Feature/api crm#572
Closed
cyco77 wants to merge 250 commits into
Closed
Conversation
Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com>
Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com>
…/copilot/fix-macos-notarization-errors Fix macOS notarization failures for production and nightly builds
…nd improve error handling
…improve error handling
…ofile detection (PowerPlatformToolBox#355) * Initial plan * Add browser profile support for interactive authentication - Add browserType and browserProfile fields to DataverseConnection interface - Implement browser-specific launch logic in AuthManager - Update add/edit connection modals with browser selection UI - Support Chrome, Edge, Firefox, and Brave browsers - Fallback to default browser if profile not found Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Address code review feedback - use helper functions consistently Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Refactor: Extract browser logic into separate BrowserManager - Create new BrowserManager class for browser detection and profile enumeration - Remove browser-related code from AuthManager - AuthManager now depends on BrowserManager via constructor injection - Add IPC channels for browser detection and profile listing - Update preload script to expose new browser APIs Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Implement dynamic browser profile detection in UI - Replace text input with dropdown for browser profiles - Dynamically detect browser installation on selection - Automatically load and populate browser profiles - Show warning when selected browser is not installed - Support both add and edit connection modals - Add modal-warning CSS for user feedback Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix: Browser profile detection in modals - Expose browser detection APIs in modalPreload.ts - Fix browser type change event to properly trigger profile loading - Set correct initial state for profile dropdown (No profile needed) - Remove premature loadBrowserProfiles() call that ran before DOM ready Fixes: - Profile selector now loads data when browser is selected - Browser detection APIs now available in modal context - Initial dropdown state shows correct message - Warning displays when browser not installed Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Enhance profile detection to show friendly names, support Chrome/Edge only - Read actual profile names from Local State file (e.g., "Person 1", "Work") - Fallback to reading individual Preferences files if Local State unavailable - Remove Firefox and Brave browser support (Chrome and Edge only) - UI now displays profile.name but stores profile.path for --profile-directory - Update both add and edit connection modals Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Move browser settings to separate section available for all auth types - Move browser type and profile selectors out of interactive-only section - Create new "Browser Settings (Optional)" section below Environment selector - Apply browser settings to all authentication types (interactive, clientSecret, usernamePassword, connectionString) - Browser profile used when tools need to open URLs with authentication - Updated both add and edit connection modals - Updated connectionManagement to apply browser settings to all auth types Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fixed style issue and added logos * Add browser profile tag to connection cards in sidebar - Add browserProfileName field to DataverseConnection type - Display browser icon and profile name as tag on connection cards - Tag shows Chrome/Edge icon with friendly profile name (e.g., "My Cool Profile") - Tag positioned next to environment badge - Update form controllers to capture and store profile name - Add CSS styling for connection-browser-tag with browser icon - Browser icons loaded from renderer/icons/logos/ Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix modal hanging issue - improve browser profile name collection - Fix collectFormData to safely handle empty profile selections - Only capture browserProfileName when a profile is actually selected - Add null-safe checks for selectedOptions array access - Prevent attempting to read textContent from empty value options Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Revert "Fix modal hanging issue - improve browser profile name collection" This reverts commit 607fde9. * Revert "Add browser profile tag to connection cards in sidebar" This reverts commit e1cab02. * feat: add browser profile name support in connection forms and UI * Update src/renderer/modules/connectionManagement.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/main/managers/browserManager.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/main/managers/browserManager.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/common/types/connection.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…derivation (PowerPlatformToolBox#354) * Initial plan * Add optional filters parameter to saveFile function Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix extension extraction to use path.extname for robust handling Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com>
