{"version":"2.1.242","anchor":"plugin-hook-code-is-parsed-and-rejected-unless-it-follows-a-","canonical_anchor":"plugin-hook-code-is-parsed-and-rejected-unless-it-follows-a-","heading":"Plugin hook code is parsed and rejected unless it follows a strict shape","tier":"soon","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/plugin-hook-code-is-parsed-and-rejected-unless-it-follows-a-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Plugin hook code is parsed and rejected unless it follows a strict shape\n\nPlugin hook code is parsed and rejected before running if it strays outside a narrow shape.\n\n**What**\n\nBefore a plugin's hook file runs, its source is parsed and walked, and anything that does not match a narrow permitted shape is refused with the file name, the line and an excerpt. This makes what a hook can do checkable before execution rather than after.\n\n**Details**\n\n- The file must export a register function taking the event registrar and options, and event names must be plain string literals naming real events.\n- Every use of the plugin API object must be written out fully at the call site. Storing it in a variable, spreading it, shadowing it, reading arguments, or using computed property access all cause a refusal.\n- At runtime the host also checks that a plugin only calls the operations its scan found.\n- The whole hooks host is behind the tengu_plugin_hooks_modules rollout flag.\n\n**Evidence**\n\n`$ is always spelled $.noun.event(...) at the call site, and on is always on(\"<event>\", hook)`\n\n- Area: Plugins\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}