feat(egg): install every plugin file the release lists, helpers included (D182) #19

wtclaude · 2026-09-27T02:47:12Z

wtclaude commented

2026-09-27 02:47:12 +00:00

The egg copied only RunicGateway.cs out of the plugin tarball. From protocol 13, Rust-Plugins releases the ZoneManager helper RunicGatewayZones.cs beside it, and the helper is installed by default (PLAN_FIXES D181, D182; decisions in docs#288).

The egg installs every .cs the plugin manifest lists in files.
Each file is checked against its own sha256 before anything is placed. The egg never checked the bridge's own checksum before this.
It refuses any name that isn't a plain <Name>.cs.
A release older than helpers lists only the bridge, so it installs exactly what it did before.

Tested in an Alpine shell against six manifests: both files, bridge only, a tampered helper, a missing helper, ../evil.cs and evil.dll. The last four refuse with nothing placed. bash -n passes.

No sidecar change is needed for step 2: the sidecar forwards event kinds without a list.

Tracking: Module-Rust#21.

AI-assisted (Claude Code)

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

The egg copied only `RunicGateway.cs` out of the plugin tarball. From protocol 13, Rust-Plugins releases the ZoneManager helper `RunicGatewayZones.cs` beside it, and the helper is installed by default (PLAN_FIXES D181, D182; decisions in docs#288). - The egg installs every `.cs` the plugin manifest lists in `files`. - Each file is checked against its own sha256 **before anything is placed**. The egg never checked the bridge's own checksum before this. - It refuses any name that isn't a plain `<Name>.cs`. - A release older than helpers lists only the bridge, so it installs exactly what it did before. **Tested** in an Alpine shell against six manifests: both files, bridge only, a tampered helper, a missing helper, `../evil.cs` and `evil.dll`. The last four refuse with nothing placed. `bash -n` passes. No sidecar change is needed for step 2: the sidecar forwards event kinds without a list. Tracking: Module-Rust#21. - [x] AI-assisted (Claude Code) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-09-27 02:47:14 +00:00

feat(egg): install every plugin file the release lists, helpers included (D182)

PR Checks / rust-gates (pull_request) Successful in 1m58s

Details

fe7b2822c5

Rust-Plugins now releases a ZoneManager helper, RunicGatewayZones.cs, beside
the bridge (docs/modules/rust/PLAN_FIXES.md D181, D182), installed by default.
The egg copied only RunicGateway.cs out of the tarball.

It now takes every .cs the plugin manifest lists in `files`, checks each
against its own sha256 before anything is placed (the bridge's own checksum
was never checked by the egg before), and refuses a name that is not a plain
<Name>.cs. A release older than helpers lists only the bridge and installs
exactly what it did before. Exercised in an Alpine shell against both, a
tampered helper, a missing one, `../evil.cs` and `evil.dll`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

whitlocktech merged commit 4498baffe4 into edge

2026-09-27 06:11:59 +00:00

whitlocktech deleted branch feat/protocol-13-egg-helpers

2026-09-27 06:12:00 +00:00

whitlocktech referenced this issue from a commit

2026-09-27 06:12:01 +00:00

Merge pull request 'feat(egg): install every plugin file the release lists, helpers included (D182)' (#19) from feat/protocol-13-egg-helpers into edge

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/Rust-Link#19