fix: harden the plugin runtime after the 2.9.0 security review

src/backend/tests/database/routes/host-plugin-settings.test.ts

@@ -271,20 +271,25 @@ describe("withHostPluginSettings", () => {
 });
 
 describe("writeHostPluginSettings", () => {
-  it("JSON-stringifies each value under the plugin's own namespace", async () => {
-    await writeHostPluginSettings("docker", 7, {
+  it("writes each value through the settings service, under the plugin's own namespace", async () => {
+    await writeHostPluginSettings(DOCKER, 7, {
       enableDocker: true,
-      socketPath: null,
+      socketPath: "/var/run/docker.sock",
     });
 
     expect(setCalls).toEqual([
       ["docker", "host", "7", "enableDocker", "true"],
-      ["docker", "host", "7", "socketPath", "null"],
+      ["docker", "host", "7", "socketPath", '"/var/run/docker.sock"'],
     ]);
   });
 
+  it("refuses a key the manifest does not declare", async () => {
+    await writeHostPluginSettings(DOCKER, 7, { injected: "x" });
+    expect(setCalls).toEqual([]);
+  });
+
   it("skips a field whose value is undefined", async () => {
-    await writeHostPluginSettings("docker", 7, {
+    await writeHostPluginSettings(DOCKER, 7, {
       enableDocker: true,
       socketPath: undefined,
     });

src/backend/tests/database/routes/plugin-legacy-paths.test.ts

@@ -10,9 +10,11 @@ import request from "supertest";
 import { describe, expect, it, vi } from "vitest";
 
 const routers = vi.hoisted(() => new Map<string, express.Router>());
+const installed = vi.hoisted(() => new Set<string>());
 
 vi.mock("../../../plugins/http.js", () => ({
   getPluginRouter: (id: string) => routers.get(id),
+  isPluginInstalled: (id: string) => installed.has(id),
 }));
 
 const { mountPluginLegacyPaths } =
@@ -64,11 +66,18 @@ describe("mountPluginLegacyPaths", () => {
     });
   });
 
-  it("answers 404 while the plugin serves no router", async () => {
+  it("answers 404 for a plugin that is not installed", async () => {
     const app = appWith([{ id: "gone", legacyPaths: ["/gone/hook"] }]);
     const response = await request(app).post("/gone/hook/x");
     expect(response.status).toBe(404);
   });
+
+  it("answers 503 for an installed plugin that serves no router", async () => {
+    installed.add("paused");
+    const app = appWith([{ id: "paused", legacyPaths: ["/paused/hook"] }]);
+    const response = await request(app).post("/paused/hook/x");
+    expect(response.status).toBe(503);
+  });
 });
 
 describe("legacy redirects", () => {