fix: harden plugin infrastructure — safety and validation

app/src/components/card-container.tsx

@@ -302,18 +302,33 @@ export function CardContainer({
         />
       );
     }
-    const mappedData = (
-      chartConfig.transformWithMapping ?? chartConfig.transform
-    )(previewData, columnMapping);
+    let mappedData: unknown;
+    try {
+      mappedData = (chartConfig.transformWithMapping ?? chartConfig.transform)(
+        previewData,
+        columnMapping,
+      );
+    } catch (err) {
+      console.error(
+        "Chart transform failed for " + widget.chartType + ":",
+        err,
+      );
+      mappedData = previewData;
+    }
     // Skip transforms for graph charts — their data shape is incompatible with tabular transforms
-    const transformedData =
-      dataTransforms.length && widget.chartType !== "graph"
-        ? applyTransforms(
-            mappedData as Record<string, unknown>[],
-            dataTransforms,
-            allParamValues,
-          )
-        : mappedData;
+    let transformedData: unknown = mappedData;
+    if (dataTransforms.length && widget.chartType !== "graph") {
+      try {
+        transformedData = applyTransforms(
+          mappedData as Record<string, unknown>[],
+          dataTransforms,
+          allParamValues,
+        );
+      } catch (err) {
+        console.error("Data transform failed:", err);
+        transformedData = mappedData;
+      }
+    }
     const availableColumns = extractColumnNames(previewData);
     return (
       <div className="h-full w-full flex flex-col">
@@ -586,16 +601,29 @@ export function CardContainer({
     );
   }
 
-  const mappedData = (
-    chartConfig.transformWithMapping ?? chartConfig.transform
-  )(rawData, columnMapping);
-  const transformedData = dataTransforms.length
-    ? applyTransforms(
+  let mappedData: unknown;
+  try {
+    mappedData = (chartConfig.transformWithMapping ?? chartConfig.transform)(
+      rawData,
+      columnMapping,
+    );
+  } catch (err) {
+    console.error("Chart transform failed for " + widget.chartType + ":", err);
+    mappedData = rawData;
+  }
+  let transformedData: unknown = mappedData;
+  if (dataTransforms.length) {
+    try {
+      transformedData = applyTransforms(
         mappedData as Record<string, unknown>[],
         dataTransforms,
         allParamValues,
-      )
-    : mappedData;
+      );
+    } catch (err) {
+      console.error("Data transform failed:", err);
+      transformedData = mappedData;
+    }
+  }
   const availableColumns = extractColumnNames(rawData);
 
   return (

app/src/lib/plugin/chart-plugin-registry.ts

@@ -131,8 +131,8 @@
   requiresQuery: true,
 };
 
 export function defineChartPlugin(config: ChartPluginConfig): ChartPlugin {
-  // Validation
+  // ── Validation ──────────────────────────────────────────────────────
   if (!config.type || config.type.trim() === "") {
     throw new Error("Chart plugin: type is required and cannot be empty");
   }
@@ -143,6 +143,30 @@
     throw new Error("Chart plugin: transform must be a function");
   }
 
+  // Validate options shape if provided
+  if (config.options) {
+    for (const opt of config.options) {
+      if (!opt.key || !opt.label || !opt.type) {
+        console.warn(
+          'Chart plugin "' + config.type + '": option missing key/label/type:',
+          opt,
+        );
+      }
+    }
+  }
+
+  // Validate compatibleWith entries
+  if (config.compatibleWith) {
+    for (const ct of config.compatibleWith) {
+      if (typeof ct !== "string" || ct.trim() === "") {
+        console.warn(
+          'Chart plugin "' + config.type + '": invalid compatibleWith entry:',
+          ct,
+        );
+      }
+    }
+  }
+
   // supportsStyling defaults to true if stylingTargets is provided, false otherwise
   const stylingFromTargets =
     config.stylingTargets && config.stylingTargets.length > 0;

app/src/plugins/index.ts

@@ -73,16 +73,35 @@ for (const plugin of BUILT_IN_PLUGINS) {
 // Same-type duplicates without overrides throw loudly so operators spot
 // the conflict at startup instead of debugging a silent replacement.
 for (const { plugin, overrides } of EXTERNAL_PLUGINS) {
-  if (pluginRegistry.has(plugin.type)) {
-    if (!overrides) {
-      throw new Error(
-        `External plugin "${plugin.type}" conflicts with an existing plugin. ` +
-          `Set "overrides": true in neoboard-plugins.json to replace the built-in.`,
+  try {
+    if (!plugin || typeof plugin !== "object" || !plugin.type) {
+      console.error(
+        "External plugin skipped: invalid plugin object (missing type)",
       );
+      continue;
     }
-    pluginRegistry.unregister(plugin.type);
+    if (pluginRegistry.has(plugin.type)) {
+      if (!overrides) {
+        console.error(
+          'External plugin "' +
+            plugin.type +
+            '" conflicts with an existing plugin. ' +
+            'Set "overrides": true in neoboard-plugins.json to replace it. Skipping.',
+        );
+        continue;
+      }
+      pluginRegistry.unregister(plugin.type);
+    }
+    pluginRegistry.register(plugin);
+  } catch (err) {
+    console.error(
+      "External plugin registration failed for type " +
+        JSON.stringify(plugin?.type) +
+        ":",
+      err,
+    );
+    // Continue loading remaining plugins — one broken plugin shouldn't crash the app
   }
-  pluginRegistry.register(plugin);
 }
 
