address review comments

mareklibra · mareklibra · commit 727c4deb6b7d · 2026-06-30T15:09:31.000+02:00
diff --git a/workspaces/boost/.changeset/neat-boxes-fry.md b/workspaces/boost/.changeset/neat-boxes-fry.md
@@ -1,5 +1,12 @@
 ---
 '@red-hat-developer-hub/backstage-plugin-boost': patch
+'@red-hat-developer-hub/backstage-plugin-boost-backend': patch
+'@red-hat-developer-hub/backstage-plugin-boost-backend-module-kagenti': patch
+'@red-hat-developer-hub/backstage-plugin-boost-backend-module-llamastack': patch
+'@red-hat-developer-hub/backstage-plugin-boost-common': patch
+'@red-hat-developer-hub/backstage-plugin-boost-node': patch
+'@red-hat-developer-hub/backstage-plugin-boost-responses-api-toolkit': patch
+'@red-hat-developer-hub/backstage-plugin-boost-toolscope': patch
 ---
 
-Add the Boost New Frontend System plugin with a lazy-loaded `/ai-catalog` route and AI Catalog scaffold page for local development.
+Add the Boost New Frontend System plugin with a lazy-loaded `/ai-catalog` route and AI Catalog scaffold page for local development. Register the frontend plugin in boost plugin family metadata (`pluginPackages`).
diff --git a/workspaces/boost/app-config.yaml b/workspaces/boost/app-config.yaml
@@ -17,7 +17,8 @@ organization:
 backend:
   # Used for enabling authentication, secret is shared by all backend plugins
   # See https://backstage.io/docs/auth/service-to-service-auth for
-  # information on the format
+  # information on the format.
+  # Enable backend.auth.keys before any non-local deployment.
   # auth:
   #   keys:
   #     - secret: ${BACKEND_SECRET}
@@ -79,6 +80,8 @@ techdocs:
 
 auth:
   # see https://backstage.io/docs/auth/ to learn about auth providers
+  # Local dev only: guest provider with auto sign-in (see packages/app sign-in module).
+  # Do not use this configuration in production deployments.
   environment: development
   providers:
     # See https://backstage.io/docs/auth/guest/provider
diff --git a/workspaces/boost/openspec/changes/ai-chat-interaction-experience/proposal.md b/workspaces/boost/openspec/changes/ai-chat-interaction-experience/proposal.md
@@ -44,7 +44,7 @@ Boost builds the frontend as composable extensions from the start — chat, admi
 
 ## Impact
 
-- `plugins/boost-frontend/src/plugin.ts` — composable routable extensions
-- `plugins/boost-frontend/src/components/ChatView.tsx` — lazy loading, capability checks
-- `plugins/boost-frontend/src/components/AdminLayout.tsx` — lazy loading per panel group
+- `plugins/boost/src/plugin.ts` — composable routable extensions
+- `plugins/boost/src/components/ChatView.tsx` — lazy loading, capability checks
+- `plugins/boost/src/components/AdminLayout.tsx` — lazy loading per panel group
 - `plugins/boost-common/src/config.d.ts` — feature flags schema
diff --git a/workspaces/boost/openspec/changes/platform-operations-deployment/proposal.md b/workspaces/boost/openspec/changes/platform-operations-deployment/proposal.md
@@ -14,9 +14,11 @@ Boost ships as a set of modular RHDH dynamic plugins (OCI) and Backstage static
 
