Turning plugin symlinks into real files now survives interruption and refuses unsafe targets.
tengu_hover_rest Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.234: on
Read once, for one account on one subscription tier, against v2.1.234. It isn't a statement about your account. What a flag value here can and cannot tell you
What's wrong with this entry?
The step that turns symlinks inside installed plugins into real files was reworked to survive interruption and concurrent runs, and to refuse targets it cannot safely copy.
- Has separate install and migrate modes; refuses network targets and Windows reparse points.
- Recovers entries left parked by an earlier interrupted run, keeps a scratch directory that is re-verified before every swap, and touches a heartbeat so a concurrent run can see it is alive.
- Only after all that does it write the marker recording that links were materialized.
- Copies use a stream pipeline opened refusing symlinks and without blocking, preserving the exact file mode.
- Dependency installs must first withdraw the marker and record liveness, otherwise the install is refused. The storage-backed liveness marker path is gated on
tengu_hover_rest.
plugin cache staged copy replaced before the swap
Strings lifted out of the shipped bundle, so the claim above can be checked against them.