* fix: enable recursive file search for notarization in release workflows * feat: add YAML regeneration steps for Windows, Linux, and macOS with correct SHA256 hashes * feat: add repackaging step for portable ZIP with signed EXE in Windows workflows
…x#356) * fix: Enhance Label structure compliance and add polymorphic lookup support This commit addresses documentation review findings and adds support for polymorphic lookup attributes (Customer/Regarding fields) to complete metadata CRUD operations implementation for issue PowerPlatformToolBox#319. ## Type Definitions (src/common/types/dataverse.ts) - Added `IsManaged?: boolean` property to LocalizedLabel interface * Microsoft examples show IsManaged included in all attribute/relationship/optionset requests * Properly tracks whether label originates from managed solution - UserLocalizedLabel remains optional in Label interface * Entity creation docs note it as read-only * However, Microsoft's own examples for attributes, relationships, and optionsets include it in POST requests * Implementation follows Microsoft's published examples ## DataverseManager Updates (src/main/managers/dataverseManager.ts) - Updated buildLabel() helper method: * Now creates LocalizedLabel with IsManaged: false property * Includes UserLocalizedLabel property set to same LocalizedLabel instance * Matches Microsoft's published examples for attribute/relationship creation * Example output: { LocalizedLabels: [{ Label: "Text", LanguageCode: 1033, IsManaged: false }], UserLocalizedLabel: { Label: "Text", LanguageCode: 1033, IsManaged: false } } - Added createPolymorphicLookupAttribute() method: * Enables creation of lookup fields that reference multiple entity types (Customer, Regarding scenarios) * Validates presence of non-empty Targets array with entity logical names * Automatically sets AttributeType="Lookup" and AttributeTypeName={ Value: "LookupType" } * Delegates to createAttribute() with proper polymorphic configuration * Returns { AttributeId: string } matching API contract * Comprehensive JSDoc with Customer (account/contact) and custom Regarding examples - Enhanced createRelationship() JSDoc: * Added CascadeConfiguration example with all cascade behaviors (Assign, Delete, Merge, Reparent, Share, Unshare) * Shows proper RemoveLink delete behavior for lookup fields - Enhanced updateRelationship() JSDoc: * Added example demonstrating cascade configuration updates (RemoveLink → Cascade) * Illustrates retrieve-modify-PUT pattern for relationship updates - Added LocalizedLabel to imports from common types ## IPC Infrastructure (src/common/ipc/channels.ts, src/main/index.ts) - Added CREATE_POLYMORPHIC_LOOKUP_ATTRIBUTE channel constant * Value: "dataverse.createPolymorphicLookupAttribute" - Registered IPC handler in main process: * Supports both primary and secondary connection targets * Extracts connectionId from WebContents based on connectionTarget parameter * Wraps dataverseManager.createPolymorphicLookupAttribute() with error handling * Proper cleanup with removeHandler() on application quit ## Preload Bridge (src/main/toolPreloadBridge.ts) - Exposed createPolymorphicLookupAttribute in toolboxAPI.dataverse - Exposed createPolymorphicLookupAttribute in window.dataverseAPI - Both accept (entityLogicalName, attributeDefinition, options?, connectionTarget?) parameters - Properly wrapped with ipcInvoke using CREATE_POLYMORPHIC_LOOKUP_ATTRIBUTE channel ## Public API Types (packages/dataverseAPI.d.ts) - Added createPolymorphicLookupAttribute method signature to DataverseAPI interface - Comprehensive JSDoc documentation: * Customer lookup example (account/contact on new_order entity) * Multi-entity Regarding example (account/contact/custom entities on new_note) * Documents Targets array requirement * Notes metadata publish requirement * Shows buildLabel() usage in examples - Method signature: (entityLogicalName, attributeDefinition, options?, connectionTarget?) => Promise<{ AttributeId: string }> ## Validation - TypeScript compilation: ✅ No errors - ESLint: ✅ 0 errors (TypeScript version warning acceptable) - All 12 implementation tasks completed - Documentation compliance verified against 5 Microsoft Learn articles ## Microsoft Documentation References - Attribute creation: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/create-update-column-definitions-using-web-api - Relationship creation: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/create-update-entity-relationships-using-web-api - Option sets: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/create-update-optionsets - Polymorphic lookups: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/multitable-lookup - Entity creation: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/create-update-entity-definitions-using-web-api