[oldwinter]

Summary

• require every enabled community plugin to have a committed main.js and a manifest whose id matches its directory
• restore the exact Omnisearch 1.15.2 manifest from the repository commit that contains the same main.js bytes
• restore the exact Hot Reload 0.3.0 release manifest after matching the committed main.js SHA-256
• remove three enabled entries whose committed bundles do not match any available upstream release, instead of guessing manifest versions

Verification

• red test before the fix: mermaid-popup/manifest.json is missing
• node --test scripts/test-plugin-manifest-ignore.mjs
• node --test scripts/*.mjs
• byte comparison against pjeby/hot-reload release 0.3.0 manifest
• byte comparison against the Omnisearch manifest at repository parent commit 4bf059749d382571d0f5bb25df80a43da6a30ed6
• sensitive plugin data.json and the private plugin directory remain ignored

Closes #112

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.