|
| 1 | +# Millennium Plugin Database |
| 2 | + |
| 3 | +This repository contains community plugins for [Millennium](https://steambrew.app/), a Steam client modding platform. Each subdirectory under `plugins/` is an independent plugin. Plugins are added as git submodules. |
| 4 | + |
| 5 | +## Cloning Plugin Source for Review |
| 6 | + |
| 7 | +Plugins in this repo are git submodules pointing to external repositories. The submodule files may not be checked out in CI. To review plugin code: |
| 8 | + |
| 9 | +1. Look at the PR diff to find the submodule entry being added or updated (check `.gitmodules` and the submodule path under `plugins/`). |
| 10 | +2. Use `git` or `gh` to determine the plugin's source repository URL and commit SHA from the PR diff. |
| 11 | +3. Clone the plugin repository yourself and check out the correct commit: |
| 12 | + ```bash |
| 13 | + git clone <repo-url> /tmp/plugin-review |
| 14 | + cd /tmp/plugin-review |
| 15 | + git checkout <commit-sha> |
| 16 | + ``` |
| 17 | +4. Review the plugin source code from there. |
| 18 | + |
| 19 | +Do NOT skip the review because submodule files aren't available locally. Always clone and inspect the actual plugin code. |
| 20 | + |
| 21 | +## PR Review Instructions |
| 22 | + |
| 23 | +When reviewing pull requests that add or update plugins, perform the following checks thoroughly. Be direct and specific in your feedback. |
| 24 | + |
| 25 | +### Security Review |
| 26 | + |
| 27 | +- Audit all network requests (fetch, XMLHttpRequest, WebSocket) for data exfiltration, SSRF, or connections to suspicious/hardcoded external endpoints. |
| 28 | +- Check for unsafe use of `eval()`, `Function()`, `innerHTML`, `dangerouslySetInnerHTML`, or any other code injection vectors. |
| 29 | +- Look for credential/token leakage -- secrets hardcoded in source, logged to console, or sent to third parties. |
| 30 | +- Inspect `callable` RPC declarations and their backend counterparts for input validation issues. |
| 31 | +- Flag any use of `document.cookie`, `localStorage`/`sessionStorage` access that reads data unrelated to the plugin's own scope. |
| 32 | +- Check for prototype pollution, unsafe deserialization, or any DOM-based injection risks. |
| 33 | +- Review file system access patterns in Lua backends for path traversal or arbitrary file read/write. |
| 34 | + |
| 35 | +### Bug Review (Priority) |
| 36 | + |
| 37 | +This is the most important part of the review. Drill deep into logic and correctness: |
| 38 | + |
| 39 | +- Trace every code path -- look for unhandled edge cases, off-by-one errors, null/undefined dereferences, race conditions, and incorrect async/await usage. |
| 40 | +- Check for missing cleanup: event listeners not removed, intervals/timeouts not cleared, subscriptions not unsubscribed. These cause memory leaks and ghost behavior in a long-running Steam client. |
| 41 | +- Verify state management correctness: stale closures, missing dependency arrays in `useEffect`/`useMemo`/`useCallback`, state updates on unmounted components. |
| 42 | +- Check error handling: uncaught promise rejections, missing try/catch around `callable` RPC calls, network requests without error handling. |
| 43 | +- Look for incorrect type coercion, string/number confusion, and comparisons that should use strict equality. |
| 44 | +- Verify that `plugin.json` schema is correct: required fields present (`name`, `common_name`, `description`, `version`), version format is valid, `backendType` matches actual backend usage. |
| 45 | +- Check for hardcoded Steam AppIDs, user IDs, or other magic values that should be dynamic. |
| 46 | +- Look for infinite loops, infinite re-renders, or expensive operations inside render cycles. |
| 47 | + |
| 48 | +### Breaking Changes |
| 49 | + |
