@bibobonking/opensol 3.0.1 → 3.0.2

package/server/lib/http.mjs

@@ -0,0 +1,237 @@
+import { createReadStream } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import path from 'node:path'
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.gif': 'image/gif',
+  '.ico': 'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf',
+  '.map': 'application/json; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.md': 'text/markdown; charset=utf-8',
+  '.wasm': 'application/wasm',
+  '.csv': 'text/csv; charset=utf-8',
+  '.xml': 'application/xml; charset=utf-8',
+  '.avif': 'image/avif',
+  '.otf': 'font/otf',
+  '.mp3': 'audio/mpeg',
+  '.wav': 'audio/wav',
+  '.ogg': 'audio/ogg',
+  '.mp4': 'video/mp4',
+  '.webm': 'video/webm',
+  '.glb': 'model/gltf-binary',
+  '.gltf': 'model/gltf+json',
+}
+
+export function mimeFor(file) {
+  return MIME[path.extname(file).toLowerCase()] ?? 'application/octet-stream'
+}
+
+export function streamFile(req, res, absolute, size, headers = {}) {
+  res.writeHead(200, {
+    'Content-Type': mimeFor(absolute),
+    'Content-Length': size,
+    ...headers,
+  })
+  if (req.method === 'HEAD') {
+    res.end()
+    return
+  }
+  const stream = createReadStream(absolute)
+  stream.on('error', () => res.destroy())
+  stream.pipe(res)
+}
+
+export class HttpError extends Error {
+  constructor(status, message, code = '') {
+    super(message)
+    this.name = 'HttpError'
+    this.status = status
+    this.code = code
+  }
+}
+
+export function securityHeaders(res) {
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.setHeader('X-Frame-Options', 'DENY')
+  res.setHeader('Referrer-Policy', 'no-referrer')
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+  res.setHeader(
+    'Content-Security-Policy',
+    [
+      "default-src 'self'",
+      // `blob:` lets a user-approved Safe plugin load as a module without unsafe-eval.
+      "script-src 'self' 'unsafe-inline' blob:",
+      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+      "font-src 'self' https://fonts.gstatic.com",
+      "img-src 'self' data: blob:",
+      "connect-src 'self'",
+      "frame-ancestors 'none'",
+      "base-uri 'self'",
+      "form-action 'self'",
+    ].join('; '),
+  )
+}
+
+export function json(res, status, value, headers = {}) {
+  const body = Buffer.from(JSON.stringify(value))
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': body.length,
+    'Cache-Control': 'no-store',
+    ...headers,
+  })
+  res.end(body)
+}
+
+export function sendError(res, error) {
+  if (res.headersSent) {
+    res.destroy()
+    return
+  }
+  const status = error instanceof HttpError ? error.status : 500
+  const message =
+    error instanceof HttpError
+      ? error.message
+      : error instanceof Error
+        ? error.message
+        : 'The daemon hit an unexpected error.'
+  json(res, status, {
+    error: {
+      message,
+      code: error instanceof HttpError ? error.code : 'daemon_error',
+      status,
+    },
+  })
+}
+
+export async function readBody(req, maxBytes = 8 * 1024 * 1024) {
+  const declared = Number(req.headers['content-length'] ?? 0)
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw new HttpError(413, 'That request is too large.', 'request_too_large')
+  }
+  const chunks = []
+  let total = 0
+  for await (const chunk of req) {
+    total += chunk.length
+    if (total > maxBytes) {
+      throw new HttpError(413, 'That request is too large.', 'request_too_large')
+    }
+    chunks.push(chunk)
+  }
+  return Buffer.concat(chunks)
+}
+
+export async function readJson(req, maxBytes = 8 * 1024 * 1024) {
+  const body = await readBody(req, maxBytes)
+  if (body.length === 0) return {}
+  try {
+    return JSON.parse(body.toString('utf8'))
+  } catch {
+    throw new HttpError(400, 'The request body is not valid JSON.', 'invalid_json')
+  }
+}
+
+export function clientIp(req) {
+  return req.socket.remoteAddress ?? 'local'
+}
+
+export function cookieValue(req, name) {
+  const header = req.headers.cookie
+  if (!header) return ''
+  for (const part of header.split(';')) {
+    const index = part.indexOf('=')
+    if (index === -1) continue
