pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
---
|
|
id: plugin-ecosystem/a-plugin-install-is-not-pinned-so-a-review
|
|
title: "A plugin install is not pinned, so a review would bind a repository rather than code"
|
|
theme: plugin-ecosystem
|
|
status: open
|
|
created: 2026-08-04
|
|
date_source: stated
|
|
order: 1
|
|
---
|
|
|
|
**A plugin install is not pinned, so a review would bind a repository rather than code.**
|
|
`fetch.ts:70` is `git clone --depth 1 <source>` — no ref — so it takes whatever the default branch
|
|
points at when the install runs. A plugin reviewed at commit X installs at whatever was pushed
|
|
since, and `--depth 1` leaves no history to compare against.
|
|
|
|
This is the shape of the npm attack already documented in `CLAUDE.md` (2026-08-04), and the same
|
|
shape as the Chrome Web Store's real failures — not bad extensions passing review, but good ones
|
|
sold or compromised and then pushing an update to users who had already accepted them.
|
|
|
|
Fix: a `reviewedCommit` on the catalogue entry, checkout detached at that SHA, and **verify
|
|
`rev-parse HEAD` matches or refuse**. The verification is the part that matters. An update then
|
|
becomes "a new reviewed SHA exists" — a catalogue change rather than something the author triggers.
|