[alysnnix]

What this changes

The plugin now targets Paseo 0.13.0 and moves off every plugin API that 0.13.0 deprecates. It also closes all 11 open Dependabot advisories. Breaking: paseo-plugin.json now requires Paseo >=0.13.0, so an app or daemon on 0.12 or older refuses to load it.

• SDK: @getpaseo/plugin, client and protocol 0.8.0-beta.1 -> 0.13.0. The react/react-native type stand-ins now match the 0.13.0 app (19.2.3 / 0.86.3).
• Registration (index.client.tsx, new client/board/sidebar-item.tsx):
  • addSurface -> addScreen
  • addSidebarItem -> addSidebarHeaderItem with a SidebarRow component
  • openSurface -> openScreen
  • The screen id stays board, so a remembered /sidebar/board route still resolves.
• UI kit: 15 client files import @getpaseo/plugin/client/ui instead of the deprecated @getpaseo/plugin/client/react-native. The host drops that entry after 2027-04-20, and before 0.13.0 client/ui did not export these components.
• Advisories: all 11 are dev-only.
  • vite 8.3.5 and vitest / @vitest/mocker 5.0.5 fix deps: Bump the all-dependencies group across 1 directory with 7 updates #5-fix(client): use GitPullRequest icon, not Github #12.
  • shell-quote 1.12.0 fixes docs: add limitations and move screenshots #1.
  • brace-expansion 1.x (feat(search): add saved PR views #2) and sprintf-js (feat(review): show PR review status across views #3, a withdrawn advisory with no patched version) are gone from the tree with react-native 0.86.3.
  • zod 4.6.7 also clears the GHSA-mrhx-c7xc-m3w5 that npm audit reports.
  • npm audit: 0 vulnerabilities.

Supersedes #5, #13, #14, #15 and #17.

Checks

• npm run typecheck passes
• npm run lint passes, including the project rules in scripts/
• npm test passes (55)
• Loads cleanly against a real daemon: an isolated Paseo 0.13.0 daemon (npm @getpaseo/[email protected], its own PASEO_HOME and port) installed the branch from its directory. The plugin reached running with [paseo] Plugin ready, and the catalog reports requirements: { paseo: ">=0.13.0" }.

UI

• Not applicable
• Checked on desktop (web export, V8)
• Checked on iOS / Android (Hermes)

Not checked visually: the npm daemon ships no web UI, and the local desktop app is 0.12.0. What was checked instead:

• The client bundle that the 0.13.0 daemon compiled was fetched from plugin.catalog.get and evaluated against a stub context. All six registrations succeed. The sidebar row renders SidebarRow with GitPullRequest, reads as active only on the board screen, and opens { screenId: "board" }. Neither command-center item calls openSurface.
• The bundle contains no addSurface, addSidebarItem, openSurface or client/react-native.
• Every icon name in the bundle is exported by lucide-react-native 1.61.0, the version the 0.13.0 app resolves.

Paseo version

Oldest supported: 0.13.0. addScreen, addSidebarHeaderItem and openScreen exist since 0.11.0, but @getpaseo/plugin/client/ui only exports Icon, useToast, Modal, TextInput, ScrollView and copyText from 0.13.0 on.