diff --git a/plugin-catalog/README.md b/plugin-catalog/README.md index b17cb01e65..beb910d276 100644 --- a/plugin-catalog/README.md +++ b/plugin-catalog/README.md @@ -118,6 +118,25 @@ meaningful: go upstream as a PR to its author. A fork that renames, rebrands or adds small changes is declined in favour of the original. A listed fork names its origin in its disclosure line (`Derived from `). +17. **No unscannable executable payloads.** Everything a reviewer and the + install scanner read at the pinned commit must be source they can read. A + plugin must not ship a compiled binary (a native executable or library of + any OS — detected by file header, not extension: ELF, Mach-O, PE/`MZ`, + WebAssembly), committed Python bytecode (`.pyc`/`.pyo`, including sourceless + or hash-forged caches that run instead of the `.py` beside them), or an + archive whose members are not themselves reviewable source. A plain-text + source bundle (a `.tar.gz` of `.py`/`.ts`/`.md` the plugin unpacks) is read + like any other source; a bundle hiding a binary is not. The scanner cannot + read machine code, and a checksum committed in the same commit only proves + the file was not changed after that commit, not where it came from. If a + plugin genuinely needs a native component, the binary must be built by the + plugin repository's own public GitHub Actions from source in that repository + and carry a GitHub build attestation (`actions/attest-build-provenance`) tying + it to that workflow and commit; the gate verifies the attestation against the + pinned commit (`gh attestation verify --repo --source-digest + `). A binary a user's own machine fetches at setup time is allowed + only from the upstream tool's official source, pinned by checksum, and + disclosed (rule 13) — never bundled and never from an unofficial mirror. The step-by-step submission guide, with the same rules and what reviewers check, diff --git a/plugin-catalog/tabro.yaml b/plugin-catalog/tabro.yaml deleted file mode 100644 index 78365a306f..0000000000 --- a/plugin-catalog/tabro.yaml +++ /dev/null @@ -1,17 +0,0 @@ -name: tabro -repo: https://github.com/ohmyskyhigh/tabro -sha: 6b0b7e526cb6d85dc3fb3d0eae63d051b5be127a -subdir: integrations/hermes -description: "Chromium profiles (Chrome, Chromium or Edge 153+) and session-owned workspaces through 22 MCP tools, with authenticated HTTP(S)/SOCKS5 proxies. Includes the Windows runtime; set TABRO_BROWSER_PATH to the browser before installation. Disclosure — Windows-only; requires TABRO_BROWSER_PATH pointing at Chrome, Chromium or Edge 153+; setup downloads a hash-pinned Node from nodejs.org, installs a Broker, browser extension and native host under %LOCALAPPDATA%\\Tabro (or TABRO_INSTALL_ROOT), registers HKCU Native Messaging hosts (Chrome, Edge, Chromium, AdsPower SunBrowser) and starts a detached background Broker on loopback that outlives Hermes; broker-owned browsers run with a loopback remote-debugging port while open; the model gets raw CDP (script evaluation, screenshots, input, response bodies) on signed-in browser profiles including user-owned ones, can route broker-owned profiles through proxies it names, and exit-IP checks contact api.ipify.org; payload is prebuilt bundled JS plus a native .exe built from in-repo source." -maintainer: ohmyskyhigh -tier: community -category: web -version: "0.4.2" -platforms: [windows] -docs_url: https://github.com/ohmyskyhigh/tabro/blob/6b0b7e526cb6d85dc3fb3d0eae63d051b5be127a/integrations/hermes/README.md -readme: true -capabilities: - provides_tools: [] - provides_hooks: [] - provides_middleware: [] - requires_env: [] diff --git a/website/docs/developer-guide/plugins/catalog-submission.md b/website/docs/developer-guide/plugins/catalog-submission.md index 5de5d4ec2e..06823c93ca 100644 --- a/website/docs/developer-guide/plugins/catalog-submission.md +++ b/website/docs/developer-guide/plugins/catalog-submission.md @@ -176,6 +176,25 @@ the gallery. There is no separate listing to maintain. go upstream as a PR to its author. A fork that renames, rebrands or adds small changes is declined in favour of the original. A listed fork names its origin in its disclosure line (`Derived from `). +17. **No unscannable executable payloads.** Everything a reviewer and the + install scanner read at the pinned commit must be source they can read. A + plugin must not ship a compiled binary (a native executable or library of + any OS — detected by file header, not extension: ELF, Mach-O, PE/`MZ`, + WebAssembly), committed Python bytecode (`.pyc`/`.pyo`, including sourceless + or hash-forged caches that run instead of the `.py` beside them), or an + archive whose members are not themselves reviewable source. A plain-text + source bundle (a `.tar.gz` of `.py`/`.ts`/`.md` the plugin unpacks) is read + like any other source; a bundle hiding a binary is not. The scanner cannot + read machine code, and a checksum committed in the same commit only proves + the file was not changed after that commit, not where it came from. If a + plugin genuinely needs a native component, the binary must be built by the + plugin repository's own public GitHub Actions from source in that repository + and carry a GitHub build attestation (`actions/attest-build-provenance`) tying + it to that workflow and commit; the gate verifies the attestation against the + pinned commit (`gh attestation verify --repo --source-digest + `). A binary a user's own machine fetches at setup time is allowed + only from the upstream tool's official source, pinned by checksum, and + disclosed (rule 13) — never bundled and never from an unofficial mirror. ## Updating your entry