Closes PowerPlatformToolBox#319 metadata CRUD operations (enhancement for polymorphic lookups) * fix: improve metadata CRUD error handling and add comprehensive documentation FIXES (Code Review Issues): 1. **Metadata creation methods now throw descriptive errors on missing headers** - createEntityDefinition, createAttribute, createRelationship, createGlobalOptionSet - Previously returned empty strings silently when OData-EntityId header missing - Now throw explicit errors: "Failed to retrieve MetadataId from response. The OData-EntityId header was missing." - Guides users to identify real issues (network failures, API changes, etc.) 2. **GET_ATTRIBUTE_ODATA_TYPE IPC handler now enforces type safety** - Added runtime enum validation against AttributeMetadataType values - Removed unsafe `as any` cast that bypassed TypeScript's type system - Throws descriptive error listing all valid types when invalid value provided - Example: "Invalid attribute type: 'InvalidType'. Valid types are: String, Integer, Boolean, ..." TECHNICAL DISCOVERY: **Dataverse metadata operations return HTTP 204 No Content with NO response body**: - Standard operations (entity, attribute, relationship, global option set): 204 No Content - Only OData-EntityId header contains the created MetadataId - Empty response body → makeHttpRequest returns `response.data = {}` - Exception: CreateCustomerRelationships action returns 200 OK with JSON body containing AttributeId and RelationshipIds This discovery led to abandoning a proposed "fallback to response body" approach, as responseData["MetadataId"] would always be undefined for metadata operations. DOCUMENTATION IMPROVEMENTS: 1. **execute() method**: Added comprehensive JSDoc with examples for: - CreateCustomerRelationships action (customer lookup creation with 200 OK response) - InsertStatusValue action (status choice column values with StateCode) - UpdateStateValue action (state value metadata updates) - Bound vs unbound actions/functions 2. **queryData() method**: Added examples demonstrating: - Retrieving global option sets by name: `GlobalOptionSetDefinitions(Name='name')` - Retrieving all global option sets with filters - Retrieving by MetadataId 3. **createPolymorphicLookupAttribute()**: Added note about CreateCustomerRelationships alternative 4. **insertOptionValue()**: Added note about InsertStatusValue for status choice columns 5. **createGlobalOptionSet()**: Added retrieval example using queryData() BENEFITS: - **Fail-Fast Approach**: Clear errors replace silent failures, improving debuggability - **Type Safety**: Runtime enum validation prevents invalid API calls - **Complete Coverage**: All metadata operations from Microsoft documentation are supported via existing methods (execute, queryData) - **Developer Guidance**: JSDoc examples show how to use actions like CreateCustomerRelationships, InsertStatusValue, UpdateStateValue - **No New Methods Needed**: Generic execute() and queryData() methods handle all special cases VALIDATION: - ✅ TypeScript compilation passed (pnpm run typecheck) - ✅ Linting passed (pnpm run lint - 0 errors) - ✅ Application builds successfully (pnpm build) - ✅ All 6 file edits applied successfully * feat(dataverse): add whitelist-based header validation for metadata operations Implemented comprehensive security validation for custom headers in metadata operations to prevent header injection attacks and API compliance issues. SECURITY ENHANCEMENTS: - Added validateMetadataHeaders() method with whitelist-based validation - Validates all custom headers against allowed list from Microsoft documentation - Blocks attempts to override protected headers (Authorization, Content-Type, etc.) - Case-insensitive header matching per HTTP specification (RFC 2616) - Detailed error messages showing invalid headers and allowed alternatives ALLOWED CUSTOM HEADERS (per Microsoft Dataverse Web API docs): - MSCRM.SolutionUniqueName: Associates metadata changes with solutions - MSCRM.MergeLabels: Controls label merging behavior (true/false) - Consistency: Forces reading latest version (value: "Strong") - If-Match: Standard HTTP header for optimistic concurrency control - If-None-Match: Standard HTTP header for caching control PROTECTED HEADERS (never allowed in customHeaders): - Authorization, Accept, Content-Type, OData-MaxVersion, OData-Version, Prefer, Content-Length (all controlled by makeHttpRequest) IMPLEMENTATION: - Created ALLOWED_METADATA_HEADERS constant with whitelist (5 headers) - Created PROTECTED_HEADERS constant with blacklist (7 headers) - Integrated validation into buildMetadataHeaders() for automatic coverage - All metadata operations now automatically validated: * createEntityDefinition / updateEntityDefinition * createAttribute / updateAttribute * createRelationship / updateRelationship * createGlobalOptionSet / updateGlobalOptionSet * createPolymorphicLookup BENEFITS: - Prevents header injection attacks and accidental header overrides - Ensures