Stateless read-only preview of a candidate plugin tarball: verify its signature, parse its manifest, and report its settings schema WITHOUT installing anything

Changed on
post/api/v1/admin/plugins/inspect

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header x-admin-token
    • HTTP bearer

Request body

filestring required
tarball_b64string required

Response

{name, version, kind, schema, schema_error, trust, source, restart_required_default}: the same shape GET /plugins/{file}/schema carries, plus name/version/kind; an untrusted/rejected candidate is reported (trust), never refused

kindstring nullable

The plugin's kind (hook | secret | …) from its manifest. Both GET /plugins/{file}/schema and POST /plugins/inspect emit it (null only when the plugin cannot be resolved to a manifest). Declared so codegen'd clients keep it.

namestring required
restart_required_defaultboolean nullable

The kind-derived restart-scoping default (busbar_plugin_sign::kind_restart_default), so busbar-ui need not hardcode the kind→default table. Emitted by both schema endpoints (null only when the plugin has no resolvable manifest/kind). Declared so codegen'd clients keep it.

schemaunknown required
schema_errorstring nullable required

Set only when the manifest's settings_schema was present but failed to parse as JSON; null for a manifest that genuinely never set the field. Never collapsed into a bare schema: null: a present-but-corrupt schema is a real authoring/packaging bug, not "this plugin simply has none."

sourcestring required

"describe" when a currently-loaded kind: hook answered its live describe wire message (the existing describe-proxy behavior, unchanged); "manifest" otherwise. Lets busbar-ui explain "why does this form look different from what I expected" without implementing the describe/manifest precedence rule itself.

truststring required

"trusted" | "unverified" | "rejected": the same vocabulary the plugin catalog already uses (never "verified").

versionstring nullable

The plugin's semantic version from its manifest. Present on POST /plugins/inspect (which previews an on-disk candidate's manifest); null/absent on GET /plugins/{file}/schema, which does not surface the version. Declared here so a codegen'd client keeps the field the inspect handler always sends, rather than silently dropping it.

Changes