 // ── Startup validation ──────────────────────────────────────────────────

cli/src/lib/manifest.ts

@@ -1,8 +1,18 @@
 /**
  * Read/write helpers for neoboard-plugins.json and neoboard-connectors.json.
+ *
+ * Writes use atomic temp-file + rename to prevent corruption from
+ * concurrent processes or crashes mid-write.
  */
 
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  existsSync,
+  unlinkSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
 
 export interface ManifestEntry {
   package: string;
@@ -13,7 +23,31 @@ export interface ManifestEntry {
 type ManifestKey = "plugins" | "connectors";
 
 /**
- * Read entries from a manifest file. Returns empty array if file missing.
+ * Atomically write JSON to a file: write to temp file, then rename.
+ * Rename is atomic on POSIX and near-atomic on Windows.
+ */
+function atomicWriteJson(filePath: string, data: unknown): void {
+  const tmpPath = join(
+    dirname(filePath),
+    ".tmp-" + Date.now() + "-" + Math.random().toString(36).slice(2),
+  );
+  try {
+    writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n");
+    renameSync(tmpPath, filePath);
+  } catch (err) {
+    // Clean up temp file on failure
+    try {
+      unlinkSync(tmpPath);
+    } catch {
+      // ignore cleanup errors
+    }
+    throw err;
+  }
+}
+
+/**
+ * Read entries from a manifest file. Returns empty array if file missing
+ * or corrupted (with a warning for corruption).
  */
 export function readManifest(
   filePath: string,
@@ -23,7 +57,8 @@ export function readManifest(
   try {
     const raw = JSON.parse(readFileSync(filePath, "utf-8"));
     return Array.isArray(raw[key]) ? raw[key] : [];
-  } catch {
+  } catch (err) {
+    console.warn("Failed to parse manifest " + filePath + ":", err);
     return [];
   }
 }
@@ -42,7 +77,7 @@ export function addToManifest(
     return false; // already exists
   }
   entries.push(entry);
-  writeFileSync(filePath, JSON.stringify({ [key]: entries }, null, 2) + "\n");
+  atomicWriteJson(filePath, { [key]: entries });
   return true;
 }
 
@@ -59,6 +94,6 @@ export function removeFromManifest(
   const entries = readManifest(filePath, key);
   const filtered = entries.filter((e) => e.package !== packageName);
   if (filtered.length === entries.length) return false; // not found
-  writeFileSync(filePath, JSON.stringify({ [key]: filtered }, null, 2) + "\n");
+  atomicWriteJson(filePath, { [key]: filtered });
   return true;
 }

scripts/generate-connector-imports.mjs

@@ -217,6 +217,26 @@ export function runGenerator(opts = {}) {
     return { ok: false, errors, wrote: false };
   }
 
+  // Verify that all referenced packages are actually installed
+  for (const entry of entries) {
+    try {
+      import.meta.resolve?.(entry.package);
+    } catch {
+      try {
+        const { createRequire } = await import("node:module");
+        const require = createRequire(manifestPath);
+        require.resolve(entry.package);
+      } catch {
+        errors.push(
+          `Package "${entry.package}" is not installed. Run: npm install ${entry.package}`,
+        );
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { ok: false, errors, wrote: false };
+  }
+
   const source = renderSource(entries);
 
   const existing = existsSync(outputPath)

scripts/generate-plugin-imports.mjs

@@ -217,6 +217,27 @@ export function runGenerator(opts = {}) {
     return { ok: false, errors, wrote: false };
   }
 
+  // Verify that all referenced packages are actually installed
+  for (const entry of entries) {
+    try {
+      import.meta.resolve?.(entry.package);
+    } catch {
+      // Fallback: try require.resolve via createRequire
+      try {
+        const { createRequire } = await import("node:module");
+        const require = createRequire(manifestPath);
+        require.resolve(entry.package);
+      } catch {
+        errors.push(
+          `Package "${entry.package}" is not installed. Run: npm install ${entry.package}`,
+        );
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { ok: false, errors, wrote: false };
+  }
+
   const source = renderSource(entries);
 
   // Idempotent write — skip if content matches (preserves mtime for