What
Every path a plugin supplies is now resolved before use and refused unless it is a plain relative path that stays inside the marketplace's own directory. Absolute paths, .. segments that climb out, network-style paths, and anything routed through a symlink are all rejected rather than resolved. This covers plugin and marketplace installs, replacing looser lookups, and extends to tools that take a directory path from a plugin, such as skill and filesystem tools.
Details
- A refused install path produces a message naming the offending path and directing you to give the marketplace entry a plain relative path.
- For plugin-supplied directory arguments, the path must be canonical as well as local, so symlinked or relative-segment routes fail with
must be canonicalinstead of being normalised. - Validation is unconditional and enforced at the schema level, with no flag, setting, or environment variable to relax it.
Evidence
Plugin source path refused: ${or(e, 300)} does not stay inside its marketplace directory. Check that the marketplace entry has a plain relative path., must be canonical
Strings lifted out of the shipped bundle, so the claim above can be checked against them.