-${action || 'debug'}-${ts}.md`;
+    const filePath = join(DATA_DIR, filename);
+    const timeStr = now.toLocaleTimeString('en-US', { hour12: true, hour: '2-digit', minute: '2-digit', second: '2-digit' });
+    let md = `---\ntitle: "Prompt Debug: ${action} @ ${timeStr}"\n---\n\n`;
+    // Metadata summary
+    if (metadata) {
+        md += `## Metadata\n\n`;
+        md += `| Key | Value |\n|-----|-------|\n`;
+        if (metadata.action)
+            md += `| Action | ${metadata.action} |\n`;
+        if (metadata.profileUsed)
+            md += `| Profile | ${metadata.profileUsed} |\n`;
+        if (metadata.nodesIn != null)
+            md += `| Nodes In | ${metadata.nodesIn} |\n`;
+        if (metadata.nodesOut != null)
+            md += `| Nodes Out | ${metadata.nodesOut} |\n`;
+        if (metadata.ragExamples != null)
+            md += `| RAG Examples | ${metadata.ragExamples} |\n`;
+        if (metadata.ragTotalWords != null)
+            md += `| RAG Total Words | ${metadata.ragTotalWords} |\n`;
+        if (metadata.processingTimeMs != null)
+            md += `| Processing Time | ${metadata.processingTimeMs}ms |\n`;
+        if (metadata.estimatedCost != null)
+            md += `| Estimated Cost | $${metadata.estimatedCost.toFixed(4)} |\n`;
+        md += `\n`;
+    }
+    // System prompt
+    if (debug.systemPrompt) {
+        md += `## System Prompt\n\n`;
+        md += debug.systemPrompt + '\n\n';
+    }
+    // User prompt
+    if (debug.userPrompt) {
+        md += `---\n\n## User Prompt\n\n`;
+        md += debug.userPrompt + '\n\n';
+    }
+    // Raw LLM response (when available)
+    if (debug.rawResponse) {
+        md += `---\n\n## Raw LLM Output\n\n\`\`\`json\n${debug.rawResponse}\n\`\`\`\n\n`;
+    }
+    atomicWriteFileSync(filePath, md);
+    return filename;
+}

package/dist/server/state.js

@@ -8,7 +8,7 @@ import { join } from 'path';
 import matter from 'gray-matter';
 import { tiptapToMarkdown, markdownToTiptap } from './markdown.js';
 import { applyTextEditsToNode } from './text-edit.js';
-import { DATA_DIR, TEMP_PREFIX, ensureDataDir, filePathForTitle, tempFilePath, generateNodeId, LEAF_BLOCK_TYPES, resolveDocPath, isExternalDoc } from './helpers.js';
+import { DATA_DIR, TEMP_PREFIX, ensureDataDir, filePathForTitle, tempFilePath, generateNodeId, LEAF_BLOCK_TYPES, resolveDocPath, isExternalDoc, atomicWriteFileSync } from './helpers.js';
 import { snapshotIfNeeded, ensureDocId } from './versions.js';
 const DEFAULT_DOC = {
     type: 'doc',
@@ -31,7 +31,7 @@ const EXTERNAL_DOCS_FILE = join(DATA_DIR, 'external-docs.json');
 const externalDocs = new Set();
 function persistExternalDocs() {
     try {
-        writeFileSync(EXTERNAL_DOCS_FILE, JSON.stringify([...externalDocs]), 'utf-8');
+        atomicWriteFileSync(EXTERNAL_DOCS_FILE, JSON.stringify([...externalDocs]));
     }
     catch { /* best-effort */ }
 }
@@ -172,6 +172,15 @@ export function getStatus() {
 // SETTERS
 // ============================================================================
 export function updateDocument(doc) {
+    // Safety: reject dramatically smaller documents (same logic as destructive save check).
+    // Prevents stale browser tabs from overwriting the correct in-memory state with
+    // corrupted content (e.g. tweet compose view sending 4-node doc vs 40-node original).
