fix(hello-status): release the full-trust manifest as 1.1.0 - #6
Merged
Conversation
The published 1.0.0 package predates the "sandbox": false line in this repo, so its manifest omits the key entirely. Glyph treats an absent "sandbox" as true, so every install of the sample plugin ran isolated in a worker, where ctx.ui.addStatusBarItem does not exist: TypeError: ctx.ui.addStatusBarItem is not a function The source is already correct; only the release is stale. Bumping the version lets release-plugins.yml repackage it and rewrite packageUrl and sha256. com.glyph.dictionary-fa needs no equivalent change: it omits "sandbox" too and so runs sandboxed, but it only calls ctx.assets.readText and ctx.spellcheck.registerDictionary, both of which the worker implements.
6 tasks
hamidfzm
added a commit
that referenced
this pull request
Aug 16, 2026
…ift in CI The release job refuses to package an official plugin whose manifest.json and plugin.json disagree, so bumping only the manifest to 1.1.0 in #6 left main red: com.glyph.hello-status: manifest.json version 1.1.0 != plugin.json version 1.0.0 Nothing checked that pairing before the merge, so it could only surface in the post-merge release job, which no re-run can turn green. - plugin.json now declares version 1.1.0 and sandbox false, matching the manifest. The marketplace reads the registration for the consent prompt shown before the download, so omitting sandbox there offered the ordinary install warning for a full-trust plugin. - com.glyph.dictionary-fa drops sandbox false from its manifest instead: it only calls ctx.assets.readText and ctx.spellcheck.registerDictionary, both implemented in the sandbox worker, and its published 1.0.0 package already runs sandboxed. - scripts/check-plugins.mjs owns the parity rules (id, version, apiVersion, sandbox, declared files). validate.yml runs it on every PR and release-official.mjs imports it, so both gates read one source of truth. - The catalog badge now names the trust mode either way. It only rendered "sandboxed" for an explicit sandbox true, which nobody writes because it is the default, so the opt-out it exists to flag never showed up. - Smoke tests drive the real release script end to end against a throwaway repo with a stubbed gh, covering packaging, the digest, the packageUrl rewrite and every refusal path. A Smoke workflow runs them with node --test.
hamidfzm
added a commit
that referenced
this pull request
Aug 16, 2026
…ift in CI (#8) The release job refuses to package an official plugin whose manifest.json and plugin.json disagree, so bumping only the manifest to 1.1.0 in #6 left main red: com.glyph.hello-status: manifest.json version 1.1.0 != plugin.json version 1.0.0 Nothing checked that pairing before the merge, so it could only surface in the post-merge release job, which no re-run can turn green. - plugin.json now declares version 1.1.0 and sandbox false, matching the manifest. The marketplace reads the registration for the consent prompt shown before the download, so omitting sandbox there offered the ordinary install warning for a full-trust plugin. - com.glyph.dictionary-fa drops sandbox false from its manifest instead: it only calls ctx.assets.readText and ctx.spellcheck.registerDictionary, both implemented in the sandbox worker, and its published 1.0.0 package already runs sandboxed. - scripts/check-plugins.mjs owns the parity rules (id, version, apiVersion, sandbox, declared files). validate.yml runs it on every PR and release-official.mjs imports it, so both gates read one source of truth. - The catalog badge now names the trust mode either way. It only rendered "sandboxed" for an explicit sandbox true, which nobody writes because it is the default, so the opt-out it exists to flag never showed up. - Smoke tests drive the real release script end to end against a throwaway repo with a stubbed gh, covering packaging, the digest, the packageUrl rewrite and every refusal path. A Smoke workflow runs them with node --test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enabling the sample plugin in Glyph fails with:
The published
1.0.0package predates the"sandbox": falseline this repo already has onmain, so the manifest inside that zip omits the key entirely. Glyph treats an absentsandboxas true (isolation is the default; only an explicitfalseopts into full trust), so every install of the sample runs in a worker.ctx.ui.addStatusBarItemhands the plugin a live DOM element to mount into, which a worker cannot have, so it is not implemented there.The source in this repo is already right. Only the release is stale, so this bumps the version and lets
release-plugins.ymlrepackage it, cutcom.glyph.hello-status-v1.1.0, and rewritepackageUrlandsha256in the index.Changes
plugins/com.glyph.hello-status/manifest.json:version1.0.0 to 1.1.0. No other edit; the packaging, release, and index rewrite are the workflow's job.Notes
com.glyph.dictionary-faneeds no equivalent change. Its manifest omitssandboxtoo, so it also runs sandboxed, but it only callsctx.assets.readTextandctx.spellcheck.registerDictionary, both of which the sandbox implements. It was failing for an unrelated reason (the marketplace download itself), fixed separately in the app.Glyph is getting a matching change so this class of failure explains itself: the three
ctx.uimethods a worker cannot implement will throw an error naming the method and pointing at"sandbox": false, instead of reading as a missing API.