API compliance with Microsoft's documented patterns - Provides clear developer feedback when invalid headers are used - Defense-in-depth validation even for type-safe inputs DOCUMENTATION REFERENCES: Based on thorough review of 6 Microsoft Learn articles covering all metadata operation types (entity, attribute, relationship, option set operations). Changes maintain backward compatibility - all existing code uses valid headers through typed MetadataOperationOptions interface. * fix(types): replace 'any' with MetadataOperationOptions in IPC handlers Improved type safety in metadata operation IPC handlers by replacing all occurrences of 'options?: any' with proper 'options?: MetadataOperationOptions' type annotation. CHANGES: - Added MetadataOperationOptions to type imports from ../common/types - Updated 9 IPC handler signatures to use MetadataOperationOptions: * CREATE_ENTITY_DEFINITION * UPDATE_ENTITY_DEFINITION * CREATE_ATTRIBUTE * UPDATE_ATTRIBUTE * CREATE_POLYMORPHIC_LOOKUP_ATTRIBUTE * CREATE_RELATIONSHIP * UPDATE_RELATIONSHIP * CREATE_GLOBAL_OPTION_SET * UPDATE_GLOBAL_OPTION_SET BENEFITS: - Eliminates use of 'any' type, maintaining TypeScript strict mode compliance - Provides IntelliSense and autocomplete for options parameter - Type safety ensures only valid options (solutionUniqueName, mergeLabels, consistencyStrong) can be passed through IPC layer - Consistency with DataverseManager method signatures - Compile-time validation of option properties This change maintains backward compatibility while adding proper type checking for all metadata operation options passed from tools via IPC. * chore: update version to 1.0.19 in package.json * feat(preload): sync metadata CRUD operations with toolPreloadBridge Synchronized preload.ts with toolPreloadBridge.ts to ensure both the main ToolBox UI and tool windows have identical metadata operation APIs available. This maintains API parity and enables future metadata manipulation from the main UI if needed. ADDED METADATA OPERATIONS (22 new methods in dataverse namespace): Metadata Helper Utilities: - buildLabel: Build localized Label objects for metadata operations - getAttributeODataType: Get OData type string for attribute type enums Entity (Table) Metadata CRUD: - createEntityDefinition: Create new entity/table definitions - updateEntityDefinition: Update existing entity definitions (PUT) - deleteEntityDefinition: Delete entity definitions Attribute (Column) Metadata CRUD: - createAttribute: Create new attributes/columns on entities - updateAttribute: Update existing attribute definitions (PUT) - deleteAttribute: Delete attributes from entities - createPolymorphicLookupAttribute: Create multi-table lookup attributes Relationship Metadata CRUD: - createRelationship: Create 1:N, N:N, or polymorphic relationships - updateRelationship: Update existing relationship definitions (PUT) - deleteRelationship: Delete relationships Global Option Set (Choice) Metadata CRUD: - createGlobalOptionSet: Create new global option sets/choices - updateGlobalOptionSet: Update existing global option sets (PUT) - deleteGlobalOptionSet: Delete global option sets Option Value Modification Actions (OData Actions): - insertOptionValue: Insert new option values into option sets - updateOptionValue: Update existing option values (labels, etc.) - deleteOptionValue: Delete option values from option sets - orderOption: Reorder option values within option sets BENEFITS: - API parity between main UI (preload.ts) and tool windows (toolPreloadBridge.ts) - Main ToolBox UI can now perform metadata operations if needed in future - Consistent API surface across all preload contexts - Future-proofing for internal metadata management UI features - All operations support primary/secondary connection targeting IMPLEMENTATION NOTES: - All methods maintain same signatures as toolPreloadBridge.ts - Options parameter uses Record<string, unknown> for flexibility - Connection targeting via optional connectionTarget parameter - Validated header whitelisting enforced by DataverseManager layer This synchronization ensures both contexts stay in sync as the metadata API evolves and provides maximum flexibility for future UI enhancements. --------- Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com>
