PluginContext by RohitKushvaha01 · Pull Request #1867 · Acode-Foundation/Acode

RohitKushvaha01 · 2026-02-11T08:46:29Z

No description provided.

greptile-apps · 2026-02-11T08:51:41Z

Greptile Overview

Greptile Summary

This PR introduces a new PluginContext system that provides isolated security contexts and permission management for plugins. The implementation adds a Cordova plugin that generates unique tokens for each plugin and tracks their permissions through a native Android bridge.

Key changes:

New pluginContext Cordova plugin with token-based authentication system
loadPlugin.js now generates a context object (ctx) passed to each plugin during initialization
Replaced @com.foxdebug.acode.rk.auth plugin with the new pluginContext plugin in cordova.plugins list
Token/permission stores changed from static to instance fields, addressing previous lifecycle concerns

Issues found:

plugin.xml contains mismatched plugin name "Gatekeeper" (should be "PluginContext")
package-lock.json has extraneous src/plugins/gatekeeper entry that needs removal
disclosed HashSet blocks plugin reload attempts with TOKEN_ALREADY_ISSUED error
Auth plugin removed from cordova.plugins but remains in devDependencies
Minor: error not logged in catch block, typo in comment

Confidence Score: 2/5

This PR has critical issues preventing plugin reloads and metadata inconsistencies that need resolution
The plugin name mismatch in plugin.xml and the disclosed set blocking reload scenarios are functional issues that will cause runtime failures. The extraneous lockfile entry and auth plugin removal create dependency inconsistencies. While the core token/permission architecture is sound and the JSON stringification fix is correct, these blocking issues need to be addressed before merge.
Pay close attention to src/plugins/pluginContext/plugin.xml (wrong name), src/plugins/pluginContext/src/android/Tee.java (reload blocking), and package-lock.json (extraneous entry)

Important Files Changed

Filename	Overview
package.json	Replaced auth plugin with plugincontext in cordova.plugins, devDeps updated correctly
package-lock.json	Contains extraneous `src/plugins/gatekeeper` entry that should not exist
src/lib/loadPlugin.js	Adds PluginContext.generate call passing stringified pluginJson correctly to ctx field
src/plugins/pluginContext/plugin.xml	Plugin XML has mismatched name 'Gatekeeper' instead of 'PluginContext'
src/plugins/pluginContext/src/android/Tee.java	Token/permission management implemented, static fields removed but stores still never cleared

Sequence Diagram

sequenceDiagram
    participant LP as loadPlugin.js
    participant PC as PluginContext.js
    participant Tee as Tee.java
    participant Plugin as Plugin Instance
    
    LP->>LP: Read plugin.json
    LP->>PC: generate(pluginId, JSON.stringify(pluginJson))
    PC->>Tee: requestToken(pluginId, pluginJson)
    
    alt Plugin Already Disclosed
        Tee-->>PC: Error: TOKEN_ALREADY_ISSUED
        PC-->>LP: return null
    else First Request
        Tee->>Tee: Generate UUID token
        Tee->>Tee: Parse permissions from pluginJson
        Tee->>Tee: Store token & permissions
        Tee->>Tee: Mark pluginId as disclosed
        Tee-->>PC: Return token (UUID)
        PC->>PC: Create _PluginContext(uuid)
        PC-->>LP: Return frozen context object
    end
    
    LP->>Plugin: initPlugin(pluginId, baseUrl, $page, {ctx, ...})
    
    Note over Plugin,Tee: Plugin can later check permissions
    Plugin->>PC: ctx.grantedPermission("permission-name")
    PC->>Tee: grantedPermission(token, permission)
    Tee->>Tee: Check permissionStore[token]
    Tee-->>PC: true/false
    PC-->>Plugin: Permission result

_{Last reviewed commit: 82d3271}

greptile-apps

_{8 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-11T08:51:48Z

src/plugins/pluginContext/www/PluginContext.js

+    generate: async function (pluginId, pluginJson) {
+      try {
+        function requestToken(pluginId) {
+          return new Promise((resolve, reject) => {
+            exec(resolve, reject, "Tee", "requestToken", [
+              pluginId,
+              pluginJson,
+            ]);
+          });


Native expects string JSON

On Android, Tee.java reads args.getString(1) and then new JSONObject(pluginJson), so the second argument must be a JSON string. Here pluginJson is passed directly (it’s an object in loadPlugin.js), which will arrive natively as a non-JSON value and trigger INVALID_PLUGIN_JSON, causing generate() to return null.

Suggested change

generate: async function (pluginId, pluginJson) {

try {

function requestToken(pluginId) {

return new Promise((resolve, reject) => {

exec(resolve, reject, "Tee", "requestToken", [

pluginId,

pluginJson,

]);

});

exec(resolve, reject, "Tee", "requestToken", [

pluginId,

JSON.stringify(pluginJson),

]);

greptile-apps · 2026-02-11T08:51:49Z

src/plugins/pluginContext/plugin.xml

+<plugin xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android" id="com.foxdebug.acode.rk.plugin.plugincontext" version="1.0.0">
+    <name>Gatekeeper</name>
+
+
+        <js-module name="PluginContext" src="www/PluginContext.js">
+        <clobbers target="window.PluginContext" />
+    </js-module>


Plugin metadata mismatch

This plugin is plugincontext but the <name> is set to Gatekeeper, which will surface as the wrong plugin name in Cordova tooling/plugins list. This looks like a copy/paste error and should be renamed to match the actual plugin.

