@@ -33,6 +33,10 @@ import {
3333} from "./install.js";
3434import { buildNpmResolutionInstallFields, recordPluginInstall } from "./installs.js";
3535import { installPluginFromMarketplace } from "./marketplace.js";
36+import {
37+getOfficialExternalPluginCatalogEntry,
38+resolveOfficialExternalPluginInstall,
39+} from "./official-external-plugin-catalog.js";
36403741export type PluginUpdateLogger = {
3842info?: (message: string) => void;
@@ -424,6 +428,37 @@ function isDefaultNpmSpecForBetaUpdate(spec: string): { name: string } | null {
424428return null;
425429}
426430431+function resolveNpmSpecPackageName(spec: string | undefined): string | undefined {
432+return spec ? parseRegistryNpmSpec(spec)?.name : undefined;
433+}
434+435+function isTrustedSourceLinkedOfficialNpmUpdate(params: {
436+pluginId: string;
437+spec: string | undefined;
438+record: PluginInstallRecord;
439+}): boolean {
440+if (params.record.source !== "npm") {
441+return false;
442+}
443+const entry = getOfficialExternalPluginCatalogEntry(params.pluginId);
444+if (!entry) {
445+return false;
446+}
447+const officialPackageName = resolveNpmSpecPackageName(
448+resolveOfficialExternalPluginInstall(entry)?.npmSpec,
449+);
450+const requestedPackageName = resolveNpmSpecPackageName(params.spec);
451+if (!officialPackageName || requestedPackageName !== officialPackageName) {
452+return false;
453+}
454+const recordedPackageNames = [
455+params.record.resolvedName,
456+resolveNpmSpecPackageName(params.record.spec),
457+resolveNpmSpecPackageName(params.record.resolvedSpec),
458+].filter((value): value is string => Boolean(value));
459+return recordedPackageNames.includes(officialPackageName);
460+}
461+427462function resolveNpmUpdateSpecs(params: {
428463record: PluginInstallRecord;
429464specOverride?: string;
@@ -727,6 +762,11 @@ export async function updateNpmInstalledPlugins(params: {
727762record.source === "npm" && npmSpecs?.fallbackSpec === record.spec
728763 ? expectedIntegrityForUpdate(record.spec, record.integrity)
729764 : undefined;
765+const trustedSourceLinkedOfficialInstall = isTrustedSourceLinkedOfficialNpmUpdate({
766+ pluginId,
767+spec: effectiveSpec,
768+ record,
769+});
730770731771if (record.source === "npm" && !effectiveSpec) {
732772outcomes.push({
@@ -851,6 +891,7 @@ export async function updateNpmInstalledPlugins(params: {
851891timeoutMs: params.timeoutMs,
852892dryRun: true,
853893dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
894+ trustedSourceLinkedOfficialInstall,
854895expectedPluginId: pluginId,
855896 expectedIntegrity,
856897onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
@@ -919,6 +960,7 @@ export async function updateNpmInstalledPlugins(params: {
919960timeoutMs: params.timeoutMs,
920961dryRun: true,
921962dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
963+ trustedSourceLinkedOfficialInstall,
922964expectedPluginId: pluginId,
923965expectedIntegrity: fallbackExpectedIntegrity,
924966onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
@@ -1033,6 +1075,7 @@ export async function updateNpmInstalledPlugins(params: {
10331075 extensionsDir,
10341076timeoutMs: params.timeoutMs,
10351077dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
1078+ trustedSourceLinkedOfficialInstall,
10361079expectedPluginId: pluginId,
10371080 expectedIntegrity,
10381081onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
@@ -1097,6 +1140,7 @@ export async function updateNpmInstalledPlugins(params: {
10971140 extensionsDir,
10981141timeoutMs: params.timeoutMs,
10991142dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
1143+ trustedSourceLinkedOfficialInstall,
11001144expectedPluginId: pluginId,
11011145expectedIntegrity: fallbackExpectedIntegrity,
11021146onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。