mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
SivanCola
d97dfdcfbf
* feat(registry): support plugin submissions Problem: The community registry exposed only skill and MCP package kinds even though the installer already supports plugin packages. Root cause: Plugin was absent from the site form, query and publish schemas, shared package types, and republish persistence. Fix: Add plugin as a first-class registry kind, require installable GitHub plugin sources, persist kind changes on republish, and expose plugin filtering and guidance in the site and moderation UI. Verification: - npm test (workers/crash-report) - npm run typecheck (workers/crash-report) - npm test (site) - npm run build (site) - Browser verification at /skills/ * fix(registry): re-review package reclassifications Problem: Package owners could reclassify an active or verified package as a plugin without returning it to moderation, and the publish API accepted plugin installers hidden behind skill or MCP kinds. Root cause: Republish persisted kind without coupling the change to status and verification, while validation only checked installer mismatches when kind itself was plugin. Fix: Return publisher-initiated active kind changes to pending, clear verification on every non-admin kind change, and require explicit installer kinds to match the public package kind. Verification: - npm test (workers/crash-report): 29 passed - npm run typecheck (workers/crash-report) - git diff --check * fix(registry): disclose compatible plugin formats Problem: The registry publish form and API error claimed plugin submissions required a Reasonix-native manifest, even though the installer also accepts Codex and Claude plugin packages. Root cause: The submission guidance was written for the first native manifest path and was not updated when compatibility parsers and Claude marketplace support were added. Fix: List the native, Codex, Claude, and supported Claude marketplace manifests in both the form guidance and server validation error, with contract tests covering every format. Verification: - worker test suite: 30 tests passed - worker TypeScript typecheck passed - site test suite: 24 tests passed - Astro production build passed - git diff --check passed * fix(registry): pin installs to declared package kind Problem: - Registry skill and MCP submissions could retain installKind=auto, while copied install requests omitted the declared kind. Root cause: - Only plugin submissions normalized auto, and the API echoed legacy installer values independently of the public package kind. Fix: - Normalize every submission and API response to the declared kind, and preserve that kind in publish and copy flows. Verification: - workers/crash-report: npm test; npm run typecheck - site: npm test; npm run build - git diff --check * fix(registry): harden plugin source validation Problem: Plugin submissions could preserve control characters in copied install prompts, and non-canonical GitHub URLs could select paths outside the cloned repository. Root cause: The registry accepted any GitHub URL with two path segments while the Go installer ignored unsupported URL tails and joined tree paths without a containment check. Fix: Reject unsafe source characters and non-repository GitHub shapes, make the shared Go parser fail closed, and verify selected plugin roots remain inside the resolved clone. Verification: go test ./internal/installsource env -u DEEPSEEK_API_KEY go test ./... go vet ./... npm test && npm run typecheck (workers/crash-report) npm test && npm run build (site)