Files
ReSkate/Extension/Plugins/plugin_manifest.h
T
AyeZeeBB 6d542536e1 Plugins: sandboxed Luau plugins in mods, phase 1 (the host, and the base, console and storage APIs)
A mod with a reskate-plugin.json is a plugin: Luau scripts that run in their own VM, with only
the reskate API ReSkate registers for them. Luau 0.741 is vendored in External/luau (the VM and
compiler only: no native code generation, no loadstring, io or C modules).

- Limits: 64 MB of memory, 50 ms a call, 2 ms a tick on average (over it for 3 s stops it),
  more than 5 errors in 10 s stops it, 50 log lines a second. A plugin over a limit cannot catch
  it in a pcall and carry on.
- API: reskate.log, on (load, unload, tick, level_loaded, level_unloading), timers, the level,
  its own package's files and JSON, require inside the package; console.command and print
  ("console"); storage get, set, add and keys ("storage"), 1 MB in
  %LOCALAPPDATA%\ReSkate\Plugins\<mod>\storage.json.
- Found every 2 s among the mods mods.json leaves on: switching a mod, or changing a plugin's
  files, loads, unloads or reloads it without a restart. A package holding a program is refused.
- plugin list, commands, reload, off and on in the console. A plugin cannot take a name of
  ReSkate's own commands.
- Tests: DINGOSDK_BUILD_PLUGIN_TESTS, including plugins written to break the sandbox.
2026-10-19 11:55:27 -05:00

33 lines
1.5 KiB
C++

#pragma once
#include <set>
#include <string>
#include <string_view>
// reskate-plugin.json, beside a mod's manifest.json, is what makes a mod a plugin:
// {"api": 1, "entry": "plugin/main.lua", "side": "client", "permissions": ["console", "storage"]}
// Thunderstore's manifest.json keeps its own rules; this file is ReSkate's alone.
namespace dingosdk::plugins {
inline constexpr char manifest_file[] = "reskate-plugin.json";
// The API this ReSkate gives plugins. A plugin written for a newer one is refused.
inline constexpr int api_version = 1;
inline constexpr std::size_t maximum_manifest_bytes = 64 * 1024;
enum class Side { client, server, both };
struct Manifest {
int api{};
std::string entry; // inside the package, as safe_relative_path leaves it
Side side{Side::client};
std::set<std::string, std::less<>> permissions;
};
// Every permission a manifest may name, including those whose APIs a later ReSkate adds, so a
// manifest written for the whole plan stays valid. The base set needs none.
bool known_permission(std::string_view name) noexcept;
// Throws std::runtime_error with a message a modder can act on.
Manifest parse_manifest(std::string_view text);
// A path a plugin names (its entry, a require, a package read) in generic form, or empty when
// it could leave the package: absolute, a drive or a stream (':'), a backslash, an empty, "." or
// ".." segment, or a character outside printable ASCII.
std::string safe_relative_path(std::string_view path);
const char* side_name(Side side) noexcept;
}