Files
orca/tests/e2e
Neil 9015f13735 feat(plugins): bind worker and panel approval to exact bytes and recheck before every start (#30637)
* plugins: bind worker and panel approval to exact package bytes

Consent for any plugin that runs code (a v2 sandboxed-ui or trusted-worker
profile, or a v1 manifest with a worker or panel) now names its installed
content hash, so an update cannot swap code under an old approval. Shipped
v1 installs re-prompt once. Data packs keep their fingerprints, and dev
trees stay unbound so a save doesn't re-prompt. The re-review notice is one
short line.

* plugins: integrity-check reviewed bytes before every worker spawn

The content verifier cached its first check, so bytes swapped between a
crash and its restart still ran. The controller now hands the manager one
uncached verifyBeforeSpawn hook that runs before every spawn, including
crash restarts, and replaces the cached first-start check, so nothing is
hashed twice and a running worker is reused without hashing. It is an
integrity check, not a sandbox: Node still reads files after it. Approval
is re-asserted at the same points, so a revoked plugin stops restarting
instead of counting as a crash, and cancellation does not wait on a hash.

* plugins: restart a running worker on its updated code

A refresh that changes a running worker's spec used to stop it and wait for
the next command or event. Reconcile now restarts it once on the new spec
after every stop, through the same approval and integrity path, and skips
the restart if a newer reconcile or dispose has taken over. Idle workers
stay lazy.

* test(plugins): re-review a dev copy that takes over an approved install

Approval of worker and panel plugins now names their exact bytes, so
switching the demo plugin from its installed copy to the dev folder asks
for review again; the journey approves the dev copy before using it.

* fix(plugins): admit worker restarts against current reviewed spec

* test(plugins): say why the worker refresh tests read the clock and wait out a backoff

* fix(plugins): refuse custom Git remote helpers in plugin downloads and test smudge filters for real

* fix(plugins): keep crash restarts through refresh pauses, stop workers before awaiting refresh on shutdown, and narrow inherited Git protocol allowlists

* test(plugins): shrink the flaky-test baseline for the worker controller test
2026-10-28 14:28:26 -07:00
..