feat(registry): add custom registry sources

Author: FTMahringer

.github/release-notes/v2.6.2-dev.md

@@ -0,0 +1,32 @@
+# v2.6.2-dev
+
+Custom Registry Sources for the v2.7.0 plugin ecosystem milestone.
+
+## Added
+
+- Persistent custom registry source records for GitHub, GitLab, Forgejo, and Nexus/Maven-style sources.
+- Registry source API endpoints:
+  - `GET /api/registry/sources`
+  - `POST /api/registry/sources`
+  - `PUT /api/registry/sources/{id}`
+  - `DELETE /api/registry/sources/{id}`
+  - `POST /api/registry/sources/{id}/sync`
+- Source visibility controls:
+  - `store` entries appear in marketplace/store listings
+  - `internal` entries stay available to registry/admin flows but are hidden from store listings
+- Per-source trust tier and sync interval fields.
+- CLI commands:
+  - `synapse registry sources`
+  - `synapse registry add-source`
+  - `synapse registry remove-source`
+  - `synapse registry sync-source`
+
+## Validation
+
+```bash
+cd packages/core
+mvn -q test
+
+cd ../cli
+go test ./...
+```

CHANGELOG.md

@@ -9,6 +9,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [v2.6.2-dev] - 2026-05-18
+
+**Custom Registry Sources**
+
+### Added
+- Persistent custom registry sources with GitHub, GitLab, Forgejo, and Nexus/Maven source types.
+- Source visibility controls for `internal` vs `store` marketplace exposure.
+- Per-source trust tier and sync interval configuration.
+- Registry source APIs for listing, adding, updating, removing, and syncing sources.
+- `synapse registry add-source`, `sources`, `remove-source`, and `sync-source` CLI commands.
+
+### Changed
+- Store listings now hide entries from registry sources marked `internal`.
+- Core and dashboard versions are now `2.6.2-dev`.
+- The `v2.6.2-dev` roadmap step is now complete.
+
+---
+
 ## [v2.6.1-dev] - 2026-05-18
 
 **Plugin Registry Service Core**

docs/roadmaps/SYNAPSE_V3_IMPLEMENTATION_ROADMAP.md

@@ -450,7 +450,7 @@ security controls. Completes the plugin platform story.
 - `synapse registry sync` CLI command
 - **Exit**: Registry serves metadata + JARs; standalone starts as separate container
 
-#### v2.6.2-dev: Custom Registry Sources
+#### v2.6.2-dev: Custom Registry Sources (completed)
 - Add/remove sources: GitHub, GitLab, Forgejo, Nexus/Maven
 - Visibility toggle: `internal` or `store`
 - Per-source trust tier and sync interval

packages/cli/cmd/registry.go

@@ -131,6 +131,134 @@ var registrySyncCmd = &cobra.Command{
 	},
 }
 
+var registrySourcesCmd = &cobra.Command{
+	Use:   "sources",
+	Short: "List registered registry sources",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client := clientFromCmd(cmd)
+		rawJSON, _ := cmd.Flags().GetBool("json")
+
+		var resp []map[string]any
+		if err := client.Get("/api/registry/sources", &resp); err != nil {
+			return err
+		}
+
+		if rawJSON {
+			tuioutput.JSON(resp)
+			return nil
+		}
+
+		tuioutput.Header(fmt.Sprintf("Registry Sources (%d)", len(resp)))
+		tuioutput.Separator()
+		for _, source := range resp {
+			tuioutput.Row(
+				fmt.Sprint(source["id"]),
+				fmt.Sprint(source["type"]),
+				fmt.Sprint(source["visibility"]),
+				fmt.Sprint(source["trustTier"]),
+				fmt.Sprint(source["url"]),
+			)
+		}
+		return nil
+	},
+}
+
+var registryAddSourceCmd = &cobra.Command{
+	Use:   "add-source",
+	Short: "Register a custom plugin registry source",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client := clientFromCmd(cmd)
+		rawJSON, _ := cmd.Flags().GetBool("json")
+		id, _ := cmd.Flags().GetString("id")
+		name, _ := cmd.Flags().GetString("name")
+		sourceType, _ := cmd.Flags().GetString("type")
+		sourceURL, _ := cmd.Flags().GetString("url")
+		visibility, _ := cmd.Flags().GetString("visibility")
+		trustTier, _ := cmd.Flags().GetString("trust-tier")
+		syncInterval, _ := cmd.Flags().GetString("sync-interval")
+		token, _ := cmd.Flags().GetString("token")
+		enabled, _ := cmd.Flags().GetBool("enabled")
+
+		body := map[string]any{
+			"id":           id,
+			"name":         name,
+			"type":         sourceType,
+			"url":          sourceURL,
+			"visibility":   visibility,
+			"trustTier":    trustTier,
+			"syncInterval": syncInterval,
+			"enabled":      enabled,
+		}
+		if token != "" {
+			body["token"] = token
+		}
+
+		var resp map[string]any
+		if err := client.Post("/api/registry/sources", body, &resp); err != nil {
+			return err
+		}
+
+		if rawJSON {
+			tuioutput.JSON(resp)
+			return nil
+		}
+
+		tuioutput.OK(fmt.Sprintf("Registry source registered: %v (%v)", resp["id"], resp["type"]))
+		return nil
+	},
+}
+
+var registryRemoveSourceCmd = &cobra.Command{
+	Use:   "remove-source <sourceId>",
+	Short: "Remove a custom plugin registry source",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client := clientFromCmd(cmd)
+		rawJSON, _ := cmd.Flags().GetBool("json")
+
+		if err := client.Delete("/api/registry/sources/" + args[0]); err != nil {
+			return err
+		}
+
+		if rawJSON {
+			tuioutput.JSON(map[string]any{"id": args[0], "removed": true})
+			return nil
+		}
+
+		tuioutput.OK("Registry source removed: " + args[0])
+		return nil
+	},
+}
+
+var registrySyncSourceCmd = &cobra.Command{
+	Use:   "sync-source <sourceId>",
+	Short: "Sync one custom registry source now",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		client := clientFromCmd(cmd)
+		rawJSON, _ := cmd.Flags().GetBool("json")
+
+		var resp map[string]any
+		if err := client.Post("/api/registry/sources/"+args[0]+"/sync", map[string]any{}, &resp); err != nil {
+			return err
+		}
+
+		if rawJSON {
+			tuioutput.JSON(resp)
+			return nil
+		}
+
+		tuioutput.OK(
+			fmt.Sprintf(
+				"Registry source synced: %v entries from %v",
+				resp["entriesSynced"],
+				resp["source"],
+			),
+		)
+		return nil
+	},
+}
+
 var registryStatusCmd = &cobra.Command{
 	Use:   "status",
 	Short: "Show registry service status",
@@ -166,7 +294,29 @@ func init() {
 	registryListCmd.Flags().String("type", "", "Filter by type")
 	registryListCmd.Flags().Bool("compatible", false, "Only show entries compatible with this SYNAPSE version")
 