+    if (part.slice(0, index).trim() === name) return decodeURIComponent(part.slice(index + 1).trim())
+  }
+  return ''
+}
+
+export function setCookie(res, name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path ?? '/'}`]
+  if (options.httpOnly !== false) parts.push('HttpOnly')
+  parts.push(`SameSite=${options.sameSite ?? 'Strict'}`)
+  if (options.maxAge !== undefined) parts.push(`Max-Age=${Math.floor(options.maxAge)}`)
+  if (options.secure) parts.push('Secure')
+  const existing = res.getHeader('Set-Cookie')
+  const next = Array.isArray(existing) ? [...existing, parts.join('; ')] : existing ? [String(existing), parts.join('; ')] : [parts.join('; ')]
+  res.setHeader('Set-Cookie', next)
+}
+
+export async function serveStatic(req, res, root, pathname) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    throw new HttpError(405, 'Method not allowed.', 'method_not_allowed')
+  }
+  let relative
+  try {
+    relative = decodeURIComponent(pathname)
+  } catch {
+    throw new HttpError(400, 'That path is not valid.', 'invalid_path')
+  }
+  if (relative.includes('\0')) throw new HttpError(400, 'That path is not valid.', 'invalid_path')
+  relative = relative.replace(/^\/+/, '')
+  const candidate = path.resolve(root, relative)
+  const prefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`
+  if (candidate !== root && !candidate.startsWith(prefix)) {
+    throw new HttpError(403, 'That path is outside the app.', 'forbidden')
+  }
+
+  let target = candidate
+  let info
+  try {
+    info = await stat(target)
+  } catch {
+    info = null
+  }
+  if (info?.isDirectory()) {
+    target = path.join(target, 'index.html')
+    info = await stat(target).catch(() => null)
+  }
+  if (!info?.isFile()) {
+    // App routes are client-side. Only fall back for navigation requests.
+    const accepts = String(req.headers.accept ?? '')
+    if (pathname.startsWith('/api/') || (!accepts.includes('text/html') && pathname !== '/')) {
+      throw new HttpError(404, 'Not found.', 'not_found')
+    }
+    target = path.join(root, 'index.html')
+    info = await stat(target).catch(() => null)
+  }
+  if (!info?.isFile()) {
+    throw new HttpError(503, 'OpenSol is not built yet. Run the remote build and place the output in dist/.', 'dist_missing')
+  }
+
+  const ext = path.extname(target).toLowerCase()
+  const immutable = target.includes(`${path.sep}assets${path.sep}`)
+  res.writeHead(200, {
+    'Content-Type': MIME[ext] ?? 'application/octet-stream',
+    'Content-Length': info.size,
+    'Cache-Control': immutable ? 'public, max-age=31536000, immutable' : 'no-cache',
+  })
+  if (req.method === 'HEAD') {
+    res.end()
+    return
+  }
+  const stream = createReadStream(target)
+  stream.on('error', () => res.destroy())
+  stream.pipe(res)
+}
+
+export function parseJson(value, fallback = null) {
+  try {
+    return JSON.parse(value)
+  } catch {
+    return fallback
+  }
+}

package/server/lib/plugins.mjs

@@ -0,0 +1,321 @@
+import { createHash, randomBytes } from 'node:crypto'
+import { lookup } from 'node:dns/promises'
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import https from 'node:https'
+import { isIP } from 'node:net'
+import path from 'node:path'
+import { HttpError } from './http.mjs'
+import { DATA_DIR } from './store.mjs'
+import { readPluginArchive } from '../../shared/plugin-package.mjs'
+
+const PLUGINS_DIR = path.join(DATA_DIR, 'plugins')
+const INDEX_FILE = path.join(PLUGINS_DIR, 'index.json')
+const MAX_NETWORK_BODY = 64 * 1024
+const MAX_NETWORK_RESPONSE = 1024 * 1024
+const REQUEST_TIMEOUT_MS = 12_000
+let writes = Promise.resolve()
+
+async function ensurePluginsDir() {
+  await mkdir(PLUGINS_DIR, { recursive: true, mode: 0o700 })
+}
+
+async function readIndex() {
+  await ensurePluginsDir()
+  try {
+    const parsed = JSON.parse(await readFile(INDEX_FILE, 'utf8'))
+    return parsed && typeof parsed === 'object' && Array.isArray(parsed.plugins)
+      ? parsed.plugins
+      : []
+  } catch (error) {
+    if (error?.code === 'ENOENT') return []
+    if (error instanceof SyntaxError) throw new Error('OpenSol plugin index is damaged.')
