Capabilities
A plugin is a WebAssembly component, and it starts with no access to files, the network or programs. A Capability is a grant that gives it one kind of access.
Only your user config grants a Capability. A plugin cannot give itself one, and a repo cannot give one to a plugin.
| Capability | What it allows | Where you set it | Pin | Trust rule | Features |
|---|---|---|---|---|---|
exec | Runs the programs that the grant names, with no shell, in a directory that dk chooses. dk does not check the arguments. | exec = ["jj"] under [plugins.<name>] in config.toml in the config directory. A .ductus/config.toml cannot set it: dk ignores the key and shows one warning. | A user plugin file gets the grant only when sha256 = "<hash>" in the same table matches the file. | Works only for a file in a trusted workspace. :trust trusts the workspace of the current document. | Plugins |
| LSP reads | Reads the diagnostics of a document, and asks its language servers for document symbols. | No grant needed. | None. | Reaches a language server only in a trusted workspace. | Plugins |
Today a plugin gets no filesystem or network access, and a grant for either will follow the rules of exec.
Exec is full trust
dk does not check the arguments of a program that an exec grant names.
jj util exec runs any program and so do git aliases, so a plugin with an exec grant for jj or git can run any program as you.
Give the grant only to a plugin that you would run as a program.
The pin
dk ships a vcs plugin that has exec = ["jj"] with no config, and exec = [] in your config turns that grant off.
A plugins/vcs.wasm in the config directory replaces the shipped plugin, and it gets no grant until your config names one with a pin.
To pin a plugin, run sha256sum on its .wasm file and write the hash as sha256 in the grant.
If the author publishes a hash, compare it with yours first.
If you copy a new file over the old one, the grant stops until you write the new hash.
If the pin is missing or does not match, the plugin runs nothing and one warning says that the grant does not apply.
The warning does not show the hash, so check the file before you write one.
dk downloads no plugin, never updates one, and never loads one from a .ductus directory.