@uniqbit/mate-core 0.17.2-canary.1 → 0.17.2-canary.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniqbit/mate-core",
-  "version": "0.17.2-canary.1",
+  "version": "0.17.2-canary.3",
   "description": "Core framework and plugin APIs for Mate.",
   "license": "MIT",
   "files": [

package/src/cli/commands/install.ts

@@ -166,11 +166,9 @@ export async function runInstallCommand(argv: string[], cwd = process.cwd()): Pr
       );
       if (drift.length > 0) {
         process.stderr.write(
-          `${FRAMEWORK_NAME}: plugin-generated files differ from the committed checkout: ${drift.join(", ")}\n` +
+          `${FRAMEWORK_NAME}: warning: plugin-generated files differ from the committed checkout: ${drift.join(", ")}\n` +
             `Prepare and commit them in the companion's authoring flow; the checkout was left unchanged.\n`,
         );
-        process.exitCode = 1;
-        return false;
       }
     } else {
       await reconcileInstalledCompanion(plan);

package/src/cli/commands/plugin/verify.ts

@@ -4,7 +4,7 @@ import { inspectDeclaredPlugins } from "../../../tools/setup/dynamic-plugins/ver
 
 /**
  * @command mate plugin verify
- * @description Strict, installation-free check that every plugin declared by the companion is allowed by `MATE_ALLOWED_PLUGINS`, installed, and loadable with the current environment. Exits non-zero naming each failing package. With `--json`, prints `{"capabilities": [...]}` listing the capability IDs the verified plugins provide.
+ * @description Strict, installation-free check that every plugin declared by the companion is installed, and loadable with the current environment. Exits non-zero naming each failing package. With `--json`, prints `{"capabilities": [...]}` listing the capability IDs the verified plugins provide.
  */
 export async function runPluginVerifyCommand(
   argv: string[] = [],

package/src/tools/setup/dynamic-plugins/frozen.ts

@@ -5,14 +5,8 @@ import path from "node:path";
 import type { PluginDeclaration } from "../../../lib/orchestrator/types";
 import type { NpmInstallRunner, PluginInstallResult } from "./install";
 import { dynamicPluginsWorkspaceRoot } from "./paths";
-import {
-  disallowedPluginMessage,
-  isPluginAllowed,
-  PluginPolicyError,
-  readPluginPolicy,
-} from "./policy";
-
-/** Raised before anything is installed: policy, manifest or lockfile inputs are unusable. */
+
+/** Raised before anything is installed: manifest or lockfile inputs are unusable. */
 export class FrozenInstallError extends Error {}
 
 export interface FrozenInstallDeps {
@@ -112,8 +106,7 @@ async function treeMismatches(workspaceRoot: string, lock: Lockfile): Promise<st
 
 /**
  * Deployment restore: installs exactly what the committed lockfile records.
- * Inputs are validated before npm runs — the appliance allowlist, the
- * workspace manifest against the declarations, and the lockfile against the
+ * Inputs are validated before npm runs — the workspace manifest against the declarations, and the lockfile against the
  * manifest — and neither tracked file is ever rewritten. An installed tree is
  * reused only when it matches the lockfile's versions and integrity.
  */
@@ -127,20 +120,6 @@ export async function installDeclaredPluginsFrozen(
   const desired: Record<string, string> = {};
   for (const declaration of sorted) desired[declaration.package] = declaration.version;
 