+    const currentNodes = state.document?.content?.length ?? 0;
+    const incomingNodes = doc?.content?.length ?? 0;
+    if (currentNodes > 5 && incomingNodes < currentNodes * 0.3) {
+        console.error(`[State] BLOCKED destructive updateDocument: ${incomingNodes} nodes would replace ${currentNodes} nodes`);
+        return;
+    }
     // Preserve pending attrs that the browser doesn't track in its document model.
     // Browser manages pending state as decorations, so its doc-updates lack pendingStatus.
     // Without this, browser overwrites server state and pending info is lost on next save.
@@ -601,7 +610,7 @@ function writeToDisk() {
             catch { /* stat failed, proceed with save */ }
         }
     }
-    writeFileSync(state.filePath, markdown, 'utf-8');
+    atomicWriteFileSync(state.filePath, markdown);
     // Best-effort version snapshot — never blocks saves
     try {
         snapshotIfNeeded(state.docId, state.filePath);
@@ -661,7 +670,7 @@ export function load() {
             state.docId = ensureDocId(state.metadata);
             if (!hadDocId) {
                 const md = tiptapToMarkdown(state.document, state.title, state.metadata);
-                writeFileSync(state.filePath, md, 'utf-8');
+                atomicWriteFileSync(state.filePath, md);
             }
             break;
         }
@@ -770,7 +779,11 @@ function cleanupEmptyTempFiles() {
             try {
                 const raw = readFileSync(fullPath, 'utf-8');
                 const parsed = markdownToTiptap(raw);
-                if (isDocEmpty(parsed.document)) {
+                // Keep temp files that have meaningful metadata (templates, pending changes, tags)
+                const meta = parsed.metadata || {};
+                const hasMetadata = meta.tweetContext || meta.articleContext || meta.pending || meta.agentCreated
+                    || (Array.isArray(meta.tags) && meta.tags.length > 0);
+                if (isDocEmpty(parsed.document) && !hasMetadata) {
                     unlinkSync(fullPath);
                 }
             }
@@ -841,7 +854,7 @@ export function addDocTag(filename, tag) {
                 tags.push(tag);
                 parsed.metadata.tags = tags;
                 const markdown = tiptapToMarkdown(parsed.document, parsed.title, parsed.metadata);
-                writeFileSync(targetPath, markdown, 'utf-8');
+                atomicWriteFileSync(targetPath, markdown);
             }
         }
         catch { /* best-effort */ }
@@ -874,7 +887,7 @@ export function removeDocTag(filename, tag) {
                 tags.splice(idx, 1);
                 parsed.metadata.tags = tags.length > 0 ? tags : undefined;
                 const markdown = tiptapToMarkdown(parsed.document, parsed.title, parsed.metadata);
-                writeFileSync(targetPath, markdown, 'utf-8');
+                atomicWriteFileSync(targetPath, markdown);
             }
         }
         catch { /* best-effort */ }
@@ -899,7 +912,7 @@ export function saveDocToFile(filename, doc) {
             transferPendingAttrs(parsed.document, doc);
         }
         const markdown = tiptapToMarkdown(doc, parsed.title, parsed.metadata);
-        writeFileSync(targetPath, markdown, 'utf-8');
+        atomicWriteFileSync(targetPath, markdown);
     }
     catch { /* best-effort */ }
 }
@@ -933,7 +946,7 @@ export function stripPendingAttrsFromFile(filename, clearAgentCreated) {
             delete parsed.metadata.agentCreated;
         }
         const markdown = tiptapToMarkdown(parsed.document, parsed.title, parsed.metadata);
-        writeFileSync(targetPath, markdown, 'utf-8');
+        atomicWriteFileSync(targetPath, markdown);
         removePendingCacheEntry(filename);
     }
     catch { /* best-effort */ }

package/dist/server/ws.js

@@ -27,7 +27,23 @@ function debouncedBroadcastDocumentsChanged() {
     }, 2100);
 }
 export function setupWebSocket(server) {
-    const wss = new WebSocketServer({ server });
+    const wss = new WebSocketServer({
+        server,
+        verifyClient: ({ req }) => {
+            const origin = req.headers.origin;
+            // Allow connections with no origin (non-browser clients like MCP)
+            // and localhost origins only (blocks cross-site WebSocket hijacking)
+            if (!origin)
