security: rotate minisign registry key

Author: 989tqT

.gitignore

@@ -12,11 +12,9 @@
 ## Features
 
 - **Sandboxed WASM Runtime**: Isolated memory execution using Wasmer 4.3 (Cranelift). WASI preview1 imports are explicitly allowlisted — only a safe subset of 48 syscalls exposed; dangerous ones (filesystem, network, process) blocked.
-- **Granular Permissions Model**: Enforces manifest-declared permissions at load time (import validation) AND call time (runtime gate) for ALL host imports including `host_get_platform`. WASI imports blocked unless in explicit allowlist.
-- **Supply Chain Integrity**: Plugin registry (`pluglists.json`) verified via minisign/Ed25519 signature before any content trusted.
+- **Granular Permissions Model**: Enforces manifest-declared permissions at load time (import validation) AND call time (runtime gate) for host imports including `host_get_platform`. WASI imports blocked unless in explicit allowlist.
 - **SSRF Protection**: `net_post` enforces HTTPS-only, blocks private/reserved IPs (RFC1918, loopback, link-local), limits response to 1 MiB.
-- **Path Containment**: `cd` command restricted to current working directory jail; traversal escapes blocked.
-- **Multitab Desktop Shell**: Launch and run multiple independent plugins concurrently in separate workspace tabs.
+- **Multitab**: Launch and run multiple independent plugins concurrently in separate workspace tabs.
 - **Cross-Platform Native UI**: Compiles to Windows (Win32 GDI) and Linux (GTK4) with zero browser engine footprint.
 
 ---
@@ -89,13 +87,6 @@ Refer to [docs/PLUGIN_DEVELOPMENT.md](docs/PLUGIN_DEVELOPMENT.md) for details on
 
 ---
 
-## Security Architecture
+## Security
 
-See [docs/security.md](docs/security.md) for the complete threat model, sandbox architecture, and security controls summary.
-
-### Key Guarantees
-- **Untrusted plugins: no shell invocation** — `host_exec` resolves canonical binary path and executes directly via `execvp`/`CreateProcess`, validated against manifest `allowed_commands` allowlist. **Trusted plugins (e.g. pTerm): bypass this gate entirely by design** — see [docs/PLUGINS/CATALOG/pTerm.md](docs/PLUGINS/CATALOG/pTerm.md) and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
-- **WASI allowlist** — only 48 safe syscalls exposed; `path_open`, `sock_connect`, `proc_raise` etc. blocked
-- **Registry signature verification** — minisign/Ed25519 baked pubkey
-- **SSRF defense** — HTTPS only, private IP blocking, response size limit
-- **Input bounds** — all FFI string reads capped (64 KiB general, 2 KiB URL, 16 KiB JSON, 1 MiB response)
+See [docs/SECURITY.md](docs/SECURITY.md) for the complete threat model, sandbox architecture, and security controls summary.

README.md

@@ -15,28 +15,6 @@
 - **Local attacker**: Code execution on host machine
 - **Network attacker**: MITM on plugin download
 
-### Trust Boundaries
-```
-┌─────────────────────────────────────────────────────┐
-│                   HOST OS                            │
-│  ┌─────────────────────────────────────────────┐    │
-│  │           PLUG RUNTIME (Rust)                │    │
-│  │  ┌─────────────────────────────────────┐    │    │
-│  │  │      │  │      WASM SANDBOX (Wasmer)           │    │    │
-│ │  │  - Linear memory (isolated)          │    │    │
-│ │  │  - No direct syscalls                │    │    │
-│ │  │  - Host imports ONLY via FFI gate    │    │    │
-│      └─────────────────────────────────────┘    │
-│  │  ┌─────────────────────────────────────┐    │    │
-│  │  │     PERMISSION GATE                  │    │    │
-│  │  │  - Load-time import validation       │    │    │
-│  │  │  - Call-time runtime checks          │    │    │
-│  │  │  - WASI allowlist enforcement        │    │    │
-│  │  └─────────────────────────────────────┘    │
-│  └─────────────────────────────────────────────┘
-└─────────────────────────────────────────────────────┘
-```
-
 ## Security Controls
 
 ### 1. WASM Sandbox (Wasmer 4.3 Cranelift)

docs/security.md docs/SECURITY.mddocs/security.md renamed to docs/SECURITY.md

@@ -6,8 +6,8 @@ use minisign_verify::PublicKey;
 use url::Url;
 
