Add plugin entry: diffui-bb

[jjcm]

What it does

Diffui brings Diffui's design canvas into bb, so design and implementation live in the same window.

• Diffui's real canvas, in bb. The "Diffui" sidebar page mounts Diffui's own <diffui-canvas-workspace> element — no iframe, no re-implementation. Pan/zoom, option stacks, noodles, comments, prompt editing, generation, undo and collab are Diffui's code running in bb. The plugin redefines Diffui's --canvas-* tokens in terms of bb's host tokens, so the canvas follows bb's light and dark themes.
• bb-owned files as threads. The thread list is wrapped to list only the canvases that belong to bb — created here or explicitly opened from the browse grid. Membership lives in the plugin's own SQLite table via bb.storage.database(); a Diffui account's other files stay in Diffui.
• Build with bb. Right-click a design on a canvas and the plugin fetches the design bytes, uploads them through bb.sdk.projects.attachments.upload, and spawns a thread with a visible brief, localImage refs, and an agent-only structured brief.
• Agent tools. diffui_create_canvas, diffui_generate_options, diffui_get_canvas, diffui_create_build_link.

Source release

Git semver range ^0.1.0 over https://github.com/jjcm/diffui-bb.git, repository root (no subdir, no tagPrefix). Tag v0.1.0 is annotated and points at b5a879c51b5ec94c3c93f8a190a5e520210a8fe2.

The entry uses the BB host icon name Palette, matching the plugin manifest's bb.branding.icon. The repository ships no logo artwork, so nothing is vendored into icons/.

Plugin checks

Run against a clean git worktree checkout of the tagged commit, with npm ci:

• npm run typecheck (tsc --noEmit) — clean
• npm test (vitest) — 7 files, 87 tests passing
• bb plugin build — emits dist/server.js, dist/app.js, dist/app.css

Marketplace checks

• npm ci --ignore-scripts
• npm run build — 64 entries
• npm run check (--liveness) — 64 entries, source resolves

Notes for reviewers

• Network. The plugin talks to a Diffui server over its public API only — JSON, file uploads, and a websocket. No Diffui schema changes and no private endpoints.
• Credentials. Diffui auth is handled by the plugin's own settings; no tokens are read from or written to bb's config outside plugin storage.
• Storage. One SQLite table in the plugin's own database, tracking which Diffui files were opened into bb.
• Manifest engines. bb >=0.38, bbPluginSdk >=0.4.8. Developed and verified against bb 0.39.0.

[SawyerHood]

Automated note from a Claude Code agent, posted on behalf of the marketplace maintainer.

Thank you for the Diffui integration. We are rejecting this version for now because the exact source cannot install safely.

• .bb/plugins.json:8 uses source: ".", but BB requires "./".
• server.ts:642-654 uses the removed experimental_statusLabels field.
• lib/bridge.ts:47-96 can fetch a supplied URL without a private-network or origin check.
• The package and tag say 0.1.0, but server.ts:36 reports 0.2.0.

Please fix the local source, migrate the SDK field, add URL checks, and align the version. The cloud data disclosure is not a blocking issue for this review.

[SawyerHood]

Automated note from a Claude Code agent, posted on behalf of the marketplace maintainer.

We are requesting changes for the reasons in the automated review comment above. Please reply after a new matching release is available.