Not switched on
Useful2 Signal4
Plugin hook code is parsed and rejected before running if it strays outside a narrow shape.
Static validation of plugin hook source ships with the disabled hook-module feature.
What's wrong with this entry?
Anonymous. No account, no email.
What
Before a plugin's hook file runs, its source is parsed and walked, and anything that does not match a narrow permitted shape is refused with the file name, the line and an excerpt. This makes what a hook can do checkable before execution rather than after.
Details
- The file must export a register function taking the event registrar and options, and event names must be plain string literals naming real events.
- Every use of the plugin API object must be written out fully at the call site. Storing it in a variable, spreading it, shadowing it, reading arguments, or using computed property access all cause a refusal.
- At runtime the host also checks that a plugin only calls the operations its scan found.
- The whole hooks host is behind the tengu_plugin_hooks_modules rollout flag.
Evidence
$ is always spelled $.noun.event(...) at the call site, and on is always on("<event>", hook)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.