fix(filename-template): restore hostPermissions + pack-time manifest validation - #1
Merged
Merged
Conversation
1.1.0 (tag motrix.filename-template@1.1.0) dropped the `"hostPermissions": ["*://*/*"]` entry while keeping `contributes.hooks.beforeFinalize`. The Motrix host enforces a hard manifest invariant: any manifest declaring `contributes.hooks` MUST declare at least one `hostPermissions` entry (error `plugin.manifest.host_permissions_required_for_hooks`). The 1.1.0 artifact is therefore uninstallable — every host rejects it at manifest parse, so the in-app builtin Update fails with that AppError. Restore the entry (as 1.0.1 had it, right after `permissions`) and bump to 1.1.1. This must ship as a new 1.1.1 release; 1.1.0 cannot be fixed in place because its artifact is already signed and pinned.
…king motrix.filename-template@1.1.0 shipped a signed, uninstallable .moext because pack.mjs validated nothing but manifest.id vs the directory name, so a manifest dropping hostPermissions while keeping contributes.hooks sailed through pack, sign, and release. Add scripts/validate-manifest.mjs and run it in packOne() before any artifact bytes are written (so both `pnpm test` and the release workflow's pack step fail loudly on an invalid manifest). Validation is composed from the published plugin SDK: @motrix/plugin-manifest-schema's ManifestSchema for structure, plus the cross-field "hooks require hostPermissions" invariant, which the schema deliberately leaves to the host and which @motrix/plugin-cli only exposes through a bin-only bundle — so its exact rule and canonical error code (plugin.manifest.host_permissions_required_ for_hooks) are reproduced here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two independent-but-related fixes for the
motrix.filename-template@1.1.0incident (a signed release that every Motrix host rejects at install withplugin.manifest.host_permissions_required_for_hooks):36ed788fix(filename-template): restore"hostPermissions": ["*://*/*"](dropped in b5e5ff8 whilecontributes.hooks.beforeFinalizeremained — violating the host invariant that declared hooks require ≥1 hostPermissions entry) and bump to 1.1.1. 1.1.0 is inherently uninstallable and must be superseded.44a93e8ci(pack):pack.mjsnow runs full manifest validation (scripts/validate-manifest.mjs) before producing any artifact bytes:@motrix/plugin-manifest-schemaManifestSchema.parse()for structure + the hooks⇒hostPermissions cross-field invariant with the host's canonical error code (replicated with provenance notes — the schema package deliberately leaves it to the host, and@motrix/plugin-cliships bin-only so it can't be imported). Covers bothpnpm testand the release workflow's pack step; no bypass path.Test plan
pnpm test46 passed;pnpm -r build/typecheckOK; biome cleanAfter merge
Tag
motrix.filename-template@1.1.1on main to trigger the signed release (registry dispatch will regenerate the entry via motrixapp/plugin-registry# logic once that PR lands first).