plugins: net: is requested, never granted — stop the consent prompt implying otherwise - #38
Merged
Merged
Conversation
… implying otherwise
`panday_plugins` carries this note above `requested_fs_writable`:
The manifest *requests*; the sandbox *enforces* (docs/16). Deriving the
policy here keeps the two from drifting — a capability that grants nothing
in the sandbox is a lie told at the consent prompt.
`net` was that lie. The prompt rendered `network: api.github.com`, which a
person reasonably reads as "this plugin may reach that host". Nothing granted
it: the value never reached `SandboxPolicy`, no tier can enforce a per-domain
allowlist, and since M14.8 a `NetPolicy` naming a host is refused outright.
docs/16 meanwhile said "Install-time consent; the sandbox tiers enforce", which
was true of `fs`, `secrets` and `hooks` and false of `net`.
**Kept the field, fixed the prompt** — the choice the brief asks me to state.
Rejecting `net:` at parse time was the alternative; it would break the shipped
`example-plugin` fixture and force every author to re-edit the day the proxy
lands, to buy nothing a truthful prompt does not already buy. So the manifest
still expresses the requirement once, and the prompt now reads:
network: NONE — requested api.github.com but no tier can grant it (M14.8);
the plugin will have no egress
The hosts stay in the text because a user refusing a plugin needs specifics —
that is what `the_consent_summary_names_every_grant_individually` exists for,
and it still passes.
Falsified: restoring the old line turns
`a_requested_network_capability_is_not_presented_as_a_grant` red with "the line
must say the request is not granted, not merely list it: network:
api.github.com". Green after restoring.
docs/16 corrected in the same commit, with the reason, per CLAUDE.md §1.
Verified: fmt, clippy -D warnings, 1093 workspace tests, schemas, ts-sdk, sbom,
deny.
Claude-Session: https://claude.ai/code/session_017kFpYDqvz6sKGSkM4YKaRf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
panday_pluginsalready states the principle, aboverequested_fs_writable:netwas that lie.The prompt rendered
network: api.github.com, which a person reasonably reads as "this plugin may reach that host". Nothing granted it — the value never reachedSandboxPolicy, no tier can enforce a per-domain allowlist, and since M14.8 aNetPolicynaming a host is refused outright. Meanwhile docs/16 said "Install-time consent; the sandbox tiers enforce", which is true offs,secretsandhooks, and false ofnet.The choice, stated
Kept the field, fixed the prompt. The alternative was rejecting
net:at parse time; that breaks the shippedexample-pluginfixture and forces every author to re-edit the day the proxy lands, to buy nothing a truthful prompt doesn't already buy. So the manifest still expresses the requirement once, and the prompt now reads:The hosts stay in the text because a user refusing a plugin needs specifics — that is what
the_consent_summary_names_every_grant_individuallyis for, and it still passes.Falsified
Restoring the old line turns the new test red:
Green again after restoring: 25/25.
Verification
fmt · clippy
--workspace --all-targets -D warnings· 1093 workspace tests, 0 failed · schemas · ts-sdk · sbom (609 components) · deny.docs/16 corrected in the same commit with the reason, per CLAUDE.md §1.
https://claude.ai/code/session_017kFpYDqvz6sKGSkM4YKaRf