…latformToolBox#379) * Initial plan * Fix loading screen to only block tool panel, not entire window Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Address code review: Fix listener leak and simplify null coalescing Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix IPC listener cleanup: use ipcMain.on instead of once Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix loading overlay bounds calculation and add close button - Get bounds directly from active tool BrowserView instead of renderer - Add getActiveToolBounds() method to ToolWindowManager - Remove rounded corners from overlay container - Add close button to manually dismiss loading overlay - Make overlay window focusable and closable Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Improve close button accessibility and contrast - Add aria-label for screen reader support - Increase background opacity for better contrast (0.1 -> 0.15) - Add visible focus indicator with blue border and shadow - Improve border visibility (0.2 -> 0.3 opacity) Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix overlay positioning and explicitly remove all rounded corners - Use content bounds (screen coordinates) instead of incorrectly adding window bounds to BrowserView bounds - Explicitly set border-radius:0 on overlay-container and close-button - BrowserView bounds are content-relative, overlay BrowserWindow needs screen coordinates Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Address code review feedback: fix shutdown handling, HTML escaping, and error telemetry - Add isMainWindowClosing flag to allow overlay to close during app shutdown - Escape HTML in loading message to prevent injection attacks - Improve error handling with captureException and full context (activeToolId, tags) - Properly destroy overlay window in cleanup - Add close listener on main window to set shutdown flag Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Refine code review fixes: use specific listener reference and clarify HTML escaping - Store closeHandler reference to remove specific listener (not all listeners) - Add comment explaining critical order of HTML entity replacements - Prevent potential issues with removeAllListeners affecting other code Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Polish destroy logic for better clarity and consistency - Move overlayWindow null assignment inside if block for logical consistency - Set closeHandler to null after cleanup for better flow - Clearer separation of window cleanup vs handler cleanup Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com>
…tformToolBox#384) (PowerPlatformToolBox#385) * feat: add getCSDLDocument API for retrieving OData endpoint (PowerPlatformToolBox#384) Add new getCSDLDocument() method to DataverseAPI that retrieves the complete CSDL/EDMX metadata document from Dataverse's OData $metadata endpoint. Key Features: - Returns raw XML containing complete schema metadata (entities, attributes, relationships, actions, functions, complex types, enum types) - Supports gzip/deflate compression for optimal transfer (70-80% size reduction) - Automatic decompression handling using Node.js zlib module - Multi-connection support (primary/secondary) for advanced tools - Response size: 1-5MB typical, up to 10MB+ for complex environments Implementation: - Added GET_CSDL_DOCUMENT IPC channel to channels.ts - Implemented getCSDLDocument() in DataverseManager with: - Custom HTTPS request handler (avoids JSON parsing) - Accept-Encoding: gzip, deflate headers - Automatic decompression via zlib.gunzip/inflate - Buffer-based response handling for binary data - Registered IPC handler in index.ts with connection targeting support - Exposed method in toolPreloadBridge.ts and preload.ts - Added comprehensive TypeScript definitions in dataverseAPI.d.ts Use Cases: - Build Dataverse REST Builder (DRB) clone tools - Create intelligent query builders and code generators - Generate TypeScript interfaces from schema - Explore entity relationships and metadata - Validate action/function parameters Naming Rationale: Method named getCSDLDocument() (not getMetadata()) to avoid confusion with existing entity metadata operations like getEntityMetadata() and getAllEntitiesMetadata(). CSDL (Common Schema Definition Language) clearly indicates it returns the OData service document. Related: PowerPlatformToolBox#384 * fix: expose getCSDLDocument on window.dataverseAPI for direct tool access Fixed issue where getCSDLDocument was only accessible via window.toolboxAPI.dataverse.getCSDLDocument but not directly on window.dataverseAPI.getCSDLDocument like other Dataverse operations. Changes: - Added getCSDLDocument to toolPreloadBridge.ts dataverseAPI namespace - Now consistent with other operations (getSolutions, queryData, etc.) - Tools can call dataverseAPI.getCSDLDocument() directly as expected This ensures getCSDLDocument follows the same exposure pattern as all other Dataverse API methods. * fix: decompress error responses in getCSDLDocument for readable error messages Previously, error responses (non-200 status codes) were converted directly from Buffer to UTF-8 string without checking for compression. Since the request includes 'Accept-Encoding: gzip, deflate' header, Dataverse may return compressed error responses, resulting in garbled error messages. Changes: - Added decompression logic to error response path - Check content-encoding header (gzip/deflate/none) - Decompress error body before converting to string - Added try-catch to handle decompression failures gracefully - Error messages now readable regardless of compression This mirrors the success path's decompression logic and ensures consistent handling of both success and error responses.
