Files
multica/server/internal/service/plugin_skill.go
f45b591623 MUL-6469: host plugin artifacts, bind installs to immutable versions (#7321)
* feat(plugins): host plugin artifacts, bind installs to immutable versions

A plugin used to be a URL. The manifest was frozen at install, but the surface
script was fetched from the author's server every time a panel opened, with no
integrity check — so an administrator consented to a manifest while the browser
ran whatever that host served that day, inside the scopes already granted. The
author's uptime was our uptime, every panel open leaked the reader's IP and
"who read which issue" to the author, and publishing at all required a public
HTTPS domain, which is why the repo's own deploy-sentinel example never ran.

The author now uploads an artifact bundle and Multica stores it:

- plugin_package / plugin_package_version / plugin_package_file. A version is
  insert-only, and the (package_id, version) unique index is what makes
  immutability a database rule rather than a convention.
- An installation names one version. Publishing another changes nothing for a
  workspace until an administrator upgrades, which is a second consent.
- The bundle is validated once, at publish: the manifest parses, every file it
  declares is present and loadable, and a surface entry with a top-level import
  is refused with the line named. That failure used to surface months later in
  a reader's browser.
- The host inlines the surface script into the document it generates, so the
  CSP names no remote script origin at all. `connect-src 'none'` now means it:
  a surface with no net: scope cannot reach anywhere, including its author.
- Install-by-URL is gone rather than kept alongside. Two paths would make "is
  this code frozen?" depend on how the plugin was installed.
- MULTICA_PLUGIN_DIR stays the development channel, but publishes an ordinary
  immutable version instead of being a second render path; re-publishing an
  unchanged version lands as `+dev.N`.

Hook endpoints and MCP servers remain on the author's own infrastructure.

Migration 376 drops existing installations: they name a source URL that is no
longer a concept, and the code they would run was never published here.
plugins_v1 has never left its feature flag and holds no production data — the
same call migration 344 made.

Closes MUL-6469

Co-authored-by: multica-agent <[email protected]>

* fix(plugins): serialize publish/install/delete, correct the isolation claim

Review of #7321 found five problems. Four are fixed here; the fifth is real,
needs its own design pass, and is now tracked and described honestly in the code
instead of claimed away.

Migration prefix collision. main took 376 for agent_task_durable_work_dir while
this branch was open, so `migration prefix 376 is reused` failed backend-tests.
Rebased and renumbered the six migrations to 377-382.

TOCTOU between delete and install/publish. Relationships are application-owned
by repository policy, so nothing made "the version this installation names still
exists" true across statements: `delete counts zero installs` -> `install reads
the version` -> `delete commits` -> `install commits` left an installation whose
panel 404s forever, and a publish racing a delete left a version whose package
row was gone. Publish, install and delete now hold a (workspace, plugin key)
advisory lock for their whole transaction, and delete counts installations
inside it. Both interleavings have regression tests that reproduce the bug with
the lock removed.

Failed publishes moved package state. upsertPackage ran before the version
transaction, so a republish that lost the unique index had already renamed the
package, and a first publish that failed afterwards left a plugin with zero
versions. It now runs inside the same transaction.

The top-level import check was wrong in BOTH directions. It read line prefixes,
so it missed `  import x` and `/* c */ import x` — and it refused a valid file
whose template literal contained the word at a line start, which is ordinary in
a surface that renders code samples. A refusal blocks a publish with no way
around it, so that false positive was the worse half. Replaced with a scanner
that skips comments and string/template literals; where it is imprecise it is
imprecise safely (`/` always reads as division), so a mistake can only cost a
detection, never invent one.

Sandbox self-navigation is NOT fixed. `sandbox="allow-scripts"` permits `_self`
navigation by design, no shipped CSP directive covers it, and contentWindow is
unchanged across it — so a hostile artifact can still reach its author once and
hand the replacement document the bridge port. Closing it needs an embedder
frame-src policy or a handshake a navigated document cannot complete; both are
decisions of their own. What lands here is damage control, labelled as such: the
generated document beacons on pagehide from a listener the plugin cannot detach,
and the embedder drops the bridge and unmounts the frame. The "a surface cannot
reach its author" wording is removed from the SDK README and the tests.

