SBDeveloper/medley

Watch

Fork 0

Plugin API: capability enforcement and secret isolation #19

New issue

Closed

opened 2026-10-06 21:16:47 +02:00 by SBDeveloper · 1 comment

SBDeveloper commented

2026-10-06 21:16:47 +02:00

Owner

Part of #13

What to build

The host denies any capability a Plugin did not declare or the user did not consent to. Secrets like the ARL never leave the owning Plugin. A misbehaving Plugin is isolated from the player. Consent is re-asked if an update requests more capabilities.

Acceptance criteria

Undeclared or unconsented capability calls are denied
One Plugin cannot read another's secrets
A trapping or runaway Plugin does not crash the player
Re-consent on capability growth
Core integration tests

Blocked by

Part of #13 ## What to build The host denies any capability a Plugin did not declare or the user did not consent to. Secrets like the ARL never leave the owning Plugin. A misbehaving Plugin is isolated from the player. Consent is re-asked if an update requests more capabilities. ## Acceptance criteria - [ ] Undeclared or unconsented capability calls are denied - [ ] One Plugin cannot read another's secrets - [ ] A trapping or runaway Plugin does not crash the player - [ ] Re-consent on capability growth - [ ] Core integration tests ## Blocked by - #18

SBDeveloper added the

ready-for-agent

label

2026-10-06 21:16:47 +02:00

SBDeveloper added a new dependency

2026-10-06 21:17:04 +02:00

#18 Plugin API: install from .zip with capability consent

SBDeveloper added a new dependency

2026-10-06 21:17:05 +02:00

#21 Plugin API: third-party DSP and playback events

SBDeveloper referenced this issue

2026-10-06 21:17:05 +02:00

Plugin API: third-party DSP and playback events #21

SBDeveloper added a new dependency

2026-10-06 21:17:07 +02:00

#25 Social: Discord rich presence Plugin

SBDeveloper referenced this issue

2026-10-06 21:17:08 +02:00

Social: Discord rich presence Plugin #25

SBDeveloper added a new dependency

2026-10-06 21:17:08 +02:00

#26 Social: scrobbling Plugin

SBDeveloper referenced this issue

2026-10-06 21:17:08 +02:00

Social: scrobbling Plugin #26

SBDeveloper referenced this issue

2026-10-07 19:53:25 +02:00

Declarative plugin UI and slots #45

SBDeveloper referenced this issue

2026-10-07 19:53:44 +02:00

Post-v1 features: offline, radio, plugin API, registry, media controls, social, Windows/macOS, track matching #13

SBDeveloper referenced this issue

2026-10-07 19:53:44 +02:00

UI rework: Spotify-style shell, unified Playlists, Recordings, plugin UI #32

SBDeveloper referenced this issue

2026-10-07 19:56:28 +02:00

Social: scrobbling Plugin #26

SBDeveloper commented

2026-10-08 20:55:30 +02:00

Author

Owner

Implemented in 2146d5f: consent enforced at load, data dir protected from plugin mounts, call timeout + memory cap + trap recovery, update flow with re-consent on capability growth. Core integration tests in crates/core/tests/plugin_isolation.rs.

Implemented in 2146d5f: consent enforced at load, data dir protected from plugin mounts, call timeout + memory cap + trap recovery, update flow with re-consent on capability growth. Core integration tests in crates/core/tests/plugin_isolation.rs.

SBDeveloper closed this issue

2026-10-08 20:55:30 +02:00

SBDeveloper referenced this issue from a commit

2026-10-08 20:55:33 +02:00

Enforce plugin capabilities and isolate plugin secrets (#19)

SBDeveloper referenced this issue from a commit

2026-10-09 20:17:43 +02:00

Enforce plugin capabilities and isolate plugin secrets (#19)