chainlesschain 0.165.5 → 0.165.8

package/src/commands/plugin.js

@@ -258,7 +258,8 @@ async function buildRegistrySetSelection(
     caFile,
   } = {},
 ) {
-  const { fetchRegistry, resolveRegistryToken } =
+  const managedPolicy = loadPluginManagedPolicy();
+  const { authorizeRegistryPluginEntry, fetchRegistry, resolveRegistryToken } =
     await import("../lib/plugin-runtime/remote-source.js");
   const {
     buildPluginMarketplaceCatalog,
@@ -281,6 +282,8 @@ async function buildRegistrySetSelection(
         const resolvedToken = resolveRegistryToken(url, { token, config });
         const resolved = await fetchRegistry(url, {
           token: resolvedToken,
+          config,
+          managedPolicy,
           allowInsecure,
           offline,
           expectedSha256: registryDigestPins.get(url),
@@ -301,6 +304,41 @@ async function buildRegistrySetSelection(
     }),
   );
   const { VERSION } = await import("../constants.js");
+  // Select and authorize the highest-ranked candidate before inspecting the
+  // installed-plugin tree. Installed versions affect dependency diagnostics,
+  // but never candidate ordering; a blocked resolved source must therefore
+  // fail before any project/user plugin filesystem access.
+  const preliminaryCatalog = buildPluginMarketplaceCatalog({
+    sources,
+    installed: {},
+    hostVersion: VERSION,
+    strict,
+  });
+  const preliminarySelection = buildPluginMarketplaceCandidateSelection({
+    catalog: preliminaryCatalog,
+    name,
+  });
+  if (!preliminarySelection.selected) {
+    return {
+      catalog: preliminaryCatalog,
+      selection: preliminarySelection,
+      preflight: null,
+      resolved: null,
+    };
+  }
+  const sourceIndex = preliminarySelection.selected.registry.priority;
+  const entryIndex = preliminarySelection.selected.registry.entryIndex;
+  const source = sources[sourceIndex];
+  const entry = source?.registry?.plugins?.[entryIndex];
+  if (!entry || entry.name !== preliminarySelection.selected.name) {
+    throw new Error(
+      "selected registry entry no longer matches catalog authority",
+    );
+  }
+  const authorized = authorizeRegistryPluginEntry(source.registry, entry, {
+    registryUrl: registryUrls[sourceIndex],
+    cwd,
+  });
   const catalog = buildPluginMarketplaceCatalog({
     sources,
     installed: await discoverInstalledPluginVersions(cwd),
@@ -311,31 +349,23 @@ async function buildRegistrySetSelection(
     catalog,
     name,
   });
-  if (!selection.selected) {
-    return { catalog, selection, preflight: null, resolved: null };
+  if (
+    selection.selected?.registry.priority !== sourceIndex ||
+    selection.selected?.registry.entryIndex !== entryIndex
+  ) {
+    throw new Error("selected registry entry changed during local preflight");
   }
   const preflight = buildPluginMarketplaceInstallPreflightFromSelection({
     catalog,
     selection,
   }).preflight;
-  const sourceIndex = selection.selected.registry.priority;
-  const entryIndex = selection.selected.registry.entryIndex;
-  const source = sources[sourceIndex];
-  const entry = source?.registry?.plugins?.[entryIndex];
-  if (!entry || entry.name !== selection.selected.name) {
-    throw new Error(
-      "selected registry entry no longer matches catalog authority",
-    );
-  }
   return {
     catalog,
     selection,
     preflight,
     resolved: {
       registryUrl: registryUrls[sourceIndex],
-      source: entry.ref ? `${entry.source}#${entry.ref}` : entry.source,
-      ref: entry.ref || null,
-      sha256: entry.sha256 || null,
+      ...authorized,
       entry,
       fromCache: source.fromCache === true,
       documentSha256: source.documentSha256 || null,
@@ -344,6 +374,61 @@ async function buildRegistrySetSelection(
   };
 }
 
+async function materializeRegistrySelection(
+  url,
+  resolved,
+  options,
+  marketplacePreflight,
+) {
+  const {
+    inspectRegistryEntrySource,
+    resolveRegistryEntrySource,
+    resolveRegistryToken,
+  } = await import("../lib/plugin-runtime/remote-source.js");
+  const inspected = inspectRegistryEntrySource(resolved.entry);
+  const expectedType = marketplacePreflight.package?.type || "git";
+  const sourceAuthority = (value) => {
+    try {
+      const parsed = new URL(String(value));
+      parsed.username = "";
+      parsed.password = "";
+      parsed.search = "";
+      parsed.hash = "";
+      return parsed.toString();
+    } catch {
+      return value;
+    }
+  };
+  if (
+    inspected.sourceType !== resolved.sourceType ||
+    inspected.sourceIdentity !== resolved.sourceIdentity ||
+    inspected.ref !== resolved.ref ||
+    inspected.sourceType !== expectedType ||
+    sourceAuthority(inspected.sourceIdentity) !==
+      marketplacePreflight.package?.source ||
+    inspected.ref !== (marketplacePreflight.package?.ref || null) ||
+    (inspected.sourceType === "archive" &&
+      inspected.archiveSpec.sha256 !==
+        marketplacePreflight.package?.archiveSha256) ||
+    (inspected.sourceType === "command" &&
+      inspected.commandSpec.mode !== marketplacePreflight.package?.mode)
