lapis-notes/plugin-registry
2
0
Fork 0
Code Issues 11 Pull requests Projects Releases Packages Wiki Activity Actions

[loader] Add Electron plugin asset protocol #6

New issue
Open
opened 2026-06-02 08:21:13 +00:00 by steve · 0 comments
steve commented 2026-06-02 08:21:13 +00:00
Owner
Copy link

Source: Lapis plugin module loading plan, 2026-06-02.

Goal: make installed plugin files URL-addressable in Electron renderer through a narrow secure custom protocol.

Scope:

  • Register lapis-plugin as a privileged, standard, secure, fetch-capable protocol before app.ready.
  • Add protocol handling for lapis-plugin://[vault-id]/[plugin-id]/[version-or-hash]/[path].
  • Validate active vault mapping, plugin ID, version/hash, path, file type, and installed metadata.
  • Serve verified plugin files with correct MIME types.
  • Add tests for nested ESM relative imports and path traversal rejection.

Acceptance:

  • Electron renderer can import lapis-plugin://.../main.mjs.
  • Relative ESM imports resolve from the same plugin URL space.
  • The protocol cannot serve arbitrary filesystem or vault user files.
Source: Lapis plugin module loading plan, 2026-06-02. Goal: make installed plugin files URL-addressable in Electron renderer through a narrow secure custom protocol. Scope: - Register `lapis-plugin` as a privileged, standard, secure, fetch-capable protocol before `app.ready`. - Add protocol handling for `lapis-plugin://[vault-id]/[plugin-id]/[version-or-hash]/[path]`. - Validate active vault mapping, plugin ID, version/hash, path, file type, and installed metadata. - Serve verified plugin files with correct MIME types. - Add tests for nested ESM relative imports and path traversal rejection. Acceptance: - Electron renderer can import `lapis-plugin://.../main.mjs`. - Relative ESM imports resolve from the same plugin URL space. - The protocol cannot serve arbitrary filesystem or vault user files.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lapis-notes/plugin-registry#6
No description provided.