-  let policy: ReturnType<typeof readPluginPolicy>;
-  try {
-    policy = readPluginPolicy(deps.env ?? process.env);
-  } catch (error) {
-    if (error instanceof PluginPolicyError) throw new FrozenInstallError(error.message);
-    throw error;
-  }
-  const refused = sorted.filter((declaration) => !isPluginAllowed(policy, declaration.package));
-  if (refused.length > 0) {
-    throw new FrozenInstallError(
-      refused.map((declaration) => disallowedPluginMessage(declaration.package)).join("\n"),
-    );
-  }
-
   const manifestFile = path.join(workspaceRoot, "package.json");
   const lockFile = path.join(workspaceRoot, "package-lock.json");
   const [manifestText, lockText] = await Promise.all([readText(manifestFile), readText(lockFile)]);

package/src/tools/setup/dynamic-plugins/loader.ts

@@ -14,12 +14,6 @@ import {
   type PluginHost,
 } from "./host";
 import { dynamicPluginsWorkspaceRoot, pluginPackageRoot } from "./paths";
-import {
-  disallowedPluginMessage,
-  isPluginAllowed,
-  PluginPolicyError,
-  readPluginPolicy,
-} from "./policy";
 
 interface PluginManifest {
   mate?: { pluginApiVersion?: unknown };
@@ -53,16 +47,6 @@ export async function loadDynamicPlugin(
   const name = declaration.package;
   const packageRoot = pluginPackageRoot(companionPath, name);
 
-  /** Fails closed: a malformed policy allows nothing. Checked before any plugin file is touched. */
-  try {
-    if (!isPluginAllowed(readPluginPolicy(deps.env ?? process.env), name)) {
-      return { ok: false, warning: `${disallowedPluginMessage(name)}; not loaded.` };
-    }
-  } catch (error) {
-    if (!(error instanceof PluginPolicyError)) throw error;
-    return { ok: false, warning: `plugin "${name}" not loaded: ${error.message}` };
-  }
-
   let manifest: PluginManifest;
   try {
     manifest = JSON.parse(

package/src/tools/setup/dynamic-plugins/staging.ts

@@ -25,22 +25,16 @@ function changedPaths(cwd: string): string[] {
 }
 
 /**
- * Checks that what plugins would generate is already committed. The live
- * checkout must have no edits of its own; the projection then runs against a
- * disposable clone of its commit, and any file that differs afterwards is
- * drift. Nothing is written back to the live checkout. Returns the drifting
- * paths (empty when the checkout is complete).
+ * Reports what plugins would generate that is not already committed. The
+ * projection runs against a disposable clone of the checkout's commit, so edits
+ * in the live checkout neither matter nor are touched, and any file that
+ * differs afterwards is drift. Nothing is written back to the live checkout.
+ * Returns the drifting paths (empty when the commit is complete).
  */
 export async function verifyTrackedPluginOutputs(
   companionPath: string,
   project: StagedProjection,
 ): Promise<string[]> {
-  const pending = changedPaths(companionPath);
-  if (pending.length > 0) {
-    throw new TrackedOutputError(
-      `the checkout has uncommitted changes, which frozen setup will not overwrite: ${pending.join(", ")}`,
-    );
-  }
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "mate-staging-"));
   try {
     const staged = path.join(root, "companion");

package/src/tools/setup/dynamic-plugins/verify.ts

@@ -5,12 +5,6 @@ import type { PluginDeclaration } from "../../../lib/orchestrator/types";
 import { readDeclarations, validateDeclaration } from "./declarations";
 import { loadDynamicPlugin, type DynamicPluginLoadDeps } from "./loader";
 import { pluginPackageRoot } from "./paths";
-import {
-  disallowedPluginMessage,
-  isPluginAllowed,
-  PluginPolicyError,
-  readPluginPolicy,
-} from "./policy";
 
 export interface PluginVerificationFailure {
   package: string;
@@ -19,15 +13,14 @@ export interface PluginVerificationFailure {
 
 export interface PluginInspection {
   failures: PluginVerificationFailure[];
-  /** IDs of the capabilities the loaded, allowlisted plugins provide. */
+  /** IDs of the capabilities the loaded plugins provide. */
   capabilities: string[];
 }
 