* fix: clean up toolboxAPI type definitions and improve connection handling * fix: implement filesystem access management for tools with user consent model * Fix filesystem access tracking to use instanceId instead of toolId (PowerPlatformToolBox#390) * Initial plan * fix: track filesystem access per instance instead of per tool This change fixes the issue where closing one instance of a tool would revoke filesystem access for all other instances of the same tool. Changes: - Updated ToolFileSystemAccessManager to use instanceId as key instead of toolId - Added getInstanceIdByWebContents() method to ToolWindowManager - Updated all filesystem IPC handlers to use instanceId - Updated closeTool() to revoke access only for the specific instance This ensures that each tool instance maintains its own filesystem permissions independently, allowing multiple instances of the same tool to run simultaneously without interfering with each other. Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * refactor: eliminate code duplication in toolWindowManager methods Refactor getToolIdByWebContents() to call getInstanceIdByWebContents() and extract the toolId from the result, eliminating duplicated loop logic. Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
…aller (PowerPlatformToolBox#397) * Initial plan * Add Windows multi-architecture support to latest.yml generation Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Apply Windows YAML merge fix to nightly-release workflow Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add standalone script to generate merged Windows latest.yml Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add buildScripts/latest.yml to gitignore and remove example file Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add macOS multi-architecture support to latest-mac.yml generation Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Remove legacy build scripts and add new merge scripts for Windows and macOS - Deleted old merge scripts: merge-macos-latest-yml.sh, merge-windows-latest-yml.sh, test-macos-build.sh, verify-build.sh - Added new merge scripts for Windows and macOS with improved functionality and documentation. - Created README for merge scripts detailing usage and troubleshooting. - Implemented new test and verification scripts for macOS builds to ensure proper packaging and structure. * fix: correct path to verify-build.sh script in build workflow * Update buildScripts/sh/merge-latest-yml.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/workflows/prod-release.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/workflows/nightly-release.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add support for bundled SVG icons in tools with backward compatibility (PowerPlatformToolBox#380) * Initial plan * Add SVG icon support with pptb-webview protocol for bundled icons Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Address code review feedback: fix recent tools icon handling and add HTML escaping Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add comprehensive HTML escaping for XSS prevention in icon URLs Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Improve accessibility and eliminate code duplication in HTML escaping Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add defensive URL validation to prevent JavaScript protocol injection Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix CodeQL warning by blocking vbscript protocol in URL validation Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Remove HTTP(S) icon support, change path to dist/ relative, rename iconUrl to icon Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Update ToolManifest comment to reflect bundled icons only (no HTTP URLs) Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add support for new Supabase 'icon' column with backward compatibility fallback to 'iconurl' Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix CSP error by allowing HTTP(S) URLs for marketplace icon display Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Add pptb-webview protocol to CSP img-src to allow local SVG icon loading Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * feat: add SVG icon support and improve icon URL resolution * feat: implement theme-aware SVG icon support with CSS masks and improve icon rendering * refactor: remove tool icon configuration section from README.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com> * Move tool distribution from GitHub Releases to Azure Blob Storage (PowerPlatformToolBox#400) * Initial plan * Add Azure Blob Storage support for tool distribution and registry fallback Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Remove hard-coded Azure Blob storage account name; resolve URLs at runtime from AZURE_BLOB_BASE_URL Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Simplify registry.json downloadUrl to filename-only; packages/ prefix added automatically at runtime Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Use per-tool version folder layout in Azure Blob, mirroring GitHub Releases structure Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Read download URL from new 'download' column in Supabase tools table, fall back to 'downloadurl' Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * fix: update Azure Blob Storage migration documentation to reflect new package structure --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Power-Maverick <danish.naglekar@hotmail.com> * feat: enhance ToolManager to create tools from installed manifests and improve tool retrieval logic * Update src/main/constants.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update Azure Blob test download URL to dedicated test path (PowerPlatformToolBox#404) * Initial plan * Update test tool download URL to /test/pptb-standard-sample-tool-download-test.tar.gz Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix resolveDownloadUrl to include packages/ prefix for Azure Blob Storage paths (PowerPlatformToolBox#405) * Initial plan * fix: include packages/ prefix in resolveDownloadUrl for Azure Blob Storage Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Fix: include `icon` field in `fetchAzureBlobRegistry` tool mapping (PowerPlatformToolBox#406) * Initial plan * fix: include icon field in fetchAzureBlobRegistry mapping Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Update src/main/index.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…ormToolBox#408) * Initial plan * Add modern themed update notification modal dialog Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Address review comments: reword restart warning and extract highlights from release notes Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> * Update src/renderer/modules/autoUpdateManagement.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Power-Maverick <36135520+Power-Maverick@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
When PowerShell (and other shells) run in interactive mode with stdin piped, they echo the commands written to stdin back to stdout. This caused the internal sentinel command used for exit-code detection to appear verbatim in the terminal UI. Fix: buffer stdout by line while a command is executing and drop any line that matches the per-shell-type sentinel echo pattern before emitting output to the display. Remaining buffered data is flushed (with the same filter applied) when the pending command is resolved or fails.
