beatrina 0.8.7 → 0.9.43

package/failsafe/plugins.R

@@ -16,8 +16,8 @@
 #
 # ── where plugins live: three layers, like .libPaths() ──────────────────────
 #
-#   user     R_user_dir("carmar","data")/plugins/<kind>/<id>/   the person's own; the ONLY layer written
-#   system   $CARMAR_PLUGIN_DIR/<kind>/<id>/                     an administrator's set, read-only
+#   user     R_user_dir("beatrina","data")/plugins/<kind>/<id>/   the person's own; the ONLY layer written
+#   system   $BEATRINA_PLUGIN_DIR/<kind>/<id>/                     an administrator's set, read-only
 #   shipped  <kernel>/plugins/<kind>/<id>/                       what the kernel came with, read-only
 #
 # Searched in that order; the first OK copy of an id wins ("active"), so a
@@ -48,18 +48,18 @@
 #
 # ── the administrator's policy ───────────────────────────────────────────────
 #
-#   CARMAR_PLUGIN_POLICY=/etc/carmar/plugin-policy.json   the file (wins where both are set)
-#   CARMAR_PLUGIN_DIR=/opt/carmar/plugins                  the system layer
-#   CARMAR_PLUGIN_INSTALL=user|none                        may the person install? (default user)
-#   CARMAR_PLUGIN_SOURCES=host,host|none                   hosts a URL/registry install may fetch from
-#   CARMAR_PLUGIN_KINDS=csl,theme                          which kinds exist at all
+#   BEATRINA_PLUGIN_POLICY=/etc/beatrina/plugin-policy.json   the file (wins where both are set)
+#   BEATRINA_PLUGIN_DIR=/opt/beatrina/plugins                  the system layer
+#   BEATRINA_PLUGIN_INSTALL=user|none                        may the person install? (default user)
+#   BEATRINA_PLUGIN_SOURCES=host,host|none                   hosts a URL/registry install may fetch from
+#   BEATRINA_PLUGIN_KINDS=csl,theme                          which kinds exist at all
 #
 # Same doctrine as ai-policy.R: the honest scope is the feature. The kernel
 # owns every fetch and every write here, so unlike an AI policy this one is
 # ENFORCEMENT — a host not on the list is never contacted, `install: none`
 # means the user layer is neither written nor read. And the three-state rule
 # holds: a policy that names nothing permits everything; one that names only
-# junk is a startup error, never a silent "all". `carmar_plugin_policy()` is
+# junk is a startup error, never a silent "all". `beatrina_plugin_policy()` is
 # pure; serve.R joins its `errors` to the startup gate.
 #
 # Nothing here runs at start. The kernel lists folders when asked; nothing is
@@ -72,8 +72,8 @@ PLUGIN_FILE_RE <- "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
 PLUGIN_MANIFEST <- "plugin.json"
 PLUGIN_MANIFEST_MAX_BYTES <- 65536L
 PLUGIN_FETCH_TIMEOUT_S <- 20L
-PLUGIN_POLICY_DEFAULT_FILE <- "/etc/carmar/plugin-policy.json"
-PLUGIN_SYSTEM_DEFAULT_DIR <- "/etc/carmar/plugins"
+PLUGIN_POLICY_DEFAULT_FILE <- "/etc/beatrina/plugin-policy.json"
+PLUGIN_SYSTEM_DEFAULT_DIR <- "/etc/beatrina/plugins"
 
 # THIS LIST IS A CROSS-LANGUAGE CONTRACT with `EDITOR_TOKENS` in
 # lib/editor-themes.js; test/plugins.test.mjs reads both and fails if they
@@ -114,7 +114,7 @@ LATEX_PREAMBLE_MAX_CHARS <- 400L
 # WHY THIS ROW HAS A DENY-LIST AND THE OTHER TWO DO NOT.
 #
 # A CSL style is XML pandoc parses; it cannot call anything. A theme is a map
-# of colours. A LaTeX preamble is CODE — not code CarmaR runs (the kernel
+# of colours. A LaTeX preamble is CODE — not code Beatrina runs (the kernel
 # never compiles a .tex; latex.js only writes one) but code the AUTHOR'S TeX
 # engine runs when they build the paper. That is a weaker guarantee than the
 # other two rows make, and it is written here rather than left to be inherited
@@ -319,8 +319,8 @@ plugin_default_hosts <- function() {
 #' Read the administrator's plugin policy.
 #'
 #' @param env a getter with `Sys.getenv`'s signature; injected for tests.
-#' @param default_file the file read when CARMAR_PLUGIN_POLICY is unset, if it exists.
-#' @param default_dir the system layer when CARMAR_PLUGIN_DIR is unset, if it exists.
+#' @param default_file the file read when BEATRINA_PLUGIN_POLICY is unset, if it exists.
+#' @param default_dir the system layer when BEATRINA_PLUGIN_DIR is unset, if it exists.
 #' @return list(set, source, install, sources, network, kinds, unknown, note,
 #'   system_dir, errors). `kinds` is the permitted kinds — every kind when
 #'   unset. `sources` is the permitted hosts; `network` FALSE when none may
@@ -329,7 +329,7 @@ plugin_default_hosts <- function() {
 #'   Three states, as in ai-policy.R: names nothing → everything; names
 #'   something valid → exactly that; names ONLY junk → an error, because an
 #'   empty allow-list that fails open is the bug the AI policy suite caught.
-carmar_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_DEFAULT_FILE,
+beatrina_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_DEFAULT_FILE,
                                  default_dir = PLUGIN_SYSTEM_DEFAULT_DIR) {
   errors <- character(0)
   source <- ""
@@ -337,19 +337,19 @@ carmar_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_
   sources_raw <- NULL
   kinds_raw <- NULL
   note <- ""
-  system_dir <- trimws(env("CARMAR_PLUGIN_DIR", ""))
+  system_dir <- trimws(env("BEATRINA_PLUGIN_DIR", ""))
   if (!nzchar(system_dir) && nzchar(default_dir) && dir.exists(default_dir)) system_dir <- default_dir
 