+    throw error
+  }
+}
+
+async function saveIndex(plugins) {
+  const task = writes.then(async () => {
+    await ensurePluginsDir()
+    const temporary = `${INDEX_FILE}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`
+    await writeFile(temporary, `${JSON.stringify({ plugins }, null, 2)}\n`, { mode: 0o600 })
+    await rename(temporary, INDEX_FILE)
+  })
+  writes = task.catch(() => undefined)
+  return task
+}
+
+function publicRecord(plugin) {
+  const { id, manifest, manifestHash, installedAt, safe, enabled, grants } = plugin
+  return { id, manifest, manifestHash, installedAt, safe, enabled, grants }
+}
+
+function locate(plugins, id) {
+  const plugin = plugins.find((item) => item.id === id)
+  if (!plugin) throw new HttpError(404, 'Plugin not found.', 'plugin_not_found')
+  return plugin
+}
+
+export async function listPlugins() {
+  return (await readIndex()).map(publicRecord)
+}
+
+export async function getPluginArchive(id) {
+  const plugins = await readIndex()
+  locate(plugins, id)
+  try {
+    return await readFile(path.join(PLUGINS_DIR, `${id}.plugin.json`))
+  } catch (error) {
+    if (error?.code === 'ENOENT') throw new HttpError(404, 'Plugin package is missing.', 'plugin_package_missing')
+    throw error
+  }
+}
+
+export async function installPlugin(bytes) {
+  let parsed
+  try {
+    parsed = readPluginArchive(bytes)
+  } catch (error) {
+    throw new HttpError(400, error instanceof Error ? error.message : 'Invalid plugin package.', 'invalid_plugin')
+  }
+  const plugins = await readIndex()
+  const manifestHash = createHash('sha256').update(JSON.stringify(parsed.manifest)).digest('hex')
+  const previous = plugins.find((item) => item.id === parsed.manifest.id)
+  const unchanged = previous?.manifestHash === manifestHash
+  const record = {
+    id: parsed.manifest.id,
+    manifest: parsed.manifest,
+    manifestHash,
+    installedAt: previous?.installedAt ?? new Date().toISOString(),
+    safe: unchanged ? previous.safe : false,
+    enabled: unchanged ? previous.enabled : false,
+    grants: unchanged
+      ? previous.grants
+      : { capabilities: [], domains: [] },
+  }
+  const archivePath = path.join(PLUGINS_DIR, `${record.id}.plugin.json`)
+  await writeFile(archivePath, bytes, { mode: 0o600 })
+  const next = previous
+    ? plugins.map((item) => (item.id === record.id ? record : item))
+    : [...plugins, record]
+  await saveIndex(next)
+  return publicRecord(record)
+}
+
+export async function setPluginGrants(id, grants) {
+  const plugins = await readIndex()
+  const plugin = locate(plugins, id)
+  if (
+    !grants ||
+    typeof grants !== 'object' ||
+    !Array.isArray(grants.capabilities) ||
+    !Array.isArray(grants.domains)
+  ) {
+    throw new HttpError(400, 'Plugin grants must list capabilities and domains.', 'invalid_plugin_grant')
+  }
+  const { capabilities, domains } = grants
+  if (
+    capabilities.some((value) => !plugin.manifest.capabilities.includes(value)) ||
+    domains.some((value) => !plugin.manifest.domains.includes(value))
+  ) {
+    throw new HttpError(400, 'A plugin cannot be granted undeclared permissions.', 'invalid_plugin_grant')
+  }
+  const updated = {
+    ...plugin,
+    grants: {
+      capabilities: [...new Set(capabilities)],
+      domains: [...new Set(domains)],
+    },
+  }
+  await saveIndex(plugins.map((item) => (item.id === id ? updated : item)))
+  return publicRecord(updated)
+}
+
+export async function setPluginSafe(id, safe) {
+  if (typeof safe !== 'boolean') throw new HttpError(400, 'Plugin trust must be explicitly true or false.', 'invalid_plugin_trust')
+  const plugins = await readIndex()
+  const plugin = locate(plugins, id)
+  const updated = { ...plugin, safe, enabled: safe ? plugin.enabled : false }
+  await saveIndex(plugins.map((item) => (item.id === id ? updated : item)))
+  return publicRecord(updated)
+}
+
+export async function setPluginEnabled(id, enabled) {
+  if (typeof enabled !== 'boolean') throw new HttpError(400, 'Plugin activation must be explicitly true or false.', 'invalid_plugin_activation')
