Plugin trust
A plugin system is an invitation to run somebody else’s code against your files. This page is about what that invitation is limited to here: what review means, what the app rechecks before it installs anything, and what a plugin cannot reach even after you have said yes.
The mechanism
Four separate stages, each of which can refuse: review, the catalog entry, the download, and the permissions you grant afterwards.
The archive is built deterministically and its SHA-256 recorded. A resubmission whose bytes differ is refused rather than merged, so any edit — even one reworded line — has to become a new version with its own review.
After downloading, the app recomputes the SHA-256 and compares it to the reviewed value, and checks the size matches the recorded one. A mismatch refuses the install outright rather than warning.
A catalog entry is only accepted if its download URL is https, on linelark.com, at the exact path for that plugin and version, with no query string and no fragment. A catalog that has been tampered with cannot redirect an install to another host.
No symbolic links, no paths escaping the bundle, at most 1,000 entries, at most 20 MB unpacked and 50 MB compressed. A zip that tries any of those is rejected before anything is written.
The manifest asks for git write access, for named hosts, and for named credentials. Installing does not grant them — you switch each on in Manage Plugins, and the panel shows exactly what was asked for.
Permissions are bound to a fingerprint of the manifest’s capabilities. An update that adds a host, or moves a credential to a different header, has to ask again from scratch rather than inheriting the yes you gave the previous version.
Specifics
These are properties of the API surface rather than promises about plugin behaviour. A capability that does not exist cannot be requested, misused or granted by mistake.
| Boundary | How it is enforced |
|---|---|
| Read a stored credential | No call returns one. A plugin can ask whether a credential exists and can hand one over; the value is attached to requests by the host and never enters the plugin’s context. |
| Send a credential somewhere else | Each credential is bound in the manifest to a single host and header. The host attaches it only to requests bound for that host. |
| Reach an undeclared host | HTTPS only, hosts matched exactly with no wildcards, redirects not followed, responses capped at 5 MB. |
| Touch arbitrary files | There is no filesystem API. A plugin’s storage is one JSON file keyed by its own identifier, with no path to name, capped at 4 MB and 2,000 keys. |
| Write to disk quietly | The only way out is a save panel. The panel is the consent, so there is no path argument for a plugin to choose. |
| Force push, reset or merge | No such calls exist. Pull is fast-forward only, and a diverged push is rejected by git itself. |
| Discard your changes without asking | The host puts that confirmation on screen itself, in front of the call, because a plugin cannot show a dialog and one that could would be the wrong thing to trust with it. |
| Load on a host that is too old | A plugin declares the API generation it was written against, and an older app refuses to load it and says so rather than losing half its panel silently. |
Read from the Linelark Studio 1.4.0 source, not from its documentation. Where the two disagree, this is the one that ships.
Before you rely on it
The mechanisms above are real and testable. The parts that are not mechanical are worth naming, because a trust page that only lists strengths is not a trust page.
Free, and staying free
Apple-notarized, macOS 14 and newer, Intel and Apple silicon.
Choose a release 6.5 MB · versioned checksums on the download page