Runtime Security

This page explains the isolation and permission model for the P!npoint plugin runtime.

Worker Runtime

P!npoint does not import plugin entry code directly into the main window.

Plugin logic runs inside a Worker and communicates with the app through message passing.

Bridge Permission

Every bridge API call is checked against permissions in manifest.json.

For example, readTextFile and listProjectFiles require project:read.

Project Boundary

readTextFile cannot read files outside the currently opened project root.

Relative and absolute paths must resolve inside the project root.

Diff Boundary

diffAnalyzer can read Snapshot/Diff data but cannot modify files.

UI Boundary

workspacePanel output is rendered through a sandboxed iframe.

Plugin panel HTML cannot directly mutate the P!npoint app DOM.

Third-Party Status

Plugin Beta is a preparation step before opening the third-party ecosystem.

Unreviewed third-party catalog publication and arbitrary network bridge access are not open yet.