 /**
- * Strict, installation-free check of every declared plugin: allowed, installed
+ * Strict, installation-free check of every declared plugin: installed
  * and loadable with the effective environment. Unlike hydration it fails
- * closed on the first-class problems ordinary commands only warn about. Only
- * allowlisted packages are imported.
+ * closed on the first-class problems ordinary commands only warn about.
  */
 export async function verifyDeclaredPlugins(
   companionPath: string,
@@ -43,14 +36,6 @@ export async function inspectDeclaredPlugins(
   const env = deps.env ?? process.env;
   const failures: PluginVerificationFailure[] = [];
   const capabilities: string[] = [];
-  let policy: ReturnType<typeof readPluginPolicy>;
-  try {
-    policy = readPluginPolicy(env);
-  } catch (error) {
-    if (!(error instanceof PluginPolicyError)) throw error;
-    return { failures: [{ package: "(allowlist)", reason: error.message }], capabilities };
-  }
-
   const declarations: PluginDeclaration[] = [];
   for (const entry of await readDeclarations(companionPath)) {
     const { declaration, error } = validateDeclaration(entry);
@@ -60,10 +45,6 @@ export async function inspectDeclaredPlugins(
 
   for (const declaration of declarations) {
     const name = declaration.package;
-    if (!isPluginAllowed(policy, name)) {
-      failures.push({ package: name, reason: disallowedPluginMessage(name) });
-      continue;
-    }
     // oxlint-disable-next-line no-await-in-loop -- declared order is part of the contract
     const installed = await fs
       .access(pluginPackageRoot(companionPath, name))

package/src/tools/setup/dynamic-plugins/policy.ts

@@ -1,55 +0,0 @@
-/** Environment variable carrying the appliance's declared-plugin package allowlist. */
-export const ALLOWED_PLUGINS_ENV = "MATE_ALLOWED_PLUGINS";
-
-/**
- * Parsed allowlist: exact package names and scope-wide `@scope/*` patterns.
- * An empty list permits no package; the policy's absence permits all.
- */
-export interface PluginPolicy {
-  exact: string[];
-  scopes: string[];
-}
-
-export class PluginPolicyError extends Error {}
-
-const EXACT_PATTERN = /^(@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
-const SCOPE_PATTERN = /^@[a-z0-9][a-z0-9._~-]*\/\*$/;
-
-/**
- * Parses a comma-separated allowlist. `undefined` means no policy; an empty
- * or blank string is an explicit empty policy. Malformed entries throw so a
- * typo can never widen or silently narrow the trust decision.
- */
-export function parseAllowedPlugins(raw: string | undefined): PluginPolicy | null {
-  if (raw === undefined) return null;
-  const policy: PluginPolicy = { exact: [], scopes: [] };
-  if (raw.trim() === "") return policy;
-  for (const part of raw.split(",")) {
-    const entry = part.trim();
-    if (SCOPE_PATTERN.test(entry)) policy.scopes.push(entry.slice(0, entry.indexOf("/") + 1));
-    else if (EXACT_PATTERN.test(entry)) policy.exact.push(entry);
-    else {
-      throw new PluginPolicyError(
-        `${ALLOWED_PLUGINS_ENV}: malformed entry ${JSON.stringify(entry)}; expected an exact package name or a scope pattern such as "@acme/*"`,
-      );
-    }
-  }
-  return policy;
-}
-
-/** Reads the effective policy from an environment; throws on a malformed value. */
-export function readPluginPolicy(
-  env: Record<string, string | undefined> = process.env,
-): PluginPolicy | null {
-  return parseAllowedPlugins(env[ALLOWED_PLUGINS_ENV]);
-}
-
-export function isPluginAllowed(policy: PluginPolicy | null, packageName: string): boolean {
-  if (policy === null) return true;
-  if (policy.exact.includes(packageName)) return true;
-  return policy.scopes.some((scope) => packageName.startsWith(scope));
-}
-
-export function disallowedPluginMessage(packageName: string): string {
-  return `plugin "${packageName}" is not allowed by ${ALLOWED_PLUGINS_ENV}`;
-}