+                return true;
+            try {
+                const url = new URL(origin);
+                return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+            }
+            catch {
+                return false;
+            }
+        },
+    });
     // Push agent changes to all browser clients
     onChanges((changes) => {
         const msg = JSON.stringify({ type: 'node-changes', changes });
@@ -126,20 +142,29 @@ export function setupWebSocket(server) {
                     try {
                         const tmpl = msg.template;
                         const url = msg.url;
-                        // Create with no title → temp file path (avoids naming conflicts)
-                        const result = createDocument();
-                        // Set template-appropriate metadata
+                        // Create named document (dedup handles collisions)
+                        let title = 'Untitled';
+                        if (tmpl === 'tweet')
+                            title = 'Tweet';
+                        else if (tmpl === 'reply')
+                            title = 'Reply';
+                        else if (tmpl === 'quote')
+                            title = 'Quote Tweet';
+                        else if (tmpl === 'article')
+                            title = 'Article';
+                        const result = createDocument(title);
+                        // Set template-specific metadata
                         if (tmpl === 'tweet') {
-                            setMetadata({ tweetContext: { mode: 'tweet' }, title: 'Tweet' });
+                            setMetadata({ tweetContext: { mode: 'tweet' } });
                         }
                         else if (tmpl === 'reply') {
-                            setMetadata({ tweetContext: { url, mode: 'reply' }, title: 'Reply' });
+                            setMetadata({ tweetContext: { url, mode: 'reply' } });
                         }
                         else if (tmpl === 'quote') {
-                            setMetadata({ tweetContext: { url, mode: 'quote' }, title: 'Quote Tweet' });
+                            setMetadata({ tweetContext: { url, mode: 'quote' } });
                         }
                         else if (tmpl === 'article') {
-                            setMetadata({ articleContext: { active: true }, title: 'Article' });
+                            setMetadata({ articleContext: { active: true } });
                         }
                         save();
                         broadcastDocumentSwitched(result.document, getTitle(), result.filename, getMetadata());
@@ -186,6 +211,7 @@ export function setupWebSocket(server) {
                         }
                         stripPendingAttrs();
                         save();
+                        updatePendingCacheForActiveDoc(); // Sync cache after strip (prevents stale "has changes" indicator)
                     }
                     else {
                         // Race path: resolved doc is NOT the active one (server switched away).
@@ -206,7 +232,8 @@ export function setupWebSocket(server) {
     });
 }
 export function broadcastDocumentSwitched(document, title, filename, metadata) {
-    const msg = JSON.stringify({ type: 'document-switched', document, title, filename, docId: getDocId(), metadata: metadata ?? getMetadata() });
+    const resolvedMeta = metadata ?? getMetadata();
+    const msg = JSON.stringify({ type: 'document-switched', document, title, filename, docId: getDocId(), metadata: resolvedMeta });
     for (const ws of clients) {
         if (ws.readyState === WebSocket.OPEN) {
             ws.send(msg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openwriter",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "The open-source writing surface for AI agents. Markdown-native editor with pending change review — your agent writes, you accept or reject.",
   "type": "module",
   "license": "MIT",
@@ -26,6 +26,10 @@
   "bin": {
     "openwriter": "./dist/bin/pad.js"
   },
+  "exports": {
+    ".": "./dist/bin/pad.js",
+    "./plugin-types": "./dist/server/plugin-types.js"
+  },
   "scripts": {
     "dev": "concurrently \"vite\" \"tsx watch server/index.ts\"",
     "build": "vite build && tsc -p tsconfig.server.json",