Files
orca/config/scripts
Neil fdc03848a5 fix(plugins): protect every security and destructive string from language packs (#36219)
* fix(plugins): protect every security and destructive string from language packs

Language packs could rewrite trust copy outside a hand-kept list of app
areas (catalog-link dialog, browser-extension Allow/Deny, Node mirror).
Protected keys are now generated from structure: every key in a file that
renders a security surface, a destructive confirmation, or a native message
box, or that carries a // @protected-copy pragma, plus same-directory copy
modules. verify:localization-catalogs fails when the list is stale.

Pack strings are also capped at max(64, 4x English) characters and may not
contain control or bidi characters. Validation stays strict; loading drops
only the offending entries.

* chore(plugins): resync protected copy keys with main

* fix(plugins): cap pack strings in shared strict checks and pin new trust copy

* fix(plugins): keep the packaged CLI off the English catalog

* chore(plugins): resync protected copy keys with main

* chore(plugins): resync protected copy keys with main
2026-10-31 02:22:49 +00:00
..