@droposs/plugin-cli 0.6.1 → 0.6.3

package/dist/signer.d.ts

@@ -1,4 +1,4 @@
-import { SIGNATURE_VERSION } from "@drop-oss/plugin-sdk";
+import { SIGNATURE_VERSION, type PluginManifest } from "@drop-oss/plugin-sdk";
 /** Current signature scheme; re-exported for backwards compatibility. */
 export { SIGNATURE_VERSION };
 /**
@@ -39,6 +39,13 @@ export interface VerifyResult {
 export declare function verifyPlugin(targetDir: string, signingKey?: string, options?: {
     allowUnsigned?: boolean;
 }): Promise<VerifyResult>;
+/**
+ * Validate the `client.sidecars` declaration against the bundle contents:
+ * each target path must resolve inside the bundle, point to a present regular
+ * file covered by the `files` checksums, and cite a matching SHA-256 of the
+ * binary. Every sidecar name must be allowlisted in `client.commands`, and
+ */
+export declare function verifySidecars(bundleDir: string, manifest: PluginManifest & Record<string, unknown>, files: string[], present: Set<string>, errors: string[]): Promise<void>;
 export declare function packPlugin(targetDir: string, outputDir?: string): Promise<{
     packagePath: string;
     id: string;

package/dist/signer.js

@@ -91,7 +91,6 @@ let cachedErrors = [];
 export async function validateManifest(manifest) {
     if (!cachedValidator) {
         const schema = await loadSchema();
-        // @ts-ignore
         const AjvClass = Ajv.default ?? Ajv;
         const ajv = new AjvClass({ allErrors: true, strict: false });
         const compiled = ajv.compile(schema);
@@ -189,6 +188,13 @@ export async function signPlugin(targetDir, signingKey, validate = true, options
         if (!validation.valid) {
             throw new Error(`Manifest validation failed against schema:\n  ${validation.errors.join("\n  ")}`);
         }
+        const files = await listFiles(bundleDir);
+        const present = new Set(files);
+        const sidecarErrors = [];
+        await verifySidecars(bundleDir, manifest, files, present, sidecarErrors);
+        if (sidecarErrors.length > 0) {
+            throw new Error(`Sidecar validation failed:\n  ${sidecarErrors.join("\n  ")}`);
+        }
     }
     const derived = await deriveManifest(bundleDir, manifest, signingKey);
     const outPath = options.outManifest
@@ -246,6 +252,7 @@ export async function verifyPlugin(targetDir, signingKey, options = {}) {
         errors.push("bundle contains multiple code files but no 'files' checksums; refusing unverified imports");
     }
     const entry = manifest.entry ?? manifest.server?.entry ?? manifest.client?.entry;
+    await verifySidecars(bundleDir, manifest, files, present, errors);
     if (entry) {
         const entryPath = path.resolve(bundleDir, entry);
         if (!isInside(bundleDir, entryPath)) {
@@ -320,6 +327,72 @@ async function resolveSignedPayload(bundleDir, manifest, filesAggregate, entry)
         error: "legacy signature has neither file checksums nor an entry checksum",
     };
 }
+/**
+ * Validate the `client.sidecars` declaration against the bundle contents:
+ * each target path must resolve inside the bundle, point to a present regular
+ * file covered by the `files` checksums, and cite a matching SHA-256 of the
+ * binary. Every sidecar name must be allowlisted in `client.commands`, and
+ */
+export async function verifySidecars(bundleDir, manifest, files, present, errors) {
+    const sidecars = manifest.client?.sidecars;
+    if (sidecars === undefined)
+        return;
+    if (!Array.isArray(sidecars) || sidecars.length === 0) {
+        errors.push("client.sidecars must be a non-empty array when declared");
+        return;
+    }
+    const commands = new Set(Array.isArray(manifest.client?.commands) ? manifest.client.commands : []);
+    for (const [idx, sidecar] of sidecars.entries()) {
+        const label = `client.sidecars[${idx}]`;
+        if (typeof sidecar !== "object" ||
+            sidecar === null ||
