Guide build-plugin on pre-request auth scripts by andrewmumblebee · Pull Request #93 · squaredup/plugins

andrewmumblebee · 2026-07-16T07:06:18Z

📋 Summary

Adds guidance to the build-plugin skill for the new preRequestScript capability arriving with WebAPI base plugin 1.8.0 (squaredup/squaredup-plugin-repository#1966, SAAS-8337) and its saas-side deploy support, so an agent building a plugin for an API with a custom auth flow (token exchange, per-request HMAC signing) has a supported path.

New "Pre-request scripts (custom auth flows)" reference section in references/metadata.md, co-located with the auth patterns: when to reach for a script (prefer built-in authModes first), wiring via scriptingVariables and the dataStreams/scripts/preRequest/<plugin>.js file reference, the reserved scriptState property, the script's variable scope, and a token-exchange example with state-cached expiry drawn from the real N-Able script in the upstream PR.
Context pointers only elsewhere (single source of truth): Phase 1's auth step in SKILL.md, the scaffold file tree, and the post-request-scripts section of references/data-streams.md.
Skill version bumped to 0.0.12.

Note: end-to-end this depends on both upstream PRs shipping — WebAPI 1.8.0 and the saas file-reference inlining.

🔍 Scope of change

Documentation only
Repository metadata or configuration
CI / automation
Other (please describe):

📚 Checklist

I agree to the Code of Conduct

🤖 Generated with Claude Code

Summary by CodeRabbit

Documentation
- Added guidance for configuring pre-request scripts to support custom authentication flows.
- Documented script inputs, outputs, allowed request modifications, encrypted state persistence, available runtime objects, and scripting variables.
- Included an end-to-end token exchange example with cached token handling.
- Clarified that datasource-level scripts run before every request.
- Updated the documented build-plugin version and scaffold guidance to include optional authentication scripting.

coderabbitai · 2026-07-16T07:06:24Z

📝 Walkthrough

Walkthrough

The build-plugin documentation now describes custom authentication pre-request scripts, their configuration and runtime behavior, execution timing, token caching, and optional scaffolding. The skill version and authentication planning guidance were updated.

Changes

Custom authentication documentation

Layer / File(s)	Summary
Pre-request script reference `.claude/skills/build-plugin/references/metadata.md`, `.claude/skills/build-plugin/references/data-streams.md`	Documents pre-request script configuration, `scriptingVariables`, encrypted `scriptState`, runtime objects, mutable request fields, error reporting, token caching, and execution before each request.
Build-plugin workflow guidance `.claude/skills/build-plugin/SKILL.md`	Updates the documented skill version to `1.0.0`, adds pre-request planning guidance for custom authentication, and documents an optional root-level `preRequest.js` file in the scaffold.】【。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding pre-request authentication guidance to the build-plugin skill.
Description check	✅ Passed	The description explains the documentation changes, scope, dependencies, and checklist, and is sufficiently complete for a documentation-only change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/skills/build-plugin/references/metadata.md:
- Around line 245-251: Add timeout or cancellation handling to the auth fetch in
the pre-request hook, using an AbortSignal or the platform’s documented fetch
timeout mechanism. Ensure hung auth requests terminate within a defined limit so
plugin streams and imports cannot stall indefinitely.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1f6180fa-4098-414a-b307-ea301e879c1c

📥 Commits

Reviewing files that changed from the base of the PR and between 9dafcf7 and e9ed698.

📒 Files selected for processing (3)

.claude/skills/build-plugin/SKILL.md
.claude/skills/build-plugin/references/data-streams.md
.claude/skills/build-plugin/references/metadata.md

clarkd

Looks spot on - thanks for picking up this chunk of work from Wayne!

clarkd · 2026-07-31T08:44:36Z

@andrewmumblebee I think this might need updating to place prerequest.js at the root?

WebAPI base plugin 1.8.0 (squaredup-plugin-repository PR #1966, SAAS-8337) adds datasource-level pre-request scripting so plugins can handle custom auth flows no authMode expresses — token-exchange steps and per-request HMAC signing. The matching saas change lets a declarative plugin's base.config reference the script as a file under dataStreams/scripts/preRequest/, inlined at deploy time. The build-plugin skill had no coverage of this, so an agent building a plugin for such an API had no supported path. Add a reference section beside the auth patterns in metadata.md covering when to reach for a script (and to prefer built-in authModes first), the wiring including scriptingVariables and the reserved scriptState property, the script's variable scope, and a token-exchange example with state-cached expiry drawn from the PR's real N-Able script. Phase 1's auth step and the post-request-scripts section point at it, keeping the full material in one place per the skill-writing guidance. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-07T09:52:57Z

🧩 Plugin PR Summary

ℹ️ No plugins were modified in this PR.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/skills/build-plugin/references/metadata.md:
- Around line 252-257: Update the failed-response branch in the token exchange
flow to throw the same error message immediately after api.report.error, making
the failure terminal and preventing resp.json() and subsequent token access from
running. Keep the existing success path unchanged.

In @.claude/skills/build-plugin/SKILL.md:
- Line 6: Update the skill metadata version from 1.0.0 back to the intended
0.0.12. Only retain 1.0.0 if the corresponding release metadata and PR objective
are explicitly updated to reflect a major-version release.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: b75a7243-2e81-4283-afba-b1817ed30616

📥 Commits

Reviewing files that changed from the base of the PR and between e9ed698 and 791a5dd.

📒 Files selected for processing (3)

.claude/skills/build-plugin/SKILL.md
.claude/skills/build-plugin/references/data-streams.md
.claude/skills/build-plugin/references/metadata.md

andrewmumblebee marked this pull request as ready for review July 16, 2026 07:27

andrewmumblebee requested a review from a team July 16, 2026 07:27

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread .claude/skills/build-plugin/references/metadata.md

andrewmumblebee requested a review from clarkd July 21, 2026 06:56

clarkd approved these changes Jul 21, 2026

View reviewed changes

andrewmumblebee and others added 3 commits August 7, 2026 10:45

remove version reference

0ab10c2

update preRequest file location

791a5dd

andrewmumblebee force-pushed the work/ah/build-plugin-pre-request-script branch from e9ed698 to 791a5dd Compare August 7, 2026 09:52

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread .claude/skills/build-plugin/references/metadata.md

Comment thread .claude/skills/build-plugin/SKILL.md

clarkd approved these changes Aug 7, 2026

View reviewed changes

clarkd merged commit b99d31f into main Aug 7, 2026
1 check passed

clarkd deleted the work/ah/build-plugin-pre-request-script branch August 7, 2026 10:30

Navigation Menu

Uh oh!

Guide build-plugin on pre-request auth scripts - #93

Guide build-plugin on pre-request auth scripts#93
clarkd merged 3 commits into
mainfrom
work/ah/build-plugin-pre-request-script

andrewmumblebee commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

clarkd left a comment

Uh oh!

clarkd commented Jul 31, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

andrewmumblebee commented Jul 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📋 Summary

🔍 Scope of change

📚 Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

clarkd left a comment

Choose a reason for hiding this comment

Uh oh!

clarkd commented Jul 31, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

🧩 Plugin PR Summary

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

andrewmumblebee commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading