Runtime, sandbox, and RPC
The runtime loads with the injected Fluxer application and reconciles installed plugin records into active sandbox instances. The injector does not need to remain open.
Trust and execution
Section titled “Trust and execution”Plugin code is copied into per-user data, checked against its manifest hash, and disabled until the user confirms the exact bundle and capabilities. Importing changed code resets enabled/trust state.
Each enabled plugin gets an opaque-origin frame with scripts allowed but no same-origin privilege. The frame has no parent DOM, Node/Electron access, unrestricted networking, or remote script execution.
The SDK’s definePlugin registers a definition inside this sandbox. Identity and API compatibility are checked before startup.
RPC flow
Section titled “RPC flow”SDK calls become serializable requests. Both the sandbox client and host check the required capability. Host handlers validate data and context before invoking generic services. Privileged operations repeat appropriate checks at the main-process boundary.
Credentials stay in core. Attachments expose owned opaque handles rather than arbitrary channel/message lookup; external navigation requires a host-held user-interaction authorization.
Lifecycle and cleanup
Section titled “Lifecycle and cleanup”Reconciliation starts, stops, or restarts plugin instances when trust, enablement, code, or settings change. Custom views show the same plugin frame and instance.
On shutdown, cancel pending work and release dialogs, subscriptions, styles, wrappers, image handles, and other instance-owned resources. Plugin cleanup remains necessary even with core’s safety net.
Verification
Section titled “Verification”Use runtime unit tests for grant enforcement, malformed requests, ownership, cleanup, cancellation, and stale asynchronous completions. Use the external-plugin fixture to prove a plugin can run using the public package boundary without private imports.