+            typeof sidecar.name !== "string" ||
+            !Array.isArray(sidecar.targets)) {
+            errors.push(`${label}: expected { name: string, targets: array }`);
+            continue;
+        }
+        const { name, targets } = sidecar;
+        if (!commands.has(name)) {
+            errors.push(`${label}: sidecar name '${name}' must be allowlisted in client.commands`);
+        }
+        const seenTargets = new Set();
+        for (const [tIdx, target] of targets.entries()) {
+            const tLabel = `${label}.targets[${tIdx}]`;
+            if (!target || typeof target !== "object") {
+                errors.push(`${tLabel}: expected target object`);
+                continue;
+            }
+            if (typeof target.os !== "string" || typeof target.arch !== "string") {
+                errors.push(`${tLabel}: expected string os and arch`);
+                continue;
+            }
+            const key = `${target.os}-${target.arch}`;
+            if (seenTargets.has(key)) {
+                errors.push(`${tLabel}: duplicate target '${key}' (only one binary per os+arch for sidecar '${name}')`);
+                continue;
+            }
+            seenTargets.add(key);
+            if (typeof target.path !== "string" ||
+                path.isAbsolute(target.path) ||
+                !isInside(bundleDir, path.resolve(bundleDir, target.path))) {
+                errors.push(`${tLabel}: path must be a bundle-relative path`);
+                continue;
+            }
+            if (isBundleCodeFile(target.path)) {
+                errors.push(`${tLabel}: 'sidecars' paths must not be JavaScript code files`);
+                continue;
+            }
+            if (!present.has(target.path)) {
+                errors.push(`${tLabel}: declared sidecar file missing: ${target.path}`);
+                continue;
+            }
+            const digest = sha256Hex(await readFile(path.join(bundleDir, target.path)));
+            if (target.sha256 !== digest) {
+                errors.push(`${tLabel}: sha256 mismatch for ${target.path} (declared ${target.sha256}, actual ${digest})`);
+            }
+        }
+    }
+}
 export async function packPlugin(targetDir, outputDir) {
     const resolvedPath = path.resolve(process.cwd(), targetDir);
     const bundleDir = await realpath(resolvedPath).catch(() => null);
@@ -332,6 +405,13 @@ export async function packPlugin(targetDir, outputDir) {
     if (!validation.valid) {
         throw new Error(`Manifest validation failed against schema:\n  ${validation.errors.join("\n  ")}`);
     }
+    const files = await listFiles(bundleDir);
+    const present = new Set(files);
+    const sidecarErrors = [];
+    await verifySidecars(bundleDir, rawManifest, files, present, sidecarErrors);
+    if (sidecarErrors.length > 0) {
+        throw new Error(`Sidecar validation failed:\n  ${sidecarErrors.join("\n  ")}`);
+    }
     // Derive the signed manifest in memory: packing must not dirty the source
     // tree, the derived fields live in the archive only.
     const { manifest } = await deriveManifest(bundleDir, rawManifest);
@@ -344,7 +424,6 @@ export async function packPlugin(targetDir, outputDir) {
         ? path.resolve(process.cwd(), outputDir)
         : path.join(bundleDir, "dist-package");
     await mkdir(outDir, { recursive: true });
-    const files = await listFiles(bundleDir);
     const bundleMap = {};
     for (const rel of files) {
         const content = await readFile(path.join(bundleDir, rel));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droposs/plugin-cli",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Drop Plugin build, test, signing, and packaging CLI for Drop OSS",
   "type": "module",
   "bin": {
@@ -50,6 +50,6 @@
   "dependencies": {
     "ajv": "^8.20.0",
     "esbuild": "^0.28.2",
-    "@droposs/plugin-sdk": "0.6.1"
+    "@droposs/plugin-sdk": "0.6.3"
   }
 }