From d88bf7b5f59dd9a2c342678a0590d041908e2c67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Tue, 18 Aug 2026 02:46:40 +0000 Subject: [PATCH] todo: what has to be true before the plugin ecosystem opens --- TODO.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/TODO.md b/TODO.md index 7b07f328..f3e98a6a 100644 --- a/TODO.md +++ b/TODO.md @@ -298,6 +298,35 @@ pane belonging to the folder you left; and the breadcrumb opted out of that last restored. Deliberate as written — a dashboard can hold two browsers and one URL cannot serve both — but worth re-deciding rather than inheriting. +## Plugin ecosystem — before it opens to third parties (2026-08-18) + +Not now. Months away. Recorded so it is not re-derived. + +- [ ] **A plugin install is not pinned, so a review would bind a repository rather than code.** + `fetch.ts:70` is `git clone --depth 1 ` — no ref — so it takes whatever the default branch + points at when the install runs. A plugin reviewed at commit X installs at whatever was pushed + since, and `--depth 1` leaves no history to compare against. + + This is the shape of the npm attack already documented in `CLAUDE.md` (2026-08-04), and the same + shape as the Chrome Web Store's real failures — not bad extensions passing review, but good ones + sold or compromised and then pushing an update to users who had already accepted them. + + Fix: a `reviewedCommit` on the catalogue entry, checkout detached at that SHA, and **verify + `rev-parse HEAD` matches or refuse**. The verification is the part that matters. An update then + becomes "a new reviewed SHA exists" — a catalogue change rather than something the author triggers. + +- [ ] **Third-party plugin sidecars are unconfined.** A plugin sidecar runs `bun run