+  ) {
+    throw new Error(
+      "registry candidate preflight revision changed before source fetch",
+    );
+  }
+  if (!["archive", "command"].includes(resolved.sourceType)) return resolved;
+  const config = await loadOptionalPluginConfig();
+  const materialized = await resolveRegistryEntrySource(url, resolved.entry, {
+    registryResolutionAuthority: resolved.registryResolutionAuthority,
+    token: resolveRegistryToken(url, { token: options.token, config }),
+    allowInsecure: options.allowInsecureRegistry === true,
+    offline: options.offline === true,
+    ...registryNetworkOptions(options),
+  });
+  return { ...resolved, ...materialized };
+}
+
 async function buildRegistryInstallPreflight(url, resolved, cwd) {
   const { VERSION } = await import("../constants.js");
   const { buildPluginMarketplaceInstallPreflight } =
@@ -364,6 +449,8 @@ function catalogAuthorityFromPreflight(
   preflight,
   impact = null,
   remoteArtifactEvidence = null,
+  archiveSource = null,
+  commandSource = null,
 ) {
   return {
     catalogDigest: preflight.catalogDigest,
@@ -417,6 +504,8 @@ function catalogAuthorityFromPreflight(
       : {}),
     ...(impact ? { updateImpactDigest: impact.impactDigest } : {}),
     ...(remoteArtifactEvidence ? { remoteArtifactEvidence } : {}),
+    ...(archiveSource ? { archiveSource } : {}),
+    ...(commandSource ? { commandSource } : {}),
   };
 }
 
@@ -475,6 +564,10 @@ async function installedCatalogAuthorityMatches(
       (!remoteArtifactEvidence ||
         authority?.remoteArtifactEvidence?.evidenceDigest ===
           remoteArtifactEvidence.evidenceDigest) &&
+      (preflight.package?.type !== "archive" ||
+        (authority?.archiveSource?.url === preflight.package.source &&
+          authority?.archiveSource?.archiveSha256 ===
+            preflight.package.archiveSha256)) &&
       remoteSbomComparisonAuthorityMatches(
         authority,
         remoteArtifactEvidence,
@@ -1582,6 +1675,9 @@ export function registerPluginCommand(program) {
       let marketplaceImpact = null;
       let remoteArtifactRequest = null;
       let remoteArtifacts = null;
+      let archiveSourceAuthority = null;
+      let commandSourceAuthority = null;
+      let registryResolutionAuthority = null;
       const registryUrls = normalizeRegistryUrls(options.registry);
       const { isRemoteSource, resolveRemoteSource } =
         await import("../lib/plugin-runtime/remote-source.js");
@@ -1643,6 +1739,7 @@ export function registerPluginCommand(program) {
               allowInsecure: options.allowInsecureRegistry === true,
               offline: options.offline === true,
               expectedSha256: registryDigestPins.get(url),
+              materialize: false,
               ...registryNetworkOptions(options),
             });
             marketplacePreflight = await buildRegistryInstallPreflight(
@@ -1651,7 +1748,8 @@ export function registerPluginCommand(program) {
               process.cwd(),
             );
           }
-          installSource = resolved.source;
+          registryResolutionAuthority =
+            resolved.registryResolutionAuthority || null;
           integritySha = resolved.sha256;
           if (registryManifestDigestConflict(integritySha, options.sha256)) {
             throw new Error(
@@ -1708,6 +1806,17 @@ export function registerPluginCommand(program) {
               "registry candidate preflight blocked: VERSION_DOWNGRADE_APPROVAL_REQUIRED; pass --allow-downgrade after reviewing cc plugin impact",
             );
           }
+          resolved = await materializeRegistrySelection(
+            url,
+            resolved,
+            options,
+            marketplacePreflight,
+          );
+          installSource = resolved.source;
+          archiveSourceAuthority = resolved.archiveAuthority || null;
+          commandSourceAuthority = resolved.commandAuthority || null;
+          registryResolutionAuthority =
+            resolved.registryResolutionAuthority || registryResolutionAuthority;
           expectedIdentity = {
             name:
               typeof resolved.entry.name === "string"
@@ -1728,16 +1837,15 @@ export function registerPluginCommand(program) {
             source: url,
             registry: url,
             package: name || source,
-            resolvedSource: resolved.source,
-            ref:
-              (typeof resolved.source === "string" &&
-                resolved.source.includes("#") &&
-                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
-              null,
+            resolvedSource: resolved.sourceIdentity || resolved.source,
+            ref: resolved.ref || null,
             offline: resolved.fromCache === true,
             catalogAuthority: catalogAuthorityFromPreflight(
               marketplacePreflight,
               marketplaceImpact,
+              null,
+              archiveSourceAuthority,
+              commandSourceAuthority,
             ),
           };
           if (resolved.fromCache) {
@@ -1790,6 +1898,8 @@ export function registerPluginCommand(program) {
