[JetSquirrel]

Closes real gaps in how plugins are installed, approved and run, and makes the app honest about what it enforces. Plugins are still not sandboxed, and this doesn't change that. docs/plugin-security.md has the threat model, including what this doesn't protect against.

Merge order: #47, #48, #49, #50, #51, #52, then this. This branch is built on all six, so its diff shows their work until they land. It targets main. Please merge these with merge commits, not squash or rebase, or each later branch stops containing the one before it (#55).

The analysis entry point gets the same protections (#55)

Control	On an analysis
Approval by folder hash	Checked as each run starts. A changed plugin doesn't run, and isn't started just to ask what it offers
Output limits	16 MiB in a line, and 100,000 findings
Time limit	5 minutes, and Stop in the window ends it
Secrets	It's sent none, so there's nothing of a source's to mask. Properties that look like secrets are masked first

Tests cover a tampered plugin, an endless line, output that isn't the protocol, and a plugin that never finishes, ended both by the limit and by cancelling. This also gives a real test of a plugin that hangs, which the describe timeout below still lacks. The 5 minutes and 100,000 are my choices, so tell me if you'd like others.

Gaps this closes

Gap	Before	Now
Plugin swapped after approval	Ran with no prompt, if version and permissions matched	Any changed file in its folder needs approval again
khonsu plugin uninstall ..	Recursively deleted a folder outside the plugins directory	Refused
entry of ../../x or an absolute path	Ran it	Refused when the manifest is read
Reinstall of a broken plugin	Deleted the working one first	Checked in a staging folder; the old one stays
Symbolic link in a plugin folder	Followed, copying in whatever it pointed at	Refused
Zip bomb	Unpacked without limit	Refused past 512 MiB or 10,000 entries, counting what actually unpacks
Endless line of output	Held in memory	The sync fails past 16 MiB in one line
describe or test output	Unlimited, and describe could hang forever	Cut at 16 MiB; describe stops after 30 seconds
Output that isn't valid UTF-8	Silently ended reading, showing as "no done"	Reported as invalid output
Secrets in the error a sync returns	My miss in #51: masked where stored, not in the returned error	Masked there too, and in test results and previews
Approval dialog	"Gets the permissions below" implied enforcement	Says it isn't sandboxed and the list isn't enforced

The uninstall one was the most serious. I haven't seen it happen, but an agent or a mistyped command could have deleted real data.

Decisions for you

1. Everyone re-approves third-party plugins once. Approvals from before this read as changed, because they hold no record of the folder's contents. There's no way to carry them over honestly. Built-in plugins are unaffected.
2. Plugins can't write into their own folder any more without needing re-approval, except __pycache__ and .pyc. A plugin that keeps a cache there would need approving on every run. Let me know if you'd rather hash only the manifest and entry files. That's looser, but it wouldn't notice a changed helper script.
3. .pyc files aren't checked, because Python writes them as it runs, even though they can hold code. It's a known hole, listed in the doc.

New

• khonsu plugin approve ID approves a plugin as it is now. Without it, re-approving from the CLI would mean reinstalling from the original folder.
• khonsu plugin list now gives approval (approved, not_approved or changed) and sandboxed: false.
• sha2 is a new direct dependency of khonsu-core. It was already in the lockfile through HawDB's dependencies.

What this doesn't do

• No sandbox. A plugin you approve can do anything you can. Its environment variables come with it.
• Not a defense against an attacker with your account. The approval record sits beside the plugins, so anyone who can edit one can edit the other. This catches accidents and swapped files.
• Programs on PATH, such as python3, aren't checked. The script is.
• No limit on total records. A plugin can send valid records until you cancel.
• Masking only covers declared secrets, and only what KhonsuGraph keeps or shows.

Testing

• cargo test --locked --workspace passes on Windows, and CI will cover macOS.
• End-to-end tests cover:
  • tampering with the program, a file beside it, and the manifest
  • entries and IDs that try to leave the folder
  • a bad reinstall
  • a 17 MiB line and invalid output, both with the graph intact afterwards
• Unit tests cover archive caps, line limits and masking.
• I checked the approval dialog in the real window on Windows, on a tampered plugin. I didn't run it on macOS or in Chinese.
• Not tested:
  • The describe timeout. There's no cross-platform way to make a test plugin hang that doesn't also make the test take 30 seconds.
  • Symbolic links in folders and archives. Creating one in a test needs special rights on Windows.
• Small gap: a sync refused for approval doesn't update the sidebar's last-sync line, so it can still say "Synced 11s ago". The error itself is shown.

Issue status

#39's criteria have tests, apart from the two gaps above. On "no new network access", this PR adds none, and there's nothing to test beyond that.

Refs #39

🤖 Generated with Claude Code