Closes MUL-6469
Refs MUL-6485

Co-authored-by: multica-agent <[email protected]>

* fix(plugins): harden surface validation and error reporting

* fix(migrations): renumber plugin package migrations

* fix(plugins): validate classic surfaces and reset failures

---------

Co-authored-by: Lambda <[email protected]>
Co-authored-by: multica-agent <[email protected]>
2026-08-21 16:03:44 +08:00

95 lines
3.6 KiB
Go

package service
import (
"context"
"strings"
"github.com/jackc/pgx/v5/pgtype"
"github.com/multica-ai/multica/server/internal/skill"
db "github.com/multica-ai/multica/server/pkg/db/generated"
"github.com/multica-ai/multica/server/pkg/plugincontract"
)
// Skill resources.
//
// A plugin's `skill` resource becomes an ordinary row in the existing skill
// table. Not a plugin-owned copy, not a bundle, not an artifact with a digest:
// the previous plugin system built all of that across fourteen tables and, at
// the end of it, delivered one SKILL.md that this table could already hold.
//
// The only thing the platform has to remember is which installation contributed
// which skill, so uninstall removes exactly those and nothing a person wrote.
// That is one nullable column.
//
// A resource is not a hook — nothing calls anything. The file was validated and
// stored when the author published the version, so installing it is a read from
// our own database rather than a fetch of whatever the author is serving today.
// InstallSkillResources writes the manifest's skill resources and prunes the
// ones this installation no longer declares.
//
// Called inside the install transaction: a plugin that half-installs its skills
// is worse than one that fails, because the missing half is invisible.
func (s *PluginService) InstallSkillResources(ctx context.Context, queries *db.Queries, installation db.PluginInstallation, manifest plugincontract.Manifest, userID pgtype.UUID) error {
resources := skillResources(manifest)
// Prune first, so a rename frees its old name before the new one is
// written. The reverse order would collide with the table's unique
// (workspace_id, name) on any rename that only changes case or spacing.
keep := make([]string, 0, len(resources))
for _, resource := range resources {
keep = append(keep, resource.Key)
}
if err := queries.DeletePluginSkillsNotIn(ctx, db.DeletePluginSkillsNotInParams{
PluginInstallationID: installation.ID,
KeepNames: keep,
}); err != nil {
return &PluginError{Kind: PluginErrorUnavailable, Message: "prune plugin skills", Err: err}
}
if len(resources) == 0 {
return nil
}
for _, resource := range resources {
raw, err := s.packageFile(ctx, queries, installation.PackageVersionID, resource.Entry)
if err != nil {
return err
}
content := string(raw)
_, description := skill.ParseSkillFrontmatter(content)
// The manifest key is authoritative for the name, not the frontmatter.
// The consent screen listed the key, the tool namespace uses it, and a
// file that disagrees must not silently install under another name.
name := resource.Key
if strings.TrimSpace(description) == "" {
description = "Provided by the " + manifest.Name + " Plugin."
}
if _, err := queries.UpsertPluginSkill(ctx, db.UpsertPluginSkillParams{
WorkspaceID: installation.WorkspaceID,
Name: name,
Description: description,
Content: content,
CreatedBy: userID,
PluginInstallationID: installation.ID,
}); err != nil {
if isUniqueViolation(err) {
return pluginErrf(PluginErrorConflict,
"a skill named %q already exists in this workspace", name)
}
return &PluginError{Kind: PluginErrorUnavailable, Message: "install plugin skill", Err: err}
}
}
return nil
}
func skillResources(manifest plugincontract.Manifest) []plugincontract.Resource {
resources := make([]plugincontract.Resource, 0, len(manifest.Contributes.Resources))
for _, resource := range manifest.Contributes.Resources {
if resource.Type == plugincontract.ResourceSkill {
resources = append(resources, resource)
}
}
return resources
}