+  const plugins = await readIndex()
+  const plugin = locate(plugins, id)
+  if (enabled && !plugin.safe) {
+    throw new HttpError(409, 'Review and trust the plugin before enabling it.', 'plugin_not_safe')
+  }
+  const updated = { ...plugin, enabled }
+  await saveIndex(plugins.map((item) => (item.id === id ? updated : item)))
+  return publicRecord(updated)
+}
+
+export async function uninstallPlugin(id) {
+  const plugins = await readIndex()
+  locate(plugins, id)
+  await rm(path.join(PLUGINS_DIR, `${id}.plugin.json`), { force: true })
+  await saveIndex(plugins.filter((item) => item.id !== id))
+  return { id, removed: true }
+}
+
+function privateAddress(address) {
+  if (isIP(address) === 4) {
+    const parts = address.split('.').map(Number)
+    return (
+      parts[0] === 0 ||
+      parts[0] === 10 ||
+      parts[0] === 127 ||
+      (parts[0] === 169 && parts[1] === 254) ||
+      (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
+      (parts[0] === 192 && parts[1] === 168) ||
+      parts[0] >= 224
+    )
+  }
+  if (isIP(address) === 6) {
+    const lower = address.toLowerCase()
+    return (
+      lower === '::' ||
+      lower === '::1' ||
+      lower.startsWith('fc') ||
+      lower.startsWith('fd') ||
+      lower.startsWith('fe80') ||
+      (lower.startsWith('::ffff:') && privateAddress(lower.slice(7)))
+    )
+  }
+  return true
+}
+
+async function addressesFor(hostname, lookupImpl) {
+  const literal = isIP(hostname)
+  const addresses = literal ? [{ address: hostname, family: literal }] : await lookupImpl(hostname, { all: true })
+  if (!addresses.length || addresses.some((entry) => privateAddress(entry.address))) {
+    throw new HttpError(403, 'Plugin network access to private hosts is blocked.', 'plugin_private_host')
+  }
+  return addresses
+}
+
+function httpsRequest(url, method, headers, body, addresses) {
+  return new Promise((resolve, reject) => {
+    const request = https.request(
+      {
+        protocol: 'https:',
+        hostname: url.hostname,
+        port: url.port || 443,
+        method,
+        path: `${url.pathname}${url.search}`,
+        headers,
+        timeout: REQUEST_TIMEOUT_MS,
+        lookup: (_hostname, options, callback) => {
+          if (options?.all) callback(null, addresses)
+          else callback(null, addresses[0].address, addresses[0].family)
+        },
+      },
+      (response) => {
+        const chunks = []
+        let total = 0
+        response.on('data', (chunk) => {
+          total += chunk.length
+          if (total > MAX_NETWORK_RESPONSE) {
+            request.destroy(new HttpError(413, 'Plugin network response is too large.', 'plugin_response_too_large'))
+            return
+          }
+          chunks.push(chunk)
+        })
+        response.on('end', () => resolve({
+          status: response.statusCode ?? 0,
+          headers: response.headers,
+          body: Buffer.concat(chunks),
+        }))
+      },
+    )
+    request.on('timeout', () => request.destroy(new HttpError(504, 'Plugin network request timed out.', 'plugin_request_timeout')))
+    request.on('error', reject)
+    if (body) request.write(body)
+    request.end()
+  })
+}
+
+export async function requestPluginNetwork(id, request, {
+  fetchImpl,
+  lookupImpl = lookup,
+} = {}) {
+  const plugins = await readIndex()
+  const plugin = locate(plugins, id)
+  if (!plugin.safe || !plugin.enabled) throw new HttpError(403, 'Plugin network access requires an enabled Safe plugin.', 'plugin_disabled')
+  if (!plugin.grants.capabilities.includes('network.request')) {
+    throw new HttpError(403, 'Plugin has not been granted network access.', 'plugin_capability_denied')
+  }
+  let url
+  try {
+    url = new URL(String(request?.url ?? ''))
+  } catch {
+    throw new HttpError(400, 'Plugin URL is invalid.', 'plugin_bad_url')
+  }
+  if (
+    url.protocol !== 'https:' ||
+    url.username ||
+    url.password ||
+    url.port && url.port !== '443' ||
+    !plugin.manifest.domains.includes(url.hostname.toLowerCase()) ||
