Commit Graph
10 Commits
Author SHA1 Message Date
LukeGus 80944301dd feat: harden plugin api for separate repos, signed updates and generic external login 2026-09-29 18:11:59 -05:00
LukeGus 2961297989 chore: lock the plugin boundary and remove 2.9.0 leftovers 2026-09-25 07:24:46 -05:00
LukeGus cc15559ea1 feat: namespace plugin permissions and keep them valid when a plugin is off 2026-09-22 17:30:00 -05:00
LukeGus 4758016f41 feat: collapse plugin runtime to one tier behind a plugin SDK 2026-09-22 14:11:50 -05:00
LukeGus 76b2e5739a feat: wire remote-desktop plugin into core and rename i18n keys
Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.
2026-09-21 20:26:09 -05:00
LukeGus 9db66d5780 feat: add cross-plugin secret references gated by the provider's RBAC permission 2026-09-21 17:09:28 -05:00
LukeGus 2d6c1cdecb feat: add a permission-gated UI action registry and action slots for plugins
Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal
plugin offers and the ai plugin fills, gated on ai.services.use.
2026-09-21 16:56:15 -05:00
LukeGus 225f618337 feat: add a permission-gated backend service registry for plugins 2026-09-21 16:23:00 -05:00
LukeGus c94a453f1e feat: ship the ssh terminal as a first-party in-process plugin
Adds a hardcoded process:transport-owner tier so the terminal can own its
WebSocket server and ssh2 clients, which cannot cross the worker boundary.
2026-09-21 08:28:50 -05:00
LukeGus 0a771c9600 feat: add plugin loader with manifest validation and crash restart
Validates an unpacked plugin, spawns a worker_threads worker and manages
activate/deactivate/crash-restart with backoff, disabling after three
tries.

The crash counter clears only after a plugin stays up past a stability
window, not on activation. Clearing it on activation let a plugin that
activates cleanly and then dies restart forever, because every attempt
looked like the first.

loader.ts documents what the worker boundary does and does not buy you.
Node's permission model is process-wide, not per-worker, so it cannot be
enabled for plugin workers alone and is not claimed here.
2026-09-21 07:19:01 -05:00