[devnull03]

Summary

• add signed official-plugin and reviewed GitHub package installation
• route plugin discovery to the website and keep installation controls in Settings
• register and hand off qrate:// plugin install links
• add host-mediated plugin API v2 JSON exports with immutable table snapshots
• keep paths and file handles outside Lua, with input, output, memory, and execution limits
• add installer protocol registration and plugin author documentation

Validation

• cargo check -p app
• cargo test -p plugin-host -p plugin-package
• simulated merge with current main: 34 passed, 7 ignored, 0 failed

[Copilot]

🟡 Changes recommended

There are a few correctness/UX issues in the new marketplace/packaging paths (notably order-sensitive permission matching and misleading install prompts) that should be fixed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a first-party plugin marketplace flow (official signed catalog + direct GitHub installs), deep-link handling via qrate://, and a plugin export API (v2) that lets plugins generate host-written JSON from immutable table snapshots.

Changes:

• Introduce plugin-package crate for signed catalog verification, ZIP inspection/extraction, and managed install receipts.
• Extend the plugin host + plugin API to support API v2 exports and static qrate-plugin.json contract checks for managed packages.
• Add app UI/actions for discovery/installation, plus OS protocol registration and a per-user single-instance deep-link handoff; update docs to match.

File summaries

File	Description
scripts/installer.wxs	Registers the qrate URL protocol handler for the MSI installer.
scripts/installer.nsi	Registers/removes the qrate URL protocol handler for the NSIS installer.
README.md	Updates docs navigation link text for plugin discovery/install docs.
docs/plugins/index.md	Expands user docs to cover official/direct/manual plugin install paths and new package manifest.
docs/plugins/api-reference.md	Updates plugin API docs to api_version = 2 and documents JSON exports.
docs/dev/plugin-marketplace-plan.md	Adds detailed internal design/plan document for the marketplace.
crates/plugin-package/src/lib.rs	New crate implementing catalog verification, GitHub release resolution, package inspection, install/update/remove, and tests.
crates/plugin-package/Cargo.toml	Adds dependencies for the new plugin-package crate.
crates/plugin-host/src/plugin.rs	Bumps plugin host API version to 2 and adds export execution + snapshot validation and packaged-descriptor matching.
crates/plugin-host/src/lib.rs	Adds package-on-disk parsing/validation, export spec aggregation, and debug-only repo plugin search path.
crates/plugin-api/src/lib.rs	Adds ExportSpec and snapshot types shared between app and host.
crates/app/src/title_items/launcher_bar.rs	Adds Extensions menu entries for plugin discovery/management.
crates/app/src/plugin_marketplace.rs	New UI window for signed catalog review + direct GitHub install flow.
crates/app/src/main.rs	Registers URL scheme, parses initial qrate:// arg, starts handoff watcher, and wires plugin export action.
crates/app/src/instance_handoff.rs	New per-user handoff mechanism so deep links reach the already-running instance.
crates/app/src/export.rs	Adds PluginExport action and host-mediated JSON export path (save dialog + atomic write).
crates/app/src/app_settings/mod.rs	Extends Plugins settings page with discovery/install entry points and managed-package removal.
crates/app/src/app_menus.rs	Adds plugin exports to File ▸ Export and adds Extensions menu actions.
crates/app/Cargo.toml	Adds plugin-package, single-instance, and tempfile dependencies.
CONTRIBUTING.md	Updates contributor guidance to reference the template + registry repos.
CLAUDE.md	Updates cross-repo plugin contract guidance to include registry + site responsibilities.
Cargo.toml	Adds crates/plugin-package to the workspace.
Cargo.lock	Locks new dependencies (plugin-package, single-instance, transitive deps).
assets/macos/Info.plist	Registers qrate URL scheme on macOS.
.github/workflows/release.yml	Injects the plugin catalog public key into release builds and updates Linux desktop entry for scheme handling.

Review details

Suppressed comments (1)

crates/app/src/plugin_marketplace.rs:316

• The direct-install confirmation doesn’t mention that first-time installs are disabled by default (but the code does disable them when no prior receipt exists). Adding that note helps users understand why the plugin won’t immediately run after installation.

            Some(&format!(
                "{} · SHA-256 {} · {permissions}. qrate has not reviewed this source.",
                release.repository, inspection.sha256
            )),

• Files reviewed: 24/25 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.