+    !plugin.grants.domains.includes(url.hostname.toLowerCase())
+  ) {
+    throw new HttpError(403, 'Plugin URL must use an explicitly granted HTTPS domain.', 'plugin_domain_denied')
+  }
+  const method = String(request.method ?? 'GET').toUpperCase()
+  if (!['GET', 'POST'].includes(method)) throw new HttpError(400, 'Plugin network method is not allowed.', 'plugin_bad_method')
+  const body = request.body === undefined ? undefined : String(request.body)
+  if (body && Buffer.byteLength(body) > MAX_NETWORK_BODY) {
+    throw new HttpError(413, 'Plugin network request body is too large.', 'plugin_request_too_large')
+  }
+  const headers = {}
+  for (const [key, value] of Object.entries(request.headers ?? {})) {
+    const lower = key.toLowerCase()
+    if (!['accept', 'content-type'].includes(lower) || typeof value !== 'string' || value.length > 200) {
+      throw new HttpError(400, 'Plugin request contains an unsupported header.', 'plugin_bad_header')
+    }
+    headers[lower] = value
+  }
+  const addresses = await addressesFor(url.hostname, lookupImpl)
+  const response = fetchImpl
+    ? await fetchImpl(url, {
+        method,
+        headers,
+        body,
+        redirect: 'manual',
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      })
+    : await httpsRequest(url, method, headers, body, addresses)
+  if (response.status >= 300 && response.status < 400) {
+    throw new HttpError(403, 'Plugin network redirects are blocked.', 'plugin_redirect_blocked')
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new HttpError(502, `Plugin network host returned HTTP ${response.status}.`, 'plugin_request_failed')
+  }
+  const getHeader = (name) =>
+    typeof response.headers?.get === 'function'
+      ? response.headers.get(name)
+      : response.headers?.[name] ?? response.headers?.[name.toLowerCase()]
+  const contentType = getHeader('content-type')?.split(';')[0].trim().toLowerCase() ?? ''
+  if (!['application/json', 'text/plain', 'application/xml', 'text/xml'].includes(contentType)) {
+    throw new HttpError(415, 'Plugin response content type is not allowed.', 'plugin_content_type')
+  }
+  const disposition = getHeader('content-disposition') ?? ''
+  if (/attachment/i.test(disposition)) throw new HttpError(415, 'Plugin file downloads are blocked.', 'plugin_download_blocked')
+  const declaredLength = Number(getHeader('content-length') ?? 0)
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_NETWORK_RESPONSE) {
+    throw new HttpError(413, 'Plugin network response is too large.', 'plugin_response_too_large')
+  }
+  const bytes =
+    response.body instanceof Uint8Array
+      ? Buffer.from(response.body)
+      : Buffer.from(await response.arrayBuffer())
+  if (bytes.length > MAX_NETWORK_RESPONSE) {
+    throw new HttpError(413, 'Plugin network response is too large.', 'plugin_response_too_large')
+  }
+  return {
+    status: response.status,
+    contentType,
+    body: bytes.toString('utf8'),
+  }
+}

package/server/lib/plugins.test.mjs

@@ -0,0 +1,140 @@
+import test, { beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { buildPluginArchive } from '../../shared/plugin-package.mjs'
+
+const dataDir = await mkdtemp(path.join(os.tmpdir(), 'maxcode-plugin-test-'))
+process.env.MAXCODE_DATA = dataDir
+const plugins = await import('./plugins.mjs')
+
+const baseManifest = {
+  id: 'test-plugin',
+  name: 'Test Plugin',
+  version: '1.0.0',
+  apiVersion: 1,
+  entry: 'plugin.js',
+  stylesheet: 'plugin.css',
+  capabilities: ['network.request'],
+  domains: ['api.example.test'],
+}
+
+function packageBytes(manifest = baseManifest) {
+  return buildPluginArchive({
+    manifest,
+    files: { 'plugin.js': 'api.registerCommand("sample", () => {})', 'plugin.css': '' },
+  })
+}
+
+async function installAndGrant(manifest = baseManifest) {
+  await plugins.installPlugin(packageBytes(manifest))
+  await plugins.setPluginGrants(manifest.id, {
+    capabilities: manifest.capabilities,
+    domains: manifest.domains,
+  })
+  await plugins.setPluginSafe(manifest.id, true)
