Tighten opaque plugin content boundaries

2026-09-03 18:24:39 +08:00
parent 80cddbf19d
commit 14cbc63e61
31 changed files with 452 additions and 558 deletions
@@ -22,6 +22,8 @@ Manifests, schemas, SDK contracts, example plugins, and test fixtures must live

 Plugins must never receive raw AI provider keys, run credentials, raw host paths, or direct storage endpoints. Use platform-mediated bridge calls for jobs, logs, files, artifacts, and AI.

+Plugin-owned request text, result payloads, player/user records, stdout/stderr, and declared file-tail bodies are opaque to Platform and Run. Do not add plugin SDK or manifest compatibility logic that scans, redacts, filters, normalizes, or rejects those values because they look like credentials, host paths, login lines, SQL text, RCON text, or game-specific user data. Keep safety checks on declared actions, permissions, scoped references, schemas, sizes, checksums, and transport framing.
+
 ## Local Development

 Local plugin development should exercise real platform-run flows through dev registration instead of bypassing platform authorization.