- --source clones each registry repository (https only) at the chosen tag,
adds it as a submodule under plugins/<vendor>/<name>, absorbs its git
dir and registers it with the tag as the go.mod require
- git URLs (https, ssh, user@host:path) are cloned with the user's git
setup and never sent to the registry; the newest tag whose plugin.yaml
framework minimum fits is checked out, else the default branch head
- go.work replace overrides for every local replace in workspace modules'
go.mod files (app target, versioned workspace module, or version pin)
- GIT_ALLOW_PROTOCOL=https:ssh, '--' before URLs and paths; non-git apps
are refused before cloning; plugin:add keeps require v0.0.0
- kiosk.Client reads the registry API v1 over fetchguard (trusted mode,
4 MiB, 10 s, no redirects); kiosk.RegistryURL reads plugins.registry_url
(default https://summercms.io, empty disables)
- build.PlanInstall/ApplyInstall pick the newest release the effective
framework satisfies (or a pin), validate registry strings, go get it and
append it to summer.yaml
- summer.yaml edits (plugin:add and plugin:install) keep comments and
blank lines
- TestInstallSmoke/module installs from a file:// GOPROXY and builds
- kiosk.ReadIdentity: ID()/Requires() as literals or constants across packages and modules, read with go/parser, never run
- plugin minimums from go.mod requires; v0.0.0 is an error, a pseudo-version warns
- kiosk.Validate, kiosk.CheckT (no testing import)
- plugin:add reads IDs through kiosk.ReadIdentity, so const-ID plugins register
make:*, plugin:add and new inserted toolchain go1.27.0 into go.mod and
go.work whenever that exact line was missing. A file that already named
another toolchain (go mod tidy and go work use write the running one)
ended up with two toolchain lines, and Go refused to load it with
"repeated toolchain statement". ensureToolchain now keeps an existing
line, replaces it only when it names an older toolchain, and inserts
one only when there is none.
- make:plugin writes plugins/<vendor>/<name> with module
<app>/plugins/<vendor>/<name>; the package name stays <name>
- make:* and the models-leaf check look in summer.yaml, then
plugins/<vendor>/<name>, then the older plugins/<name>
- summer new puts its starter plugin at plugins/golem15/<name>
- refuse a vendor directory that is a legacy plugin module and a second
copy of a plugin that already sits in plugins/<name>
- help text and docs, with an upgrading note: moving is optional
- build runs go build under a spinner on a terminal and ends with
'Built bin/<name> in <time>'; make:* print 'Created <path>' per file
- make:*, plugin:add, new, parity:*, docs:build, docs:sync and every
delegate get long help and examples; delegates note that global options
pass through to the application binary
- make:* failures (no summer.yaml, invalid plugin ID or name, existing
artifact, unknown plugin) explain themselves and suggest a command
- docs:build and docs:sync return bonfire.Reported after the problem list
- TestCommandsDocumented covers the tool commands too
- docs: Upgrading to 0.4, delegates and global options, make: results and
hints, the checklist for a finished command
- build.NewApp writes sm-<name>-app: go.mod with a relative framework
replace, go.work, summer.yaml, config/ and a starter plugin
- make:plugin gains an opt-in starter route (GET /{$}) in the same
routes.go template; plain make:plugin output is unchanged
- plugin:add writes go.work use paths relative to the go.work directory
- bonfire accepts new as a bare tool command name
Render plugin.go, routes.go, leaf packages and go.mod from embedded
templates, emit empty registry accessors, and define job, admin, lang
and mail capability contracts so a new plugin compiles before artifacts.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Scaffold a compiling vendor.plugin module with go.mod, plugin.go and config/
- Register the module once in summer.yaml, go.work and the app go.mod
- Keep summer build on the same generate-and-compile path and print elapsed time