+  await plugins.setPluginEnabled(manifest.id, true)
+}
+
+beforeEach(async () => {
+  for (const plugin of await plugins.listPlugins()) await plugins.uninstallPlugin(plugin.id)
+})
+
+test('installing a package starts disabled and not trusted', async () => {
+  const archive = packageBytes()
+  const installed = await plugins.installPlugin(archive)
+  assert.equal(installed.enabled, false)
+  assert.equal(installed.safe, false)
+  assert.deepEqual(installed.grants, { capabilities: [], domains: [] })
+  assert.equal((await plugins.listPlugins()).length, 1)
+  assert.deepEqual(await plugins.getPluginArchive(installed.id), Buffer.from(archive))
+})
+
+test('enabling an untrusted plugin or granting undeclared access is rejected', async () => {
+  await plugins.installPlugin(packageBytes())
+  await assert.rejects(plugins.setPluginEnabled('test-plugin', true), /trust|Safe/i)
+  await assert.rejects(
+    plugins.setPluginGrants('test-plugin', { capabilities: ['workspace.write'], domains: [] }),
+    /undeclared/i,
+  )
+})
+
+test('permission decisions reject malformed grant and activation values', async () => {
+  await plugins.installPlugin(packageBytes())
+  await assert.rejects(
+    plugins.setPluginGrants('test-plugin', { capabilities: 'network.request', domains: [] }),
+    /grant|capabilit/i,
+  )
+  await assert.rejects(plugins.setPluginSafe('test-plugin', 'true'), /trust|true or false/i)
+  await assert.rejects(plugins.setPluginEnabled('test-plugin', 'true'), /activation|true or false/i)
+})
+
+test('changing a manifest revokes prior trust and grants', async () => {
+  await installAndGrant()
+  const changed = { ...baseManifest, domains: ['api.example.test', 'new.example.test'] }
+  const result = await plugins.installPlugin(packageBytes(changed))
+  assert.equal(result.safe, false)
+  assert.equal(result.enabled, false)
+  assert.deepEqual(result.grants, { capabilities: [], domains: [] })
+})
+
+test('network requests require a separately granted exact domain', async () => {
+  await installAndGrant()
+  let called = false
+  await assert.rejects(
+    plugins.requestPluginNetwork('test-plugin', { url: 'https://other.example.test/data' }, {
+      fetchImpl: async () => {
+        called = true
+        return new Response('ok')
+      },
+      lookupImpl: async () => [{ address: '93.184.216.34' }],
+    }),
+    /domain|permission/i,
+  )
+  assert.equal(called, false)
+})
+
+test('network requests reject redirects instead of following them', async () => {
+  await installAndGrant()
+  await assert.rejects(
+    plugins.requestPluginNetwork('test-plugin', { url: 'https://api.example.test/data' }, {
+      fetchImpl: async () => new Response(null, { status: 302, headers: { location: 'https://other.example.test/' } }),
+      lookupImpl: async () => [{ address: '93.184.216.34' }],
+    }),
+    /redirect/i,
+  )
+})
+
+test('network responses reject executable and oversized content', async () => {
+  await installAndGrant()
+  await assert.rejects(
+    plugins.requestPluginNetwork('test-plugin', { url: 'https://api.example.test/file' }, {
+      fetchImpl: async () => new Response('alert(1)', { headers: { 'content-type': 'application/javascript' } }),
+      lookupImpl: async () => [{ address: '93.184.216.34' }],
+    }),
+    /content type/i,
+  )
+  await assert.rejects(
+    plugins.requestPluginNetwork('test-plugin', { url: 'https://api.example.test/large' }, {
+      fetchImpl: async () => new Response('x'.repeat(1_048_577), { headers: { 'content-type': 'text/plain' } }),
+      lookupImpl: async () => [{ address: '93.184.216.34' }],
+    }),
+    /large|size/i,
+  )
+})
+
+test('network requests reject private DNS results', async () => {
+  await installAndGrant()
+  await assert.rejects(
+    plugins.requestPluginNetwork('test-plugin', { url: 'https://api.example.test/data' }, {
+      fetchImpl: async () => new Response('unexpected'),
+      lookupImpl: async () => [{ address: '127.0.0.1' }],
+    }),
+    /private/i,
+  )
+})
+
+test.after(async () => {
+  await rm(dataDir, { recursive: true, force: true })
+})