release

plugin-templates/msp2606/.gitignore

@@ -0,0 +1,11 @@
+node_modules/
+build/
+coverage/
+.DS_Store
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*

plugin-templates/msp2606/.npmrc

@@ -0,0 +1 @@
+shamefully-hoist=true

plugin-templates/msp2606/README.md

@@ -0,0 +1,12 @@
+# <mypluginname>
+
+Muse plugin created with the `msp2606` SDK preset.
+
+## Development
+
+```bash
+pnpm install
+pnpm start
+```
+
+Update `muse.devConfig` in `package.json` to select the Muse application and environment used for local development.

plugin-templates/msp2606/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "<mypluginname>",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "muse": {
+    "msp": "msp2606",
+    "type": "normal",
+    "devConfig": {
+      "app": "myapp",
+      "env": "staging"
+    }
+  },
+  "scripts": {
+    "start": "vite",
+    "build": "vite build",
+    "build:dev": "cross-env NODE_ENV=development vite build --mode development",
+    "build:test": "cross-env MUSE_TEST_BUILD=true NODE_ENV=production vite build --mode e2e-test"
+  },
+  "dependencies": {
+    "js-plugin": "1.1.0"
+  },
+  "devDependencies": {
+    "@ebay/muse-core": "^2.0.0",
+    "@ebay/muse-lib-antd": "^2.0.0",
+    "@ebay/muse-lib-react": "^2.0.0",
+    "@ebay/muse-vite-plugin": "^2.0.0",
+    "@vitejs/plugin-react": "^6.0.1",
+    "cross-env": "^10.1.0",
+    "vite": "^8.0.11"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  }
+}

plugin-templates/msp2606/src/ext/index.js

@@ -0,0 +1 @@
+export {};

plugin-templates/msp2606/src/index.js

@@ -0,0 +1,11 @@
+import plugin from 'js-plugin';
+import * as ext from './ext';
+import reducer from './reducer';
+import route from './route';
+
+plugin.register({
+  ...ext,
+  name: '<mypluginname>',
+  route,
+  reducer,
+});

plugin-templates/msp2606/src/reducer.js

@@ -0,0 +1,3 @@
+const reducer = (state = {}) => state;
+
+export default reducer;

plugin-templates/msp2606/src/route.js

@@ -0,0 +1,5 @@
+const route = {
+  childRoutes: [],
+};
+
+export default route;

plugin-templates/msp2606/vite.config.js

@@ -0,0 +1,7 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+import museVitePlugin from '@ebay/muse-vite-plugin';
+
+export default defineConfig(() => ({
+  plugins: [react(), museVitePlugin()],
+}));

ui-plugins/muse-boot-default/MUSE_README.md

@@ -376,10 +376,10 @@ const MyComponent = () => {
 
 ### Example 5: Force Loading Specific Plugin Versions
 
-For debugging or testing, use the `forcePlugins` query parameter:
+For debugging, local development, or Muse e2e, use the `forcePlugins` query parameter. It is applied when `isDev`, `isLocal`, or `isE2eTest` is true. Plugin names, types (`boot` / `init` / `lib` / `normal`), and versions must be valid; other values are ignored.
 
 ```
-https://myapp.com?forcePlugins=@ebay/my-plugin@1.2.3;other-plugin@2.0.0
+https://myapp.com?forcePlugins=@ebay/my-plugin@1.2.3;other-plugin!normal@2.0.0
 ```
 
 This overrides the deployed plugin versions with specific versions.
@@ -394,7 +394,7 @@ This overrides the deployed plugin versions with specific versions.
 - Handles plugin loading order: boot → init → lib → normal
 - Init plugins can use `initEntries` or `waitFor` to perform async initialization
 - Lib plugins with `isAppEntry: true` register app entry functions
-- The `forcePlugins` query parameter is useful for debugging specific plugin versions
+- The `forcePlugins` query parameter is useful for debugging specific plugin versions in local/dev or Muse e2e
 - Service worker registration is automatic but can be customized
 - All plugin loading happens in parallel for performance (within each type group)
 - The loading UI provides user feedback during the bootstrap process

ui-plugins/muse-boot-default/package.json

@@ -5,7 +5,7 @@
     "url": "https://github.com/ebay/Muse",
     "directory": "ui-plugins/muse-boot-default"
   },
-  "version": "2.0.2",
+  "version": "2.0.3",
   "main": "index.js",
   "license": "MIT",
   "type": "module",

ui-plugins/muse-boot-default/src/boot.js

@@ -3,6 +3,7 @@ import loading from './loading';
 import error from './error';
 import registerSw from './registerSw';
 import { loadInParallel, loadInSerial, getPluginId } from './utils';
+import { applyForcePlugins, isForcePluginsAllowed } from './forcePlugins';
 import msgEngine from './msgEngine';
 import './urlListener';
 import './style.css';
@@ -105,51 +106,16 @@ async function start() {
     );
   }
 
