30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
# 4. Plugin install is a 40-slug allowlist, fail-closed
|
|
|
|
- **Status:** Accepted
|
|
- **Date:** 2026-08-15
|
|
|
|
## Context
|
|
|
|
wordpress.org is not a reviewed-safe catalog. A malicious plugin looks fine in preview and only phones home after deploy. The agent will eventually install plugins, but must not be able to in the MVP either (R2).
|
|
|
|
## Decision
|
|
|
|
The agent may install only from a written ~40-slug allowlist (`spikes/plugin-catalog.md`), and only via `wp plugin install <slug>`. No URLs, no zips, no premium marketplaces. Unknown slug → refuse. A detect-only list (Wordfence, Jetpack, cache suites) is never installed.
|
|
|
|
### Options considered
|
|
|
|
- Open wordpress.org search.
|
|
- Written allowlist now; reputation/egress gate later (Sprint 9).
|
|
- No wall until the install playbook exists.
|
|
|
|
### Rejected
|
|
|
|
- Open search — reintroduces R2.
|
|
- No wall until later — the MVP agent could still `wp plugin install <url>` unless the tool schema forbids it from day one.
|
|
|
|
## Consequences
|
|
|
|
- Sprint 3 `tool-schemas.ts` must forbid `wp plugin install http` and unknown slugs even though no install playbook ships in MVP.
|
|
- Reputation gate, zip SHA, and egress watch on first activate are Sprint 9 scope, already specced.
|
|
- Catalog changes are PRs, not prompt edits.
|