| 50 | +Always flag the following as breaking changes when they occur in plugin updates: |
| 51 | + |
| 52 | +- Changes to `plugin.json` fields: `name`, `backendType`, `data` schema changes (renamed/removed keys). |
| 53 | +- Removed or renamed `callable` backend function signatures. |
| 54 | +- Changed settings storage keys (causes users to lose their settings on update). |
| 55 | +- Bumped minimum Millennium version requirements. |
| 56 | +- Removed features or changed default behavior. |
| 57 | + |
| 58 | +Clearly label these as **Breaking Change** in your review. |
| 59 | + |
| 60 | +### UI/Component Standards |
| 61 | + |
| 62 | +Plugins must use the component library from `@steambrew/client` and Steam's built-in components. Review settings panels and UI for compliance: |
| 63 | + |
| 64 | +**Settings panels** are defined in `definePlugin()`'s return object via the `content` prop (in the plugin's `index.tsx`): |
| 65 | +```tsx |
| 66 | +export default definePlugin(() => { |
| 67 | + return { |
| 68 | + title: "Plugin Name", |
| 69 | + icon: <IconsModule.Something />, |
| 70 | + content: <SettingsPanel />, |
| 71 | + }; |
| 72 | +}); |
| 73 | +``` |
| 74 | + |
| 75 | +**Required component usage:** |
| 76 | +- Use `Field` for settings rows (with `label`, `description`, and `bottomSeparator` props). |
| 77 | +- Use `Toggle`, `TextField`, `Dropdown`, `Slider` for input controls inside `Field`. |
| 78 | +- Use `DialogButton` or `Button` for actions. |
| 79 | +- Use `showModal`/`ModalRoot`/`ConfirmModal` for dialogs. |
| 80 | +- Use `showContextMenu`/`Menu`/`MenuItem` for context menus. |
| 81 | +- Use `Focusable` for keyboard/controller navigation support. |
| 82 | +- Use `Spinner` for loading states. |
| 83 | + |
| 84 | +**Flag these anti-patterns:** |
| 85 | +- Raw HTML elements (`<input>`, `<select>`, `<button>`, `<table>`) used where a `@steambrew/client` or Steam component exists. |
| 86 | +- Direct DOM manipulation (`document.createElement`, `element.innerHTML`, `element.appendChild`) for UI that could be React components. |
| 87 | +- Inline `style` attributes or `<style>` tags for layout/styling that Steam's existing CSS classes handle. Custom styles are acceptable only when Steam provides no equivalent. |
| 88 | +- Using `window.SP_REACT.createElement` directly instead of JSX. |
| 89 | +- Building settings UI outside of the `definePlugin` `content` pattern without good reason. |
| 90 | + |
| 91 | +**Acceptable exceptions:** |
| 92 | +- DOM manipulation for injecting into parts of Steam's UI that aren't exposed via React (e.g., patching existing Steam pages via `Millennium.findElement`). |
| 93 | +- Custom CSS for genuinely novel UI that has no Steam equivalent. |
| 94 | +- Plugins that don't have user-facing settings don't need a settings panel. |
| 95 | + |
| 96 | +### Backend Language Policy |
| 97 | + |
| 98 | +Python backends are no longer accepted. All plugins must use Lua for their backend (`"backendType": "lua"` in `plugin.json`). |
| 99 | + |
| 100 | +- Reject any plugin with `"backendType": "python"` or that ships `.py` files as part of the plugin backend. |
| 101 | +- Python helper scripts used only for development (build scripts, code generation, tooling) are acceptable and should NOT be flagged -- these are not shipped with the plugin. |
| 102 | +- If a PR updates an existing plugin that currently uses Python, it must migrate to Lua. Do not approve Python backend additions or modifications. |
| 103 | + |
| 104 | +### General Quality |
| 105 | + |
| 106 | +- Check that the plugin does what its description claims. |
| 107 | +- Flag dead code, unused imports, and unreachable branches. |
| 108 | +- Note overly complex code that could be simplified. |
| 109 | +- Verify consistent error messaging (user-facing errors should be helpful, not raw stack traces). |
0 commit comments