-  /* Handle forcePlugins query parameter */
+  /* Handle forcePlugins query parameter (local/dev or Muse e2e) */
   const searchParams = new URLSearchParams(window.location.search);
   const forcePluginStr = searchParams.get('forcePlugins');
   if (forcePluginStr) {
-    const forcePluginById = forcePluginStr
-      .split(';')
-      .filter(Boolean)
-      .reduce((p, c) => {
-        const separator = '@';
-        const limit = 2;
-        let prefix = '';
-        if (c.startsWith('@') && c[0] === separator) {
-          // Starts with @, means it's a scoped plugin
-          c = c.substring(1);
-          prefix = '@';
-        }
-        const arr = c.split(separator, limit);
-        if (arr.length === limit) {
-          const [name, type] = arr[0].split('!');
-          p[`${prefix}${name}`] = {
-            version: arr[1],
-            type: type,
-          };
-        }
-        return p;
-      }, {});
-    // Update or remove plugins from the list based on forcePlugins
-    plugins = plugins
-      .map((p) => {
-        if (!forcePluginById[p.name]) return p;
-        const newPlugin = { ...p, version: forcePluginById[p.name].version };
-        delete forcePluginById[p.name];
-        return newPlugin;
-      })
-      .filter((p) => p.version !== 'null');
-
-    // Need to get the type of plugin from muse registry directly.
-    for (const p in forcePluginById) {
-      if (forcePluginById[p].version !== 'null') {
-        plugins.push({
-          name: p,
-          type: forcePluginById[p].type,
-          version: forcePluginById[p].version,
-        });
-      }
+    if (isForcePluginsAllowed(mg)) {
+      plugins = applyForcePlugins(plugins, forcePluginStr);
+    } else {
+      console.warn(
+        '[muse-boot] forcePlugins is ignored outside local/dev and Muse e2e.',
+      );
     }
   }
 

ui-plugins/muse-boot-default/src/boot.test.js

@@ -46,6 +46,7 @@ vi.mock('./style.css', () => ({}));
 import loading from './loading.js';
 import error from './error.js';
 import msgEngine from './msgEngine.js';
+import { loadInParallel } from './utils.js';
 import { bootstrap } from './boot.js';
 
 function makeMuseGlobal(overrides = {}) {
@@ -261,6 +262,87 @@ describe('bootstrap', () => {
 
     expect(loader).toHaveBeenCalledTimes(1);
   });
+
+  it('ignores forcePlugins in deployed environments', async () => {
+    const prevLocation = window.location;
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: { search: '?forcePlugins=poc!init@1.0.0' },
+    });
+    window.MUSE_GLOBAL.appEntries = [{ name: 'main', func: vi.fn().mockResolvedValue(undefined) }];
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    vi.spyOn(document.head, 'appendChild').mockImplementation((el) => {
+      if (el.tagName === 'SCRIPT' && el.textContent?.includes('__onMusePluginsLoaded')) {
+        window.MUSE_GLOBAL.__onMusePluginsLoaded?.();
+      }
+    });
+
+    try {
+      await runBootstrap();
+      const initPlugins = loadInParallel.mock.calls[0]?.[0] || [];
+      expect(initPlugins.some((p) => p.name === 'poc')).toBe(false);
+    } finally {
+      Object.defineProperty(window, 'location', { configurable: true, value: prevLocation });
+    }
+  });
+
+  it('applies valid forcePlugins in dev', async () => {
+    const prevLocation = window.location;
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: { search: '?forcePlugins=extra!init@1.0.1' },
+    });
+    window.MUSE_GLOBAL = makeMuseGlobal({
+      isDev: true,
+      appEntries: [{ name: 'main', func: vi.fn().mockResolvedValue(undefined) }],
+    });
+    vi.spyOn(document.head, 'appendChild').mockImplementation((el) => {
+      if (el.tagName === 'SCRIPT' && el.textContent?.includes('__onMusePluginsLoaded')) {
+        window.MUSE_GLOBAL.__onMusePluginsLoaded?.();
+      }
+    });
+
+    try {
+      await runBootstrap();
+      const initPlugins = loadInParallel.mock.calls[0][0];
+      expect(initPlugins).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ name: 'extra', type: 'init', version: '1.0.1' }),
+        ]),
+      );
+    } finally {
+      Object.defineProperty(window, 'location', { configurable: true, value: prevLocation });
+    }
+  });
+
+  it('applies valid forcePlugins when isE2eTest is true', async () => {
+    const prevLocation = window.location;
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: { search: '?forcePlugins=extra!init@1.0.1' },
+    });
+    window.MUSE_GLOBAL = makeMuseGlobal({
+      isE2eTest: true,
+      appEntries: [{ name: 'main', func: vi.fn().mockResolvedValue(undefined) }],
+    });
+    vi.spyOn(document.head, 'appendChild').mockImplementation((el) => {
+      if (el.tagName === 'SCRIPT' && el.textContent?.includes('__onMusePluginsLoaded')) {
+        window.MUSE_GLOBAL.__onMusePluginsLoaded?.();
+      }
+    });
+
+    try {
+      await runBootstrap();
+      const initPlugins = loadInParallel.mock.calls[0][0];
+      expect(initPlugins).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ name: 'extra', type: 'init', version: '1.0.1' }),
+        ]),
+      );
+    } finally {
+      Object.defineProperty(window, 'location', { configurable: true, value: prevLocation });
+    }
+  });
 });
 
