Add remote plugin install, index discovery, and plugin dependencies - #1422

Merged

Soph merged 38 commits into

mainfrom

ashtom/plugin-index

Aug 10, 2026

Commits on Jun 12, 2026

Add plugins settings (index_url, index_ttl_hours)

ashtom
and
claude
committed
5ccff29
Add remote plugin install, git-synced index discovery, and dependencies

ashtom
and
claude
committed
9e40149
Document the plugin system in the README

ashtom
and
claude
committed
f81da17
Address PR review findings (Bugbot, Copilot)

ashtom
and
claude
committed
cd5984b
Address Bugbot round-two findings

ashtom
and
claude
committed
6ee0a3b
Address Bugbot round-three findings

ashtom
and
claude
committed
117b23b
Address Bugbot round-four finding: semver-aware upgrade comparison

ashtom
and
claude
committed
813670a
Address Bugbot round-five findings

ashtom
and
claude
committed
6da333c

Commits on Aug 4, 2026

Merge remote-tracking branch 'origin/main' into ashtom/plugin-index
Soph
committed
f426d5b
Fix lint errors surfaced by main's build-tagged lint coverage

Soph
and
claude
committed
2ac8323
Derive the asset filename from the download_url path only

Soph
and
claude
committed
56a063e
Validate plugin repo URLs before they reach the git CLI

Soph
and
claude
committed
ac0d13e
Record the plugin index schema version instead of enforcing it

Soph
and
claude
committed
0636c62

Commits on Aug 5, 2026

Require authenticated plugin downloads and verify installed binaries

Soph
and
claude
committed
26b10db
Address trail #973 findings: extraction truncation, index cache locking

Soph
and
claude
committed
a31378f
Plan the stricter minimum when a dependency is required twice

Soph
and
claude
committed
91ac04e
Flag dependencies resolved from unlisted repo URLs before confirming

Soph
and
claude
committed
fe13cc8
Harden the plugin supply chain: transport, naming, hygiene fixes

Soph
and
claude
committed
9c5cf27
Take the plugin index URL out of repo-committed settings

Soph
and
claude
committed
600eae5
Decode entire-plugin.yml leniently, before third-party files exist

Soph
and
claude
committed
9c1de62
Let a leftover plugins settings key fail loudly

Soph
and
claude
committed
ac51853
Redact credentials in asset-download errors too

Soph
and
claude
committed
ba64c9c
Reject an install under a name the caller did not request

Soph
and
claude
committed
161a73b
Resolve dependencies through the index, not an author-supplied URL

Soph
and
claude
committed
4c781ae

Commits on Aug 6, 2026

Cleanup pass: reuse shared helpers, close redaction gaps, flatten hot spots

Soph
and
claude
committed
abf3a92
Dedupe the plugin test fixtures

Soph
and
claude
committed
fcf6acd
Make the install target and expected name required arguments

Soph
and
claude
committed
143c652
Route every scp-like git URL to the repository, not the filesystem

Soph
and
claude
committed
f4a5f20
Parse the install source once, classifying and validating together

Soph
and
claude
committed
32991c4
Keep the manifest consistent with the binary, and verify dependency outcomes

Soph
and
claude
committed
653eced
Confirm before browse installs

Soph
and
claude
committed
fb8412b
Validate min_version so a typo cannot remove the version floor

Soph
and
claude
committed
ab61a0b

Commits on Aug 7, 2026

Name the plugin a --force install replaces, and stop two misleading messages

Soph
and
claude
committed
87447c1
Accept file:// git remotes only under test

Soph
and
claude
committed
ea46af2
Bound every read of remote-controlled data, and lstat what we own

Soph
and
claude
committed
bd570cd
Pin the one-binary rule, and make archive selection deterministic

Soph
and
claude
committed
18ba7e7
Close the caps' remaining gaps, and stop holding an archive listing in memory

Soph
and
claude
committed
f727a8a

Commits on Aug 10, 2026

Reject catalog entries that could repaint the terminal

Soph
and
claude
committed
b5d1654