-  path <- trimws(env("CARMAR_PLUGIN_POLICY", ""))
+  path <- trimws(env("BEATRINA_PLUGIN_POLICY", ""))
   if (!nzchar(path) && nzchar(default_file) && file.exists(default_file)) path <- default_file
   if (nzchar(path)) {
     source <- path
     if (!file.exists(path)) {
-      errors <- c(errors, paste0("CARMAR_PLUGIN_POLICY names a file that does not exist: ", path))
+      errors <- c(errors, paste0("BEATRINA_PLUGIN_POLICY names a file that does not exist: ", path))
     } else {
       doc <- tryCatch(jsonlite::fromJSON(path, simplifyVector = TRUE), error = function(e) e)
       if (inherits(doc, "error")) {
-        errors <- c(errors, paste0("CARMAR_PLUGIN_POLICY is not valid JSON: ", conditionMessage(doc)))
+        errors <- c(errors, paste0("BEATRINA_PLUGIN_POLICY is not valid JSON: ", conditionMessage(doc)))
       } else {
         install <- trimws(as.character(doc$install %||% "")[1] %||% "")
         if (!is.null(doc$sources)) sources_raw <- as.character(unlist(doc$sources))
@@ -362,9 +362,9 @@ carmar_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_
       }
     }
   } else {
-    if (nzchar(env("CARMAR_PLUGIN_INSTALL", ""))) { source <- "env"; install <- trimws(env("CARMAR_PLUGIN_INSTALL", "")) }
-    if (nzchar(env("CARMAR_PLUGIN_SOURCES", ""))) { source <- "env"; sources_raw <- policy_split(env("CARMAR_PLUGIN_SOURCES", "")) }
-    if (nzchar(env("CARMAR_PLUGIN_KINDS", ""))) { source <- "env"; kinds_raw <- policy_split(env("CARMAR_PLUGIN_KINDS", "")) }
+    if (nzchar(env("BEATRINA_PLUGIN_INSTALL", ""))) { source <- "env"; install <- trimws(env("BEATRINA_PLUGIN_INSTALL", "")) }
+    if (nzchar(env("BEATRINA_PLUGIN_SOURCES", ""))) { source <- "env"; sources_raw <- policy_split(env("BEATRINA_PLUGIN_SOURCES", "")) }
+    if (nzchar(env("BEATRINA_PLUGIN_KINDS", ""))) { source <- "env"; kinds_raw <- policy_split(env("BEATRINA_PLUGIN_KINDS", "")) }
   }
 
   if (!nzchar(install)) install <- "user"
@@ -417,17 +417,17 @@ carmar_plugin_policy <- function(env = Sys.getenv, default_file = PLUGIN_POLICY_
 #' The sentence shown when the policy refuses something.
 plugin_policy_reason <- function(policy, what = "install") {
   base <- switch(what,
-    install = "This CarmaR is configured so that plugins are not installed by users; the set is fixed by the deployment.",
-    network = "This CarmaR is configured to fetch no plugins from the network; a plugin arrives as a file.",
-    host = sprintf("This CarmaR is configured to fetch plugins only from: %s.", paste(policy$sources, collapse = ", ")),
-    kind = "This CarmaR is configured without that plugin kind.",
-    "This CarmaR's plugin policy refuses that.")
+    install = "This Beatrina is configured so that plugins are not installed by users; the set is fixed by the deployment.",
+    network = "This Beatrina is configured to fetch no plugins from the network; a plugin arrives as a file.",
+    host = sprintf("This Beatrina is configured to fetch plugins only from: %s.", paste(policy$sources, collapse = ", ")),
+    kind = "This Beatrina is configured without that plugin kind.",
+    "This Beatrina's plugin policy refuses that.")
   if (nzchar(policy$note)) paste(base, policy$note) else base
 }
 
 # ── layers and paths ─────────────────────────────────────────────────────────
 
-plugin_user_dir <- function() file.path(tools::R_user_dir("carmar", "data"), "plugins")
+plugin_user_dir <- function() file.path(tools::R_user_dir("beatrina", "data"), "plugins")
 
 #' The layers, in precedence order. The user layer is absent under
 #' `install: none` — not read-only, ABSENT, because "the set is fixed by the