…/copilot/secure-terminal-commands Harden tool terminal execution with command blocklisting and persistent shell process
…/bug/487-incorrect-button-placement-settings Adjust button alignment and layout in settings and tool item sections
…/copilot/support-beta-packages feat: support beta/pre-release npm packages for tools
1.2.3 Release Notes
…/fix/npm-install-issue Fix npm install and uninstall issue
Contributor
There was a problem hiding this comment.
Pull request overview
This PR expands Power Platform ToolBox’s tool ecosystem features by adding (1) capability-based tool discovery, (2) improved inter-tool invocation UX/flow (banner, auto-close, multi-connection prompting, one-at-a-time enforcement), and (3) prerelease/beta npm package detection + installation support, alongside terminal hardening and a Dataverse URL validation update.
Changes:
- Add capability tag registry plumbing (Supabase-backed with built-in fallback), tool capability parsing from
pptb.config.json, and afindToolsByCapabilityAPI surface. - Enhance inter-tool invocation lifecycle (callee tab creation/removal, “Return to caller” banner, optional
noReturn, connection auto-inheritance + secondary-connection prompt). - Add prerelease npm package support (beta dist-tag detection + install flow), and tighten TerminalManager command/env sanitization.
Reviewed changes
Copilot reviewed 26 out of 29 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| src/renderer/types/index.ts | Adds npmPackageName to renderer tool detail type for prerelease detection. |
| src/renderer/styles.scss | UI tweaks + new invocation banner styling. |
| src/renderer/modules/toolManagement.ts | Adds renderer-side invocation banner, connection prompt handling, and callee tab lifecycle listeners. |
| src/renderer/modules/marketplaceManagement.ts | Adds prerelease detection and prerelease install button logic in tool detail view. |
| src/renderer/modules/initialization.ts | Wires invocation initializers and adjusts BrowserView bounds when banner is visible. |
| src/renderer/modules/connectionManagement.ts | Expands Dataverse hostname validation to include *.api.crm* hosts and minor formatting fixes. |
| src/renderer/index.html | Adds invocation banner DOM container above tool content. |
| src/main/toolPreloadBridge.ts | Extends tool invocation launch options (noReturn) and adds capability discovery APIs for tools. |
| src/main/preload.ts | Exposes new renderer-shell IPC APIs (banner state, prompts, prerelease install/check, capability tags). |
| src/main/managers/toolWindowManager.ts | Implements invocation banner state push, callee opened/closed events, one-at-a-time enforcement, connection prompting, and capability search IPC. |
| src/main/managers/toolsManager.ts | Persists capabilities on loaded tools, adds known-capability retrieval + prerelease install helpers, adjusts uninstall behavior, and improves package manager env handling. |
| src/main/managers/toolRegistryManager.ts | Adds Supabase + fallback capability tag registry, prerelease npmPackageName field, capability parsing/validation, and beta dist-tag query. |
| src/main/managers/terminalManager.ts | Refactors terminal execution around a persistent shell with improved validation/sanitization and sentinel-based completion. |
| src/main/managers/browserviewProtocolManager.ts | Adjusts npm tool base directory resolution for version/tagged package names. |
| src/main/index.ts | Adds IPC handlers for capability tag retrieval and prerelease/beta package workflows. |
| src/main/constants.ts | Introduces blocked terminal commands/env keys/npx flags constants for terminal hardening. |
| src/common/types/tool.ts | Adds capability tag types and tool capability fields + npm package name on registry entries. |
