[ashx-j]

Fixes from a second adversarial review, of #23 to #25 (#3). It builds on #25, so until #14 to #25 merge this diff also shows their commits.

A second Claude Opus 5.5 at xhigh effort reviewed #23 to #25 from their code alone and found 10 issues. All 10 are fixed here. It also confirmed the tarball extractor never writes outside the plugin's folder.

Installs (#22, #24, #25):

• Installing from one source could replace a different plugin that had the same id. That plugin's folder, settings, secrets and storage then belonged to the new code. update also only checked the id after swapping. Now install refuses an id that is already installed from a different source, and update checks the id before anything moves.
• Updating a disabled plugin turned it on. An update now keeps the plugin's enabled state; only a new install is enabled.
• Startup recovery could delete the staging folder of an install that began while the server was starting. Recovery now only handles staging folders that existed when the host was created, before the server serves requests.
• A git URL with credentials in it (https://token@host/…) was shown to every client that can read plugin state, including read-only sessions and agents. Plugin state now shows such URLs with the credentials replaced; the server keeps the full URL for updates.

npm (#25):

• Downloads had no timeout, and the size was checked only after the whole tarball was in memory. Each request now has a 60-second limit, a content-length over 32 MiB is refused before reading, and metadata uses npm's abbreviated document, which is much smaller.
• The extractor parsed some archives differently from npm's tar library, which could install a file other than the one npm's tools show. It now verifies every header checksum, honors pax size records, reads the ustar prefix field only from ustar headers, needs the 2 zero blocks that end an archive, and refuses a path that appears twice.

Run hook (#23):

• If the event stream behind afterRunCompleted failed (a slow handler can make the server end it), the hook stopped silently until the plugin restarted. It now logs the failure and resumes from its saved position after a second.

Web runtime (#23):

• A bundle whose top-level await never settled still blocked every other plugin. The import now has the same 30-second deadline as fetch and activate.
• revision restarted at 0 with every server process, so after a restart a client could keep a plugin's old web code. It now starts from the clock.
• A command registered after the loader stopped added a keyboard scope nobody removed. It no longer registers one.

Verification:

• pluginTarball.test.ts adds a header with a bad checksum and a duplicate path, both refused. Its test tarballs now carry real checksums.
• The PluginHost.test.ts install case adds a folder claiming an installed plugin's id (refused) and an update of a disabled plugin, which stays disabled.
• api/turns.test.ts passes.
• vp run check:changed passed.
• Not covered by a test: resuming the run hook after a stream failure, the npm timeouts and size header, the import deadline, the startup listing, the URL redaction, and the clock-seeded revision.

---

PR filed by Claude Opus 5.5 in Claude Code through T3 Code.