-	registryCmd.AddCommand(registryListCmd, registryVersionsCmd, registrySyncCmd, registryStatusCmd)
+	registryAddSourceCmd.Flags().String("id", "", "Source ID (defaults to a slug from name)")
+	registryAddSourceCmd.Flags().String("name", "", "Source display name")
+	registryAddSourceCmd.Flags().String("type", "", "Source type: github, gitlab, forgejo, or maven")
+	registryAddSourceCmd.Flags().String("url", "", "Registry source URL")
+	registryAddSourceCmd.Flags().String("visibility", "store", "Visibility: store or internal")
+	registryAddSourceCmd.Flags().String("trust-tier", "community", "Trust tier: official, community, or private")
+	registryAddSourceCmd.Flags().String("sync-interval", "PT1H", "Sync interval as an ISO-8601 duration")
+	registryAddSourceCmd.Flags().String("token", "", "Bearer token for private registry sources")
+	registryAddSourceCmd.Flags().Bool("enabled", true, "Enable source after registration")
+	registryAddSourceCmd.MarkFlagRequired("name")
+	registryAddSourceCmd.MarkFlagRequired("type")
+	registryAddSourceCmd.MarkFlagRequired("url")
+
+	registryCmd.AddCommand(
+		registryListCmd,
+		registryVersionsCmd,
+		registrySyncCmd,
+		registryStatusCmd,
+		registrySourcesCmd,
+		registryAddSourceCmd,
+		registryRemoveSourceCmd,
+		registrySyncSourceCmd,
+	)
 	commandfeatures.BindSubcommandListing(registryCmd)
 	rootCmd.AddCommand(registryCmd)
 }

packages/cli/cmd/registry_test.go

@@ -79,6 +79,61 @@ func TestRegistryListCommand(t *testing.T) {
 	}
 }
 
+func TestRegistryAddSourceCommand(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/registry/sources" {
+			t.Fatalf("unexpected path: %s", r.URL.Path)
+		}
+		if r.Method != http.MethodPost {
+			t.Fatalf("unexpected method: %s", r.Method)
+		}
+		var body map[string]any
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatalf("decode body: %v", err)
+		}
+		if body["type"] != "gitlab" || body["visibility"] != "store" || body["trustTier"] != "private" {
+			t.Fatalf("unexpected body: %#v", body)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"id":         "company-gitlab",
+			"type":       "gitlab",
+			"visibility": "store",
+			"trustTier":  "private",
+		})
+	}))
+	defer server.Close()
+
+	cmd, _, err := newIsolatedRootCommand()
+	if err != nil {
+		t.Fatalf("newIsolatedRootCommand: %v", err)
+	}
+
+	got := captureStdout(t, func() {
+		cmd.SetArgs([]string{
+			"registry",
+			"add-source",
+			"--host",
+			server.URL,
+			"--name",
+			"Company GitLab",
+			"--type",
+			"gitlab",
+			"--url",
+			"https://gitlab.example.com/plugins/registry.yml",
+			"--visibility",
+			"store",
+			"--trust-tier",
+			"private",
+		})
+		if err := cmd.Execute(); err != nil {
+			t.Fatalf("execute: %v", err)
+		}
+	})
+	if !strings.Contains(got, "Registry source registered: company-gitlab") {
+		t.Fatalf("unexpected output: %q", got)
+	}
+}
+
 func captureStdout(t *testing.T, fn func()) string {
 	t.Helper()
 

packages/core/pom.xml

@@ -15,7 +15,7 @@
 
     <groupId>dev.synapse</groupId>
     <artifactId>synapse-core</artifactId>
-    <version>2.6.1-dev</version>
+    <version>2.6.2-dev</version>
     <name>synapse-core</name>
     <description>SYNAPSE Spring Boot backend</description>