fix(plugin): validate plugin id format

src/langbot/pkg/api/http/service/bot.py

@@ -120,26 +120,24 @@ class BotService:
 
     async def update_bot(self, bot_uuid: str, bot_data: dict) -> None:
         """Update bot"""
-        update_data = bot_data.copy()
-
-        if 'uuid' in update_data:
-            del update_data['uuid']
+        if 'uuid' in bot_data:
+            del bot_data['uuid']
 
         # set use_pipeline_name
-        if 'use_pipeline_uuid' in update_data:
+        if 'use_pipeline_uuid' in bot_data:
             result = await self.ap.persistence_mgr.execute_async(
                 sqlalchemy.select(persistence_pipeline.LegacyPipeline).where(
-                    persistence_pipeline.LegacyPipeline.uuid == update_data['use_pipeline_uuid']
+                    persistence_pipeline.LegacyPipeline.uuid == bot_data['use_pipeline_uuid']
                 )
             )
             pipeline = result.first()
             if pipeline is not None:
-                update_data['use_pipeline_name'] = pipeline.name
+                bot_data['use_pipeline_name'] = pipeline.name
             else:
                 raise Exception('Pipeline not found')
 
         await self.ap.persistence_mgr.execute_async(
-            sqlalchemy.update(persistence_bot.Bot).values(update_data).where(persistence_bot.Bot.uuid == bot_uuid)
+            sqlalchemy.update(persistence_bot.Bot).values(bot_data).where(persistence_bot.Bot.uuid == bot_uuid)
         )
         await self.ap.platform_mgr.remove_bot(bot_uuid)
 

src/langbot/pkg/plugin/connector.py

@@ -633,11 +633,12 @@ class PluginRuntimeConnector:
         Raises:
             ValueError: If plugin_id is not in the expected 'author/name' format.
         """
-        if '/' not in plugin_id:
+        segments = plugin_id.split('/')
+        if len(segments) != 2 or not all(segments):
             raise ValueError(
                 f"Invalid plugin_id format: '{plugin_id}'. Expected 'author/name' format (e.g. 'langbot/rag-engine')."
             )
-        return plugin_id.split('/', 1)
+        return segments[0], segments[1]
 
     async def call_rag_ingest(self, plugin_id: str, context_data: dict[str, Any]) -> dict[str, Any]:
         """Call plugin to ingest document.

tests/unit_tests/api/http/service/test_bot_service.py

@@ -1,62 +0,0 @@
-from types import SimpleNamespace
-from unittest.mock import AsyncMock
-
-from sqlalchemy.sql.dml import Update
-
-from langbot.pkg.api.http.service.bot import BotService
-
-
-class _FakeResult:
-    def __init__(self, value):
-        self.value = value
-
-    def first(self):
-        return self.value
-
-
-class _PersistenceManager:
-    def __init__(self):
-        self.update_values = None
-
-    async def execute_async(self, statement):
-        if isinstance(statement, Update):
-            self.update_values = {
-                key: value for key, value in statement.compile().params.items() if not key.startswith('uuid_')
-            }
-            return None
-
-        return _FakeResult(SimpleNamespace(name='Updated Pipeline'))
-
-
-async def test_update_bot_copies_input_before_filtering_and_setting_pipeline_name():
-    persistence_mgr = _PersistenceManager()
-    runtime_bot = SimpleNamespace(enable=False)
-    platform_mgr = SimpleNamespace(
-        remove_bot=AsyncMock(),
-        load_bot=AsyncMock(return_value=runtime_bot),
-    )
-    ap = SimpleNamespace(
-        persistence_mgr=persistence_mgr,
-        platform_mgr=platform_mgr,
-        sess_mgr=SimpleNamespace(session_list=[]),
-    )
-    service = BotService(ap)
-    service.get_bot = AsyncMock(return_value={'uuid': 'bot-1'})
-    payload = {
-        'uuid': 'caller-owned-uuid',
-        'name': 'Test Bot',
-        'use_pipeline_uuid': 'pipeline-1',
-    }
-
-    await service.update_bot('bot-1', payload)
-
-    assert payload == {
-        'uuid': 'caller-owned-uuid',
-        'name': 'Test Bot',
-        'use_pipeline_uuid': 'pipeline-1',
-    }
-    assert persistence_mgr.update_values == {
-        'name': 'Test Bot',
-        'use_pipeline_uuid': 'pipeline-1',
-        'use_pipeline_name': 'Updated Pipeline',
-    }

tests/unit_tests/plugin/test_plugin_id_parsing.py

@@ -0,0 +1,25 @@
+"""Test plugin ID parsing validation."""
+
+import pytest
+
+from src.langbot.pkg.plugin.connector import PluginRuntimeConnector
+
+
+def test_parse_plugin_id_accepts_author_name():
+    assert PluginRuntimeConnector._parse_plugin_id('langbot/rag-engine') == ('langbot', 'rag-engine')
+
+
+@pytest.mark.parametrize(
+    'plugin_id',
+    [
+        '',
+        'author',
+        'author/',
+        '/name',
+        'author/name/extra',
+        '/',
+    ],
+)
+def test_parse_plugin_id_rejects_malformed_ids(plugin_id):
+    with pytest.raises(ValueError, match='Expected'):
+        PluginRuntimeConnector._parse_plugin_id(plugin_id)