               marketplacePreflight,
               marketplaceImpact,
               remoteArtifacts.authority,
+              archiveSourceAuthority,
+              commandSourceAuthority,
             );
           }
         }
@@ -1841,6 +1951,7 @@ export function registerPluginCommand(program) {
           sourceMetadata,
           expectedIdentity,
           managedPolicy: managed,
+          registryResolutionAuthority,
           policySource: sourceMetadata?.registry || source,
           remoteSbomBytes: remoteArtifacts?.sbomBytes || null,
           offline: options.offline === true,
@@ -2036,6 +2147,7 @@ export function registerPluginCommand(program) {
           options.registry,
           {
             token,
+            config,
             allowInsecure: options.allowInsecureRegistry === true,
             offline: options.offline === true,
             expectedSha256: registryDigestPins.get(options.registry),
@@ -2177,6 +2289,7 @@ export function registerPluginCommand(program) {
             });
             const resolved = await fetchRegistry(url, {
               token,
+              config,
               allowInsecure: options.allowInsecureRegistry === true,
               offline: options.offline === true,
               expectedSha256: registryDigestPins.get(url),
@@ -3330,6 +3443,9 @@ export function registerPluginCommand(program) {
       let marketplaceImpact = null;
       let remoteArtifactRequest = null;
       let remoteArtifacts = null;
+      let archiveSourceAuthority = null;
+      let commandSourceAuthority = null;
+      let registryResolutionAuthority = null;
       const registryUrls = normalizeRegistryUrls(options.registry);
       const { isRemoteSource, resolveRemoteSource } =
         await import("../lib/plugin-runtime/remote-source.js");
@@ -3391,6 +3507,7 @@ export function registerPluginCommand(program) {
               allowInsecure: options.allowInsecureRegistry === true,
               offline: options.offline === true,
               expectedSha256: registryDigestPins.get(url),
+              materialize: false,
               ...registryNetworkOptions(options),
             });
             marketplacePreflight = await buildRegistryInstallPreflight(
@@ -3399,7 +3516,8 @@ export function registerPluginCommand(program) {
               process.cwd(),
             );
           }
-          installSource = resolved.source;
+          registryResolutionAuthority =
+            resolved.registryResolutionAuthority || null;
           integritySha = resolved.sha256;
           if (registryManifestDigestConflict(integritySha, options.sha256)) {
             throw new Error(
@@ -3472,6 +3590,17 @@ export function registerPluginCommand(program) {
               `registry candidate preflight blocked: UPDATE_IMPACT_DIGEST_MISMATCH (expected ${options.expectedImpactDigest}, actual ${marketplaceImpact.impactDigest})`,
             );
           }
+          resolved = await materializeRegistrySelection(
+            url,
+            resolved,
+            options,
+            marketplacePreflight,
+          );
+          installSource = resolved.source;
+          archiveSourceAuthority = resolved.archiveAuthority || null;
+          commandSourceAuthority = resolved.commandAuthority || null;
+          registryResolutionAuthority =
+            resolved.registryResolutionAuthority || registryResolutionAuthority;
           expectedIdentity = {
             name:
               typeof resolved.entry.name === "string"
@@ -3492,16 +3621,15 @@ export function registerPluginCommand(program) {
             source: url,
             registry: url,
             package: name || source,
-            resolvedSource: resolved.source,
-            ref:
-              (typeof resolved.source === "string" &&
-                resolved.source.includes("#") &&
-                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
-              null,
+            resolvedSource: resolved.sourceIdentity || resolved.source,
+            ref: resolved.ref || null,
             offline: resolved.fromCache === true,
             catalogAuthority: catalogAuthorityFromPreflight(
               marketplacePreflight,
               marketplaceImpact,
+              null,
+              archiveSourceAuthority,
+              commandSourceAuthority,
             ),
           };
           if (resolved.fromCache && !options.json) {
@@ -3554,6 +3682,8 @@ export function registerPluginCommand(program) {
               marketplacePreflight,
               marketplaceImpact,
               remoteArtifacts.authority,
+              archiveSourceAuthority,
+              commandSourceAuthority,
             );
           }
         }
@@ -3603,6 +3733,7 @@ export function registerPluginCommand(program) {
           sourceMetadata,
           expectedIdentity,
           managedPolicy: managed,
+          registryResolutionAuthority,
           policySource: sourceMetadata?.registry || source,
           remoteSbomBytes: remoteArtifacts?.sbomBytes || null,
           offline: options.offline === true,