Skip to content

feat(cloudbase-sites): ✨ CloudBase Sites v2 plugin with Codex support#735

Merged
binggg merged 6 commits into
mainfrom
feat/cloudbase-sites-v2
Jun 4, 2026
Merged

feat(cloudbase-sites): ✨ CloudBase Sites v2 plugin with Codex support#735
binggg merged 6 commits into
mainfrom
feat/cloudbase-sites-v2

Conversation

@binggg
Copy link
Copy Markdown
Member

@binggg binggg commented Jun 4, 2026

Summary

This PR introduces the CloudBase Sites v2 plugin for the CloudBase AI Toolkit MCP Server, enabling AI agents to deploy static sites and single-page apps to CloudBase hosting with a Codex-compatible workflow.

Changes

  • ✨ Add CloudBase Sites plugin with save-to-file + deploy workflow (Codex Sites-style)
  • 🌐 Rename plugin to cloudbase-sites with proper description for skill activation
  • 📚 Explicit MCP-fetch convention for CloudBase domain skills
  • 🔧 Core runtime: lib/bin/hooks for cloudbase-vibe-coding integration
  • 🔒 Fix zip slip in template extraction (TSRC security checklist)
  • 💡 Improve manageApps, adopt framework=static, enable cloud-mode deploy
  • 🔧 Sync rules, tool descriptions, and plugin with new deploy strategy

Related Issues

Closes #734 (WeChat integration skill merged into base)

Checklist

  • Commits follow conventional-changelog style
  • pnpm build passes
  • No new supply-chain risks (pinned dependencies)
  • Skills/compat config regenerated if needed

binggg and others added 4 commits June 3, 2026 18:24
…oding

The plugin previously had only 3 files committed (deploy + SKILL.md + on-session-start.sh).
This restores the missing core runtime that those 3 files depend on:

- lib/preview-state.mjs    shared IO + probes + ERR codes (deploy depends on this)
- lib/registry.mjs         ~/.cloudbase-agent/registry.json CRUD with mkdir-lock
- lib/supervisor-ctl.mjs   ensureSupervisorRunning() — every bin calls this at startup
- bin/cloudbase-vibe-init           empty-cwd → React+Vite template + install + start
- bin/cloudbase-vibe-start-preview  daemonize Vite (PPID=1, port 17173-17272, --strictPort)
- bin/cloudbase-vibe-stop-preview   SIGTERM + SIGKILL escalation, unregister
- bin/cloudbase-vibe-restart-preview wrapper → start --force
- bin/cloudbase-vibe-status-preview triple-probe (alive + http + recorded)
- bin/cloudbase-vibe-supervisor     global daemon: 15s tick, 5-fail degraded
- hooks/on-file-change.sh           PostToolUse: 1.5s debounced async restart
- hooks/hooks.json                  registers SessionStart + PostToolUse
- .claude-plugin/plugin.json        manifest
- .mcp.json                         registers cloudbase-mcp upstream

End-to-end verified:
  start → PPID=1 daemon → kill -9 vite → supervisor restores in 15s → PPID=1 again
  HTTP 200 throughout, 0 leftover processes after stop --force.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ploy

Rename:
  plugin/cloudbase-vibe-coding/ → plugin/cloudbase-sites/
  manifest name: cloudbase-vibe-coding → cloudbase-sites
  state field:   serviceName → siteName (V1 reads upgrade in-memory)

CLI shape: 7 separate cloudbase-vibe-* bins → single `cloudbase-sites` with
subcommands. Inspired by https://developers.openai.com/codex/sites.

Subcommands:
  init          scaffold CloudBase + React/Vue + Vite from empty cwd
  preview       daemonize / inspect / stop / restart Vite dev server
  save          create a saved version (git tag version/<n> + app.json entry)
  deploy        two-phase: emit nextAction → manageApps → --post records URL
  rollback      revert to a saved version (stash uncommitted, git reset)
  versions      list saved versions + deployment status
  supervisor    global watchdog daemon

Two-stage save → deploy pattern (matches Codex Sites' "saved version" model):
  - `save` is a git checkpoint with a label and a number; no build, no deploy.
  - `deploy [--version <n>]` builds + emits nextAction(manageApps,
    framework=static, installCmd="", buildCmd="") for the saved version.
    Default: latest saved.
  - `--post --version <n> --access-url <url>` appends to deployments[],
    tags git deploy/<n>-<ts>, returns finalUrl with cache-bust.
  - app.json schema: { siteName, versions[], deployments[],
    currentVersion, currentDeploy }. V1 deployHistory[] auto-upgraded.

Hook RULES_BLOCK rewritten with new CLI quick-ref + Rule 7 explaining the
save→deploy two-stage workflow.

End-to-end verified (13 checks):
  preview start → PPID=1 → save v1 → deploy --skip-build → emit nextAction
  → --post v1 → version status flips to 'deployed' → save v2 → kill -9 vite
  → supervisor restores in 12s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ills

Plugin does NOT bundle the 25 CloudBase domain skills (ui-design, auth-tool,
auth-web, no-sql-web-sdk, web-development, etc.) — those live inside
cloudbase-mcp and are fetched on demand via:

  searchKnowledgeBase(mode="skill", skillName="<name>")

Changes:

- hook RULES_BLOCK: rewrote Rule 3 (UI design) and Rule 5 (BaaS-first) to
  use the explicit `searchKnowledgeBase(mode="skill", ...)` call form
  instead of vague "调 X skill" — model now knows it's an MCP tool call,
  not a Claude Code native skill lookup.
- hook RULES_BLOCK: added "CloudBase Skill catalog" section listing the
  8 most-likely-needed skill names with one-line descriptions, plus a
  note that the full list is reachable by calling the MCP tool with no
  skillName argument.
- SKILL.md: full rewrite to V2 (cloudbase-sites CLI subcommands, save→deploy
  two-stage workflow, skill-catalog convention, error code 14/15 for
  versions/rollback). Old V1 cloudbase-vibe-* command names purged.

Token cost: RULES_BLOCK injected at every SessionStart goes from ~1573
tokens to ~2160 (added catalog section). Still well under any sane
system-prompt budget; in exchange the model never has to guess where
"ui-design skill" lives.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Comment thread plugin/cloudbase-sites/lib/verbs/init.mjs Fixed
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

.string()
.optional()
.describe("应用线上访问路径(hosting mount path),例如 /my-web-app。不是本地目录路径;省略时默认为 /serviceName。"),

P2 Badge Align the appPath default with the actual deploy path

The schema now tells agents that omitting appPath defaults to /serviceName, but the implementation still resolves missing appPath to / (resolvedDeployPath = appPath || "/"). In deployments where callers rely on this description, the app is mounted at the root instead of the documented /serviceName path, so either the code or the tool description should be corrected.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +146 to +147
if (head && (head === version.commitSha || head.startsWith(version.commitSha) || version.commitSha.startsWith(head))) {
return { checked: true, changed: false, commitSha: version.commitSha };
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Ensure deploys ignore unsaved working-tree edits

When the user has saved a version and then makes additional local edits without running cloudbase-sites save again, deploy sees that HEAD still matches the saved commit and returns without stashing or resetting. The subsequent build therefore packages the dirty working tree while recording/deploying it as the saved version, which breaks the versioned deploy contract and can publish unsaved changes; this path should verify a clean tree or stash/reset even when HEAD matches.

Useful? React with 👍 / 👎.

@binggg binggg merged commit 5fdff4d into main Jun 4, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant