admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(scum): declare protected run requests

Browse Source
This commit is contained in:
npc0-hue
2026-07-29 22:37:16 +08:00
parent d7465bfd32
commit 99be8f0f3a
28 changed files with 497 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/sdk/bridge-contract.md
+1 -1
View File
@@ -37,7 +37,7 @@ Run distribution, dependency, log backfill, and client-manager requests use `cre
Client-manager lifecycle requests remain Platform-mediated. A plugin declaration does not grant access by itself: Platform rechecks the installed plugin, server owner/administrator scope, runtime binding, assigned Run endpoint capabilities, current distribution target/revision/key generation, and durable installation state before dispatching a typed job.
Game-client plugin pages receive a host-provided `GameClientBridgePageClient`. The SDK defines status, command, result, snapshot, approval, and manifest declaration types but never creates its own HTTP client. Queue requests carry only a declared command type, logical profile key, bounded typed payload, expiry, priority, and idempotency key. Browser-facing types intentionally have no component session, component key, installation fence, host path, DSN, Run endpoint, socket, or storage credential fields.
Game-client plugin pages receive a host-provided `GameClientBridgePageClient`. The SDK defines status, command, result, snapshot, approval, and manifest declaration types but never creates its own HTTP client. Queue requests carry only a declared command type, logical profile key, bounded typed payload, expiry, priority, and idempotency key. A command may declare a protected `sql`, `rcon`, or management-program request: the plugin supplies only its one bounded text field and logical transport/target keys; Platform authorizes, approves, redacts, queues, and forwards it to Run. A management program is not host OS shell access. Browser-facing types intentionally have no component session, component key, installation fence, host path, DSN, Run endpoint, socket, or storage credential fields.
Production plugin lifecycle requests use `createProductionPluginLifecycleRequest`. Envelopes contain only plugin/server scope, enumerated operation, optional target version, confirmation, and idempotency key. Platform rechecks the manifest `productionLifecycle` declaration, dependency policy, disruptive approval, endpoint capacity, compatibility, and prior idempotency inputs before dispatch.
plugins/sdk/index.ts
+14 -3
View File
@@ -211,7 +211,17 @@ export interface GamePluginRemoteAccess {
export type GameClientBridgeApprovalLevel = "none" | "operator" | "platform-admin";
export type GameClientBridgeApprovalState = "not_required" | "pending" | "approved" | "rejected";
export type GameClientBridgeCommandState = "pending" | "claimed" | "succeeded" | "failed" | "cancelled" | "expired";
export type GameClientBridgeCommandState = "pending" | "claimed" | "succeeded" | "failed" | "unknown" | "cancelled" | "expired";
export type GameClientBridgeProtectedRequestKind = "sql" | "rcon" | "program";
export interface GameClientBridgeProtectedRequestDeclaration {
kind: GameClientBridgeProtectedRequestKind;
transportKey: string;
targetKey: string;
textField: string;
maxTextBytes: number;
}
export interface GameClientBridgeCommandDeclaration {
type: string;
@@ -221,7 +231,8 @@ export interface GameClientBridgeCommandDeclaration {
payloadSchemaRef: string;
resultSchemaRef?: string;
timeoutSeconds: number;
maxPayloadBytes: number;
maxPayloadBytes: number;
protectedRequest?: GameClientBridgeProtectedRequestDeclaration;
}
export interface GameClientBridgeSnapshotDeclaration {
@@ -306,7 +317,7 @@ export interface GameClientBridgeStatus {
}
export interface GameClientBridgeCommandResult {
status: "succeeded" | "failed" | "cancelled";
status: "succeeded" | "failed" | "unknown" | "cancelled";
summary?: string;
payload?: Record<string, unknown>;
completedAt: string;