 describe('bootstrap - appConfig.entry selection', () => {

ui-plugins/muse-boot-default/src/error.js

@@ -1,8 +1,17 @@
+function isSafeHref(href) {
+  if (!href || href === '#') return true;
+  try {
+    const url = new URL(href, window.location.origin);
+    return url.protocol === 'https:' || url.protocol === 'http:';
+  } catch {
+    return false;
+  }
+}
+
 const error = {
   errors: [],
   init() {
     const errorDiv = document.createElement('div');
-    errorDiv.innerHTML = ``;
     errorDiv.id = 'muse-error-node';
     document.body.appendChild(errorDiv);
     this.mountNode = errorDiv;
@@ -14,22 +23,42 @@ const error = {
   },
   update() {
     if (!this.mountNode) this.init();
+    this.mountNode.replaceChildren();
+
+    const inner = document.createElement('div');
+    inner.className = 'muse-error-node-inner';
+
+    const heading = document.createElement('h4');
+    heading.textContent = 'Failed to load:';
+    inner.appendChild(heading);
+
+    if (this.errors.length === 1) {
+      const div = document.createElement('div');
+      div.textContent = String(this.errors[0] ?? '');
+      inner.appendChild(div);
+    } else {
+      const ul = document.createElement('ul');
+      this.errors.forEach((err) => {
+        const li = document.createElement('li');
+        li.textContent = String(err ?? '');
+        ul.appendChild(li);
+      });
+      inner.appendChild(ul);
+    }
+
+    const note = document.createElement('p');
+    note.appendChild(
+      document.createTextNode('* Unexpected error happened, please refresh to retry or '),
+    );
+    const supportLink = window.MUSE_GLOBAL?.appConfig?.supportLink || '#';
+    const contact = document.createElement('a');
+    contact.textContent = 'contact support';
+    contact.href = isSafeHref(supportLink) ? supportLink : '#';
+    note.appendChild(contact);
+    note.appendChild(document.createTextNode('.'));
+    inner.appendChild(note);
 
-    const content =
-      this.errors.length === 1
-        ? `<div>${this.errors[0]}</div>`
-        : `<ul>
-            ${this.errors.map((err) => '<li>' + err + '</li>').join('')}
-          </ul>`;
-    this.mountNode.innerHTML = `
-      <div class="muse-error-node-inner">
-        <h4>Failed to load:</h4>
-        ${content}
-        <p>* Unexpected error happened, please refresh to retry or <a href="${
-          window.MUSE_GLOBAL.appConfig?.supportLink || '#'
-        }">contact support</a>.</p>
-      </div>
-    `;
+    this.mountNode.appendChild(inner);
   },
 };
 

ui-plugins/muse-boot-default/src/error.test.js

@@ -78,5 +78,19 @@ describe('error', () => {
       error.update();
       expect(error.mountNode.innerHTML).toContain('href="#"');
     });
+
+    it('renders untrusted error text without executing HTML', () => {
+      error.showMessage('<img src=x onerror="alert(1)">');
+      expect(error.mountNode.querySelector('img')).toBeNull();
+      expect(error.mountNode.textContent).toContain('<img src=x onerror="alert(1)">');
+    });
+
+    it('rejects javascript: support links', () => {
+      setupMuseGlobal({ appConfig: { supportLink: 'javascript:alert(1)' } });
+      error.errors = ['oops'];
+      error.init();
+      error.update();
+      expect(error.mountNode.querySelector('a').getAttribute('href')).toBe('#');
+    });
   });
 });