| src/common/types/api.ts | Extends ToolboxAPI surface for invocation capabilities, banner/prompt events, and prerelease helpers. |
| src/common/ipc/channels.ts | Adds IPC channel constants for capability tags, prerelease checks/installs, and invocation banner/prompt lifecycle. |
| RELEASE_NOTES.md | Updates release notes to 1.2.3 highlighting prerelease, invocation, capability discovery, and terminal hardening. |
| README.md | Updates icon path and tool update status badge URL; minor formatting. |
| packages/toolboxAPI.d.ts | Updates public tool-dev API typings to reflect invocation lifecycle, noReturn, capability discovery, and terminal notes. |
| packages/README.md | Documents invocation.capabilities, updated invocation behaviors, and terminal execution rules. |
| packages/pptbConfig.d.ts | Adds capability tag types/unions and documents invocation.capabilities schema. |
| packages/package.json | Bumps @pptb/types version to 1.2.3. |
| packages/lib/validate.js | Adds capability tag validation (warnings for unknown tags) and exports KNOWN_CAPABILITY_TAGS. |
| packages/bin/pptb-validate.js | Prints declared capabilities and known tag list in validation output. |
| package.json | Bumps app version to 1.2.3. |
| docs/INTER_TOOL_INVOCATION.md | Expands inter-tool invocation docs with banner/noReturn, capability discovery, auto-close, and multi-connection scenario details. |
| bottom: 0; | ||
| background: var(--bg-color); | ||
| z-index: 10; | ||
| justify-content: end; |
Comment on lines
+1802
to
+1805
| returnBtn.addEventListener("click", () => { | ||
| void window.toolboxAPI.returnToCallerBanner(); | ||
| banner.style.display = "none"; | ||
| }); |
Comment on lines
177
to
+181
| ipcMain.removeHandler(TOOL_WINDOW_CHANNELS.GET_OPEN_TOOLS); | ||
| ipcMain.removeHandler(TOOL_WINDOW_CHANNELS.UPDATE_TOOL_CONNECTION); | ||
| ipcMain.removeHandler(TOOL_WINDOW_CHANNELS.HIDE_ALL); | ||
| ipcMain.removeHandler(TOOL_WINDOW_CHANNELS.RETURN_INVOCATION_DATA); | ||
| ipcMain.removeHandler(TOOL_WINDOW_CHANNELS.FIND_TOOLS_BY_CAPABILITY); |
Comment on lines
290
to
294
| ipcMain.removeHandler(TOOL_CHANNELS.FETCH_REGISTRY_TOOLS); | ||
| ipcMain.removeHandler(TOOL_CHANNELS.FETCH_COMMUNITY_LINKS); | ||
| ipcMain.removeHandler(TOOL_CHANNELS.GET_KNOWN_CAPABILITY_TAGS); | ||
| ipcMain.removeHandler(TOOL_CHANNELS.CHECK_TOOL_UPDATES); | ||
| ipcMain.removeHandler(TOOL_CHANNELS.UPDATE_TOOL); |
| * - "my-tool" => "my-tool" | ||
| * - "@scope/my-tool" => "@scope/my-tool" | ||
| */ | ||
| const packageDirName = tool.npmPackageName.replace(/@?([^@]+)(?:@[\d.]+)?$/, ""); |
Comment on lines
192
to
198
| unloadTool(toolId: string): void { | ||
| const tool = this.tools.get(toolId); | ||
| if (tool) { | ||
| this.tools.delete(toolId); | ||
| // Too soon to delete it | ||
| //this.tools.delete(toolId); | ||
| this.emit("tool:unloaded", tool); | ||
| } |
Comment on lines
+239
to
+253
| const rawExecutable = tokens[0]; | ||
| const executable = rawExecutable.toLowerCase(); | ||
|
|
||
| if (/[;&|<>]/.test(rawExecutable)) { | ||
| throw new Error(`Terminal command executable "${rawExecutable}" contains shell metacharacters.`); | ||
| } | ||
|
|
||
| if (BLOCKED_TERMINAL_COMMANDS.has(executable)) { | ||
| throw new Error(`Blocked unsafe terminal command "${rawExecutable}". Shell interpreters and privilege-escalation tools are not allowed.`); | ||
| } | ||
|
|
||
| if (executable === "npx" && tokens.slice(1).some((arg) => BLOCKED_NPX_FLAGS.has(arg.toLowerCase()))) { | ||
| throw new Error("Blocked unsafe npx invocation. Shell execution flags are not allowed."); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please fill in this template.