 | Package                           | Purpose                                                           |
 | --------------------------------- | ----------------------------------------------------------------- |
-| `boost-frontend`                  | Chat UI, agent gallery, admin panels, composable extensions       |
+| `boost`                           | Chat UI, agent gallery, admin panels, composable extensions       |
 | `boost-common`                    | Shared types, permissions (browser-safe, `common-library` role)   |
 | `boost-node`                      | Service refs, extension points (`node-library` role)              |
+| `boost-responses-api-toolkit`     | Shared Responses API utilities (`node-library` role)              |
+| `boost-toolscope`                 | Injectable cache adapter for tool scope (`node-library` role)     |
 | `boost-backend`                   | Core routes, services, middleware, cross-cutting entity providers |
 | `boost-backend-module-llamastack` | Llama Stack agentic provider                                      |
 | `boost-backend-module-kagenti`    | Kagenti agentic provider                                          |
@@ -72,4 +74,4 @@ These principles are informed by the Augment reference prototype's experience (s
 - `plugins/boost-backend/src/services/` — RuntimeConfigResolver, config validation, cache management
 - `plugins/boost-backend/src/routes/` — admin panel API routes
 - `plugins/boost-common/src/config.d.ts` — generated from Zod schemas
-- `plugins/boost-frontend/src/admin/` — admin panel components, feature flag integration
+- `plugins/boost/src/admin/` — admin panel components, feature flag integration
diff --git a/workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/design.md b/workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/design.md
@@ -54,7 +54,7 @@ boost-common (common-library)  ←──  boost-node (node-library)  ←──
      │                                   boost-backend-module-llamastack
      │                                   boost-backend-module-kagenti
      ↓
-boost-frontend (imports types only)
+boost (imports types only)
 ```
 
 `boost-common` exports: `AgenticProvider`, `ProviderDescriptor`, `ProviderCapabilities`, `NormalizedStreamEvent`, conversation types, permission definitions.
diff --git a/workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/proposal.md b/workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/proposal.md
@@ -51,4 +51,4 @@ Two built-in provider modules, each as an independent `createBackendModule`:
 - `plugins/boost-backend/src/plugin.ts` — serviceRef factory registration, ProviderManager
 - `plugins/boost-backend-module-llamastack/` — Llama Stack provider module
 - `plugins/boost-backend-module-kagenti/` — Kagenti provider module
-- `plugins/boost-frontend/src/` — capability-based rendering throughout
+- `plugins/boost/src/` — capability-based rendering throughout
diff --git a/workspaces/boost/openspec/changes/security-safety-governance/proposal.md b/workspaces/boost/openspec/changes/security-safety-governance/proposal.md
@@ -44,5 +44,5 @@ Enterprise AI platforms must treat security, safety, and governance as foundatio
 
 - `plugins/boost-common/src/permissions.ts` — 16 permission definitions with resource types
 - `plugins/boost-backend/src/middleware/security.ts` — `authorizeLifecycleAction` middleware
-- `plugins/boost-frontend/src/components/SecurityGate.tsx` — granular permission checks
+- `plugins/boost/src/components/SecurityGate.tsx` — granular permission checks
 - `plugins/boost-backend/src/services/TokenExchangeManager.ts` — RFC 8693 implementation
diff --git a/workspaces/boost/package.json b/workspaces/boost/package.json
@@ -10,7 +10,7 @@
     "start": "backstage-cli repo start",
     "start:debug": "backstage-cli repo start --inspect",
     "build:all": "backstage-cli repo build --all",
-    "build:api-reports": "yarn tsc:full; yarn build:api-reports:only",
+    "build:api-reports": "yarn tsc:full && yarn build:api-reports:only",
     "build:api-reports:only": "backstage-repo-tools api-reports -o ae-wrong-input-file-type,ae-undocumented --validate-release-tags",
     "build:knip-reports": "backstage-repo-tools knip-reports",
     "tsc": "tsc",
diff --git a/workspaces/boost/packages/backend/Dockerfile b/workspaces/boost/packages/backend/Dockerfile
@@ -1,6 +1,10 @@
 # This dockerfile builds an image for the backend package.
 # It should be executed with the root of the repo as docker context.
 #
+# WARNING: This image bundles the workspace dev app-config.yaml (guest auth,
+# allow-all permissions, in-memory database). It is not production-ready
+# without supplying production app-config overrides.
+#
 # Before building this image, be sure to have run the following commands in the repo root:
 #
 # yarn install --immutable
@@ -17,19 +21,11 @@ FROM node:24-trixie-slim