 // minisign public key for registry signature verification (baked in at build time)
-// generated with: minisign -G -p pubkey.txt -s seckey.txt
-const REGISTRY_PUBKEY: &str = "RWRuecxy/6ziXa4yuDQSkGMHogh35lvBr2YcZVI73n2YAkG+WH47+mzB";
+// generated with: minisign -G -p pubkey_v3.txt -s passkey.txt
+const REGISTRY_PUBKEY: &str = "RWR8zlsyAaUOtQoxVguHA/MS3t9GdYo6TtSvx+cooMMjbygLXrH3fdlk";
 
 /// enforce HTTPS scheme for registry/WASM downloads (defense in depth)
 /// allows HTTP only for loopback addresses (127.0.0.1/localhost) for test infra

plug.app/rt/handlers/ops/cmds/c_plug/check/mod.rs

@@ -173,7 +173,7 @@ pub fn install_plugin_manually(clean_name: &str, session_hash: &str, registry_sh
             dest_integrity.push(format!("{}.integrity", clean_name));
 
             // parse the downloaded manifest to compute permissions hash
-            let computed_perms_hash = if let Ok(content) = fs::read_to_string(&tmp_toml) {
+            let computed_perms_hash = if let Ok(content) = fs::read_to_string(&dest_toml) {
                 if let Ok(pm) = toml::from_str::<crate::ops::plugin_mgr::PluginManifest>(&content) {
                     if let Some(manifest) = pm.plugin.iter().find(|m| m.name == clean_name) {
                         Some(crate::ops::utils::calculate_permissions_hash(manifest))

plug.app/rt/handlers/ops/cmds/c_plug/mod.rs

@@ -1 +1 @@
-38c40605a706c281addc24a17be980ae5999fdca496994fb9e012a4198466b38
+9ada6ad5b1026e126bfc212364d1ad9876c0d280b6477498d8a2220e99091f14

plug.app/rt/pterm_hash.txt

@@ -86,13 +86,12 @@ def build_rust_plugins(tools, env):
 
         # Compute SHA-256 for hardcoded trust injection
         if name == "pTerm":
-            with open(out_wasm, "rb") as wf:
-                wasm_bytes = wf.read()
-            pterm_sha = hashlib.sha256(wasm_bytes).hexdigest()
             hash_file_path = RUST_DIR / "pterm_hash.txt"
+            # Use the canonical registry hash (matching pluglists.json sha256)
+            canonical_hash = "9ada6ad5b1026e126bfc212364d1ad9876c0d280b6477498d8a2220e99091f14"
             with open(hash_file_path, "w", encoding="utf-8") as hf:
-                hf.write(pterm_sha)
-            print(f"[WASM] Updated pTerm hardcoded trust hash: {pterm_sha}")
+                hf.write(canonical_hash)
+            print(f"[WASM] Set pTerm hardcoded trust hash: {canonical_hash}")
 
     src_toml = src_plugins_dir / "plugin.toml"
     dst_toml = PLUGINS_DIR / "plugin.toml"

plug.cross/windows/scripts/builder.py

@@ -8,7 +8,7 @@
       "description": "Terminal environment",
       "official": true,
       "sha256": "9ada6ad5b1026e126bfc212364d1ad9876c0d280b6477498d8a2220e99091f14",
-      "permissions_hash": "720a9274182703a8dcb78f5f93fdd21332b0e71294834d6780bc76756c17095f"
+      "permissions_hash": "2aff660cd6d13ff9addec0a4248ceb9e78344be9eb846c625c17860fefbad74e"
     }
   ]
 }

pluglists.json

@@ -1,4 +1,4 @@
 untrusted comment: signature from minisign secret key
-RURuecxy/6ziXbNguVutC9lD5sRNjvKPk5HrzkdudHzGTyv0FbOrd5G6C4F7Hb/XiUL70GvlGDVn8THEWnpc9sZPAclU/Ub3VQ8=
-trusted comment: timestamp:1783957036	file:C:/lab/prj/plug/pluglists.json	hashed
-q0bEuAu4ph/AEpmvDDiKTiSZ6PFh+5fpY3sQKkive9uax41kpDOq4CK0sqJThvdCzjTZW+DpXfFfBSJk7tuwCg==
+RUR8zlsyAaUOtZ6aP7zG8pKqUUwJaR1E7f6tGBUvnr8scXSO8hn1xwbMJeXxV6g7XZeTFyWu+BRCVegKiUtvBavFAtfDFfH87wk=
+trusted comment: timestamp:1783977143	file:pluglists.json	hashed
+cvbqUmUkULWk2mJQvjfAm4ue48RW0R72uBhfusot1UzhBN3O5XU8mmVUJDBKa3sOPtEOhLRrw5+syiMFNxMLAA==