ReviewOS

also looking at this

stacks/buddy

fix(setup): make custom plugins able to run at all

#1416
Merged glennmichael123 wants to merge fix/json-plugins into main
5 files +401 -31
CLAUDE.mdmodified+18-12
Changes to CLAUDE.md
@@ -1187,30 +1187,36 @@ export JIRA_PROJECT_KEY="BUDDY" # Optional, defaults to BUDDY
11871187Create custom integrations by defining plugins in `.buddy/plugins/`:
11881188
11891189```jsonc
1190// .buddy/plugins/custom-integration.json
1190// .buddy/plugins/custom-notify.json
11911191{
1192 "name": "custom-integration",
1192 "name": "custom-notify",
11931193 "version": "1.0.0",
11941194 "enabled": true,
11951195 "triggers": [
1196 { "event": "setup*complete" },
1197 { "event": "validation*error" }
1196 { "event": "setup_complete" },
1197 { "event": "validation_error" }
11981198 ],
11991199 "hooks": [
12001200 {
1201 "name": "custom-notification",
1201 "name": "notify",
12021202 "priority": 10,
1203 "async": true,
1204 "handler": "// Custom JavaScript function"
1203 "action": {
1204 "type": "webhook",
1205 "url": "https://your-webhook.com/notify",
1206 "body": { "channel": "#builds" }
1207 }
12051208 }
1206 ],
1207 "configuration": {
1208 "webhook*url": "https://your-custom-webhook.com/notify",
1209 "api*key": "your-api-key"
1210 }
1209 ]
12111210}
12121211```
12131212
1213A hook declares an `action` rather than a function. JSON has no way to carry
1214one, and reading a string out of a config file to run as code would turn any
1215`.buddy/plugins/*.json` in a repository into arbitrary code execution on
1216whoever runs `buddy setup`. The payload names the event and the repository
1217and nothing else, plus whatever `body` adds — setup holds a token by the time
1218hooks run, and the plugin file chooses the URL.
1219
12141220### Plugin Events
12151221
12161222| Event | Description | Context |