Suggested change

<plugin xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android" id="com.foxdebug.acode.rk.plugin.plugincontext" version="1.0.0">

<name>Gatekeeper</name>

<js-module name="PluginContext" src="www/PluginContext.js">

<clobbers target="window.PluginContext" />

</js-module>

<name>PluginContext</name>

greptile-apps · 2026-02-11T08:51:50Z

package-lock.json

+    "src/plugins/gatekeeper": {
+      "name": "com.foxdebug.acode.rk.plugin.gatekeeper",
+      "version": "1.0.0",
+      "extraneous": true,
+      "license": "MIT"
+    },


Unrelated extraneous lockfile entry

This PR introduces an extraneous entry for src/plugins/gatekeeper, but there’s no corresponding dependency/plugin added in package.json. This will make installs non-reproducible across environments and should be removed from the lockfile (regenerate package-lock.json from a clean install) so only intentional dependencies are recorded.

greptile-apps · 2026-02-11T08:51:52Z

Additional Comments (1)

src/lib/loadPlugin.js
Undefined PluginContext

PluginContext.generate(...) is referenced here but PluginContext isn’t imported/defined in this module, so loading any plugin will throw ReferenceError: PluginContext is not defined at runtime. If this is intended to come from the Cordova clobber (window.PluginContext), it still needs to be referenced as window.PluginContext (and ideally gated until deviceready / plugin availability).

RohitKushvaha01 · 2026-02-11T15:53:37Z

@greptileai

greptile-apps

_{8 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-11T15:58:57Z

package.json

      "com.foxdebug.acode.rk.exec.proot": {},
      "com.foxdebug.acode.rk.exec.terminal": {},
      "com.foxdebug.acode.rk.customtabs": {},
-      "com.foxdebug.acode.rk.auth": {}
+      "com.foxdebug.acode.rk.plugin.plugincontext": {}


Plugin list inconsistency

cordova.plugins dropped the auth plugin entry while devDependencies still includes the local auth package. This makes the Cordova plugin list inconsistent with what gets installed, and can remove auth functionality unexpectedly. If auth is still required, add it back under cordova.plugins; otherwise remove the local auth dependency and update any consumers accordingly.

greptile-apps · 2026-02-11T15:58:58Z

src/plugins/pluginContext/src/android/Tee.java

+    private static final Map<String, String> tokenStore = new HashMap<>();
+    private static final HashSet<String> disclosed = new HashSet<>();
+    private static final Map<String, List<String>> permissionStore = new HashMap<>();
+


Global static stores leak

tokenStore, disclosed, and permissionStore are static and never cleared. In a Cordova WebView, plugins can be installed/uninstalled or reloaded without a full process restart; these maps will retain old pluginIds/tokens/permissions and can cause TOKEN_ALREADY_ISSUED or stale permission results for later sessions. Consider scoping these stores to the plugin instance/lifecycle or providing a reset path tied to app/plugin reload.

RohitKushvaha01 · 2026-02-13T09:31:51Z

@greptileai

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-13T09:35:14Z

src/plugins/pluginContext/www/PluginContext.js

+        const uuid = await requestToken(pluginId);
+        return new _PluginContext(uuid);
+      } catch (err) {
+        console.warn(`PluginContext creation failed for pluginId ${pluginId}:`);


error object not logged in warning message

Suggested change

console.warn(`PluginContext creation failed for pluginId ${pluginId}:`);

console.warn(`PluginContext creation failed for pluginId ${pluginId}:`, err);

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

greptile-apps · 2026-02-13T09:35:15Z

src/plugins/pluginContext/src/android/Tee.java

+    // pluginId : token
+    private /*static*/ final Map<String, String> tokenStore = new HashMap<>();
+
+    //assined tokens


typo: 'assined' should be 'assigned'

Suggested change

//assined tokens

//assigned tokens

greptile-apps · 2026-02-13T09:35:16Z

src/plugins/pluginContext/src/android/Tee.java

+        if (disclosed.contains(pluginId)) {
+            callback.error("TOKEN_ALREADY_ISSUED");
+            return;
+        }


disclosed set never cleared, blocks plugin reload

The disclosed set prevents the same pluginId from requesting a token twice in this plugin instance's lifetime. If loadPlugin() is called again for the same plugin (reload scenario), this check will fail with TOKEN_ALREADY_ISSUED even though it's a legitimate reload request.

RohitKushvaha01 added 3 commits February 11, 2026 14:09

feat: pluginContext

c183fd8

Merge branch 'Acode-Foundation:main' into main

4588b20

format

86e8103

RohitKushvaha01 marked this pull request as draft February 11, 2026 08:46

greptile-apps bot reviewed Feb 11, 2026

View reviewed changes

fix: issues

7b724e5

greptile-apps bot reviewed Feb 11, 2026

View reviewed changes

feat

82d3271

RohitKushvaha01 self-assigned this Feb 13, 2026

RohitKushvaha01 added the plugin api It represents, plugins specific apis enhancement label Feb 13, 2026

greptile-apps bot reviewed Feb 13, 2026

View reviewed changes

	console.warn(`PluginContext creation failed for pluginId ${pluginId}:`);
	console.warn(`PluginContext creation failed for pluginId ${pluginId}:`, err);

Conversation

RohitKushvaha01 commented Feb 11, 2026

Uh oh!

greptile-apps bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 2/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Feb 11, 2026

Uh oh!

RohitKushvaha01 commented Feb 11, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

RohitKushvaha01 commented Feb 13, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

greptile-apps bot commented Feb 11, 2026 •

edited

Loading