build: ship pinned optional WebUI plugin in shared runtime artifacts #298
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/package-optional-webui"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Package the separate optional WebUI in dist/optional-plugins/webui for both npm and the shared runtime image. Keep lifecycle/plugin ownership separate; do not auto-activate a listener. Pin all input bytes to reviewed Plugins commit a03e5d2 with per-file SHA-256, install exact npm lock with dependency lifecycle scripts disabled, bundle through locked esbuild, and ship runtime files plus source/output provenance without another node_modules tree.
Local: typecheck/build and complete suite passed (1587 passed, 1 existing skipped fixture, 0 failed). New tests cover inert materialization, tampering and whole-lock validation, traversal/ref/repository refusal and built artifact integrity. No model/context constants, credential changes, Service/Ingress or network authentication.
Compatibility workflow prerequisite is the Plugins ci/optional-plugin-assets PR. Shared release validator also needs Python 3/flock already required by current Core OS locks; overlays PR follows. Per-agent explicit activation remains a separate GitOps configuration change.
Final integrated candidate includes current Core main
6f67488and its updated validator pin. Normal typecheck/build and entire suite passed again: 1593 pass, 1 existing skipped fixture, 0 failed. Plugins #55 and overlays #198 are merged after successful remote checks. Optional assets are hash-pinned and inert until configured. Proceeding through normal non-force source merge; image publishing and per-agent activation remain separate evidence.