 # Set Python interpreter for `node-gyp` to use
 ENV PYTHON=/usr/bin/python3
 
-# Install isolate-vm dependencies, these are needed by the @backstage/plugin-scaffolder-backend.
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && \
-    apt-get install -y --no-install-recommends python3 g++ build-essential && \
-    rm -rf /var/lib/apt/lists/*
-
-# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
-# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
+# Install isolate-vm and sqlite3 dependencies (needed by scaffolder and better-sqlite3).
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && \
-    apt-get install -y --no-install-recommends libsqlite3-dev && \
+    apt-get install -y --no-install-recommends python3 g++ build-essential libsqlite3-dev && \
     rm -rf /var/lib/apt/lists/*
 
 # From here on we use the least-privileged `node` user to run the backend.
diff --git a/workspaces/boost/packages/backend/src/index.ts b/workspaces/boost/packages/backend/src/index.ts
@@ -49,7 +49,8 @@ backend.add(import('@backstage/plugin-catalog-backend-module-logs'));
 
 // permission plugin
 backend.add(import('@backstage/plugin-permission-backend'));
-// See https://backstage.io/docs/permissions/getting-started for how to create your own permission policy
+// Local dev only: allow-all-policy grants every permission to every caller.
+// Production deployments must register a real permission policy instead.
 backend.add(
   import('@backstage/plugin-permission-backend-module-allow-all-policy'),
 );
diff --git a/workspaces/boost/plugins/boost-backend-module-kagenti/package.json b/workspaces/boost/plugins/boost-backend-module-kagenti/package.json
@@ -13,6 +13,7 @@
     "pluginId": "boost",
     "pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost-backend",
     "pluginPackages": [
+      "@red-hat-developer-hub/backstage-plugin-boost",
       "@red-hat-developer-hub/backstage-plugin-boost-backend",
       "@red-hat-developer-hub/backstage-plugin-boost-backend-module-kagenti",
       "@red-hat-developer-hub/backstage-plugin-boost-common",
diff --git a/workspaces/boost/plugins/boost-backend-module-llamastack/package.json b/workspaces/boost/plugins/boost-backend-module-llamastack/package.json
@@ -13,6 +13,7 @@
     "pluginId": "boost",
     "pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost-backend",
     "pluginPackages": [
+      "@red-hat-developer-hub/backstage-plugin-boost",
       "@red-hat-developer-hub/backstage-plugin-boost-backend",
       "@red-hat-developer-hub/backstage-plugin-boost-backend-module-llamastack",
       "@red-hat-developer-hub/backstage-plugin-boost-common",
diff --git a/workspaces/boost/plugins/boost/dev/index.tsx b/workspaces/boost/plugins/boost/dev/index.tsx
@@ -20,10 +20,10 @@ import plugin from '../src';
 const defaultPage = '/ai-catalog';
 
 if (
-  typeof global.window !== 'undefined' &&
-  global.window.location.pathname === '/'
+  globalThis.window !== undefined &&
+  globalThis.window.location.pathname === '/'
 ) {
-  global.window.location.pathname = defaultPage;
+  globalThis.window.location.pathname = defaultPage;
 }
 
 createDevApp({ features: [plugin] });
diff --git a/workspaces/boost/plugins/boost/package.json b/workspaces/boost/plugins/boost/package.json
@@ -17,6 +17,7 @@
   "backstage": {
     "role": "frontend-plugin",
     "pluginId": "boost",
+    "pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost",
     "supported-versions": "1.52.0",
     "pluginPackages": [
       "@red-hat-developer-hub/backstage-plugin-boost",
diff --git a/workspaces/boost/plugins/boost/src/components/AiCatalogIcon.tsx b/workspaces/boost/plugins/boost/src/components/AiCatalogIcon.tsx
@@ -14,5 +14,8 @@
  * limitations under the License.
  */
 import StorefrontIcon from '@mui/icons-material/Storefront';
+import type { SvgIconProps } from '@mui/material/SvgIcon';
 
-export const AiCatalogIcon = () => <StorefrontIcon />;
+export const AiCatalogIcon = (props: SvgIconProps) => (
+  <StorefrontIcon {...props} />
+);
diff --git a/workspaces/boost/plugins/boost/src/plugin.test.ts b/workspaces/boost/plugins/boost/src/plugin.test.ts
@@ -13,10 +13,20 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { boostPlugin } from './plugin';
+import { coreExtensionData } from '@backstage/frontend-plugin-api';
+import { createExtensionTester } from '@backstage/frontend-test-utils';
+
+import { boostPage, boostPlugin } from './plugin';
 
 describe('boost', () => {
   it('should export plugin', () => {
     expect(boostPlugin).toBeDefined();
   });
+
+  it('should define ai catalog page at /ai-catalog', () => {
+    const tester = createExtensionTester(boostPage);
+
+    expect(tester.get(coreExtensionData.routePath)).toBe('/ai-catalog');
+    expect(tester.get(coreExtensionData.title)).toBe('AI Catalog');
+  });
 });
diff --git a/workspaces/boost/plugins/boost/src/plugin.tsx b/workspaces/boost/plugins/boost/src/plugin.tsx
