Fix local run freshness and plugin asset handling

platform/validator/resources.go

@@ -1,10 +1,13 @@
 package validator
 
 import (
+	"bytes"
+	"encoding/base64"
 	"fmt"
 	"regexp"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
 	"browser.local/platform/domain"
 )
@@ -260,6 +263,9 @@ func validatePluginAssetFileDeclarations(prefix string, files []domain.PluginAss
 		if file.Content != "" {
 			violations = append(violations, field+".content must be supplied only in registration assetFiles")
 		}
+		if file.Encoding != "" {
+			violations = append(violations, field+".encoding must be supplied only in registration assetFiles")
+		}
 		if file.Mode != 0 && file.Mode != 0o600 && file.Mode != 0o700 {
 			violations = append(violations, field+".mode is unsafe")
 		}
@@ -282,7 +288,10 @@ func validatePluginAssetFiles(prefix string, files []domain.PluginAssetFile) []s
 			violations = append(violations, field+".path is duplicated")
 		}
 		seen[file.Path] = struct{}{}
-		if len([]byte(file.Content)) > 64*1024 || strings.ContainsRune(file.Content, '\x00') || containsUnsafeRuntimeSecret(file.Content) {
+		content, err := pluginAssetContentBytes(file)
+		if err != nil {
+			violations = append(violations, field+err.Error())
+		} else if len(content) > 64*1024 || pluginAssetContentUnsafe(file, content) {
 			violations = append(violations, field+".content is unsafe")
 		}
 		if file.Mode != 0 && (file.Mode < 0o400 || file.Mode > 0o700 || file.Mode&0o022 != 0) {
@@ -292,6 +301,31 @@ func validatePluginAssetFiles(prefix string, files []domain.PluginAssetFile) []s
 	return violations
 }
 
+func pluginAssetContentBytes(file domain.PluginAssetFile) ([]byte, error) {
+	switch strings.TrimSpace(file.Encoding) {
+	case "":
+		return []byte(file.Content), nil
+	case "base64":
+		content, err := base64.StdEncoding.DecodeString(strings.TrimSpace(file.Content))
+		if err != nil {
+			return nil, fmt.Errorf(".content is not valid base64")
+		}
+		return content, nil
+	default:
+		return nil, fmt.Errorf(".encoding is unsupported")
+	}
+}
+
+func pluginAssetContentUnsafe(file domain.PluginAssetFile, content []byte) bool {
+	if strings.TrimSpace(file.Encoding) == "base64" {
+		if bytes.ContainsRune(content, '\x00') || !utf8.Valid(content) {
+			return false
+		}
+		return containsUnsafeRuntimeSecret(string(content))
+	}
+	return bytes.ContainsRune(content, '\x00') || containsUnsafeRuntimeSecret(string(content))
+}
+
 func validateRegistrationAssetCoverage(declared []domain.PluginAssetFile, payload []domain.PluginAssetFile) []string {
 	if len(declared) == 0 {
 		return nil