@@ -21,7 +21,7 @@ import {
 import { rootRouteRef } from './routes';
 import { AiCatalogIcon } from './components/AiCatalogIcon';
 
-export const page = PageBlueprint.make({
+export const boostPage = PageBlueprint.make({
   params: {
     path: '/ai-catalog',
     routeRef: rootRouteRef,
@@ -39,7 +39,7 @@ export const page = PageBlueprint.make({
  */
 export const boostPlugin = createFrontendPlugin({
   pluginId: 'boost',
-  extensions: [page],
+  extensions: [boostPage],
   routes: {
     root: rootRouteRef,
   },
diff --git a/workspaces/boost/specifications/prd/platform-operations-deployment.md b/workspaces/boost/specifications/prd/platform-operations-deployment.md
@@ -65,9 +65,11 @@ All packages live at `rhdh-plugins/workspaces/boost/plugins/`:
 
 | Package                           | Type            | Description                                                                                                   |
 | --------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------- |
-| `boost-frontend`                  | Frontend plugin | Chat UI, agent gallery, admin panels, composable extensions                                                   |
+| `boost`                           | Frontend plugin | Chat UI, agent gallery, admin panels, composable extensions                                                   |
 | `boost-common`                    | Common library  | Shared types (`AgenticProvider`, `NormalizedStreamEvent`, permissions) — browser-safe, no backend API imports |
 | `boost-node`                      | Node library    | `boostAiProviderServiceRef`, `boostProviderExtensionPoint` — service refs and extension points                |
+| `boost-responses-api-toolkit`     | Node library    | Shared Responses API utilities                                                                                |
+| `boost-toolscope`                 | Node library    | Injectable cache adapter for tool scope                                                                       |
 | `boost-backend`                   | Backend plugin  | Core routes, services, middleware, `ProviderManager`, cross-cutting entity providers (MCP, vector stores)     |
 | `boost-backend-module-llamastack` | Backend module  | Llama Stack agentic provider (composes `llamastack-entity-provider`)                                          |
 | `boost-backend-module-kagenti`    | Backend module  | Kagenti agentic provider (composes `kagenti-entity-provider`)                                                 |
@@ -82,14 +84,14 @@ All packages live at `rhdh-plugins/workspaces/boost/plugins/`:
 4. RHDH loads plugins dynamically via Scalprum — no code changes or rebuilds
 5. Boost appears as a sidebar entry in RHDH
 
-**Full portal deployment** installs `boost-frontend`, `boost-common`, `boost-node`, `boost-backend`, plus one or both provider modules. Provider modules compose their entity providers internally.
+**Full portal deployment** installs `boost`, `boost-common`, `boost-node`, `boost-backend`, plus one or both provider modules. Provider modules compose their entity providers internally.
 
 **Entity-provider-only deployment** installs `llamastack-entity-provider` or `kagenti-entity-provider` as standalone dynamic plugins — gets AI domain objects in the Backstage catalog without the rest of boost.
 
 **Backstage — Static Plugin:**
 
-1. Install npm packages: `@boost/plugin-boost-frontend`, `@boost/plugin-boost-backend`, `@boost/plugin-boost-common`, `@boost/plugin-boost-node`
-2. Optionally install provider modules: `@boost/plugin-boost-backend-module-llamastack`, `@boost/plugin-boost-backend-module-kagenti`
+1. Install npm packages: `@red-hat-developer-hub/backstage-plugin-boost`, `@red-hat-developer-hub/backstage-plugin-boost-backend`, `@red-hat-developer-hub/backstage-plugin-boost-common`, `@red-hat-developer-hub/backstage-plugin-boost-node`
+2. Optionally install provider modules: `@red-hat-developer-hub/backstage-plugin-boost-backend-module-llamastack`, `@red-hat-developer-hub/backstage-plugin-boost-backend-module-kagenti`
 3. Register frontend route, sidebar entry, and icon
 4. Register backend plugin and provider modules in backend startup
 5. Configure `app-config.yaml`
@@ -248,14 +250,14 @@ Backend services + Frontend via admin API
 
 ```
 RHDH Dynamic Plugin (full portal):
-  boost-frontend + boost-common + boost-node + boost-backend + provider module(s)
+  boost + boost-common + boost-node + boost-backend + provider module(s)
   OCI images → dynamic-plugins.override.yaml → Scalprum → sidebar entry
   No code changes, no rebuilds
 
 RHDH Dynamic Plugin (entity providers only):
   llamastack-entity-provider and/or kagenti-entity-provider
   Catalog entities without the full portal
-  No boost-backend or boost-frontend needed
+  No boost-backend or boost needed
 
 Backstage Static Plugin:
   npm packages → manual registration → rebuild → deploy
