fix: resolve Linux FFI signature mismatch for main_l_get_tab_owner

Author: 989tqT

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -39,7 +39,7 @@ body:
     id: plugin
     attributes:
       label: "Relevant Plugin (If Applicable)"
-      description: "If this issue is related to a specific WebAssembly plugin (such as pTerm), specify its name and version."
-      placeholder: "e.g., pTerm vx.x.x"
+      description: "If this issue is related to a specific WebAssembly plugin, specify its name and version."
+      placeholder: "e.g., plugin vx.x.x"
     validations:
-      required: false
+      required: false 

CHANGELOG.md

@@ -9,6 +9,11 @@
 * Shared WASM compilation module `tests/build_utils.py` to enforce `--allow-undefined` linker flags globally across all plugin builds.
 * Automated target binary copying and caching for Linux production builds.
 * Custom structured issue templates (Bug Report, Feature Request, Plugin Submission) and a Pull Request template in `.github/`.
+* Platform-agnostic OS detection FFI `host_get_platform` returning compile-time host platform evaluation (0 for Windows, 1 for Linux) to eliminate brittle environment variable parsing.
+* Linux shell executor backend (`sh.rs`) executing `/bin/sh -c` queries for the `pTerm` plugin.
+* Shell blacklisting security reinforcement: added `dash` shell to the banned executable list in the sandbox to block unauthorized access by untrusted plugins.
+* Shared `get_plugins_dir()` utility in `utils.rs` for consistent cross-platform plugin storage path resolution (`$HOME/.plug/plugins` on Linux, `%SystemDrive%\.plug\plugins` on Windows).
+* Permission gates for `get_env` and `net_post` WASM host imports — load-time import validation and runtime call-time enforcement against `plugin.toml` declarations.
 
 ### Fixed
 * Linux CI cross-compilation failure (`x86_64-pc-windows-gnu` target) — removed orphaned `.cargo/config.toml` that forced incorrect target resolution on Linux runners.
@@ -21,6 +26,14 @@
 * Linux production linker `undefined reference to 'g_headless_mode'` — guarded `extern "C"` declaration in `main_l.cpp` under `#ifdef PLUG_ENABLE_HEADLESS_MODE`; production builds now use `static constexpr bool g_headless_mode = false` with zero runtime cost.
 * GCC `-Wextern-initializer` warning in `main.cpp` — changed `extern "C" bool g_headless_mode = false` to block-form `extern "C" { bool g_headless_mode = false; }`.
 * Process hang on `/e` exit in headless mode — `g_cmd_thread` was blocking indefinitely on `g_cmd_cv.wait()`; `main_l_cleanup()` now sets `g_cmd_thread_running = false`, notifies the CV, and joins the thread before returning so the process exits cleanly within the test timeout window.
+* Headless CI broken pipe (`test_cli_lifecycle`) — moved `g_cmd_thread` and `g_headless_stdin_thread` startup from `on_tick()` frame-clock callback to `on_activate()` so stdin reader is live before any test data arrives; frame-clock callbacks are not guaranteed to fire before GApplication idle-hold expires under `xvfb-run`.
+* Linux `test_sandbox_rules` 120s timeout — plugin directory was hardcoded to `C:\.plug\plugins` (Windows-only); corrected to `$HOME/.plug/plugins` matching `proc.rs` `c_init()` runtime logic.
+* FFI Windows-centric symbol leakage — renamed `main_w_add_tab` to platform-neutral `host_add_tab` across `plugin_mgr.rs`, pTerm manifests, source plugin files, and test mocks (`ok_plugin.rs`, `rogue_plugin.rs`, `rogue_plugin_runtime.rs`) to prevent load-time link failures.
+* `pTerm` Linux shell execution compatibility — resolved execution errors on Linux hosts by adding `/sh` routing to the command parser, introducing the Linux shell backend, defaulting shell mode dynamically on Unix targets, and mapping E2E test assertions to platform-specific outputs.
+* Linux plugin install/delete path mismatch — `/plug` and `/plug-` handlers in `c_plug/mod.rs` and `c_plug/del/mod.rs` were hardcoded to `%SystemDrive%\.plug\plugins` (Windows-only); aligned with `c_init()` using shared `get_plugins_dir()` so Linux installs to `$HOME/.plug/plugins`.
+* Plugin dispatch race condition — `dispatch_plugin_cmd()` no longer removes the plugin instance from the in-memory registry during async execution; per-plugin execution locks serialize concurrent invocations instead.
+* README and startup banner exit command typo — corrected `/e-` references to `/e` in `main.cpp` and `main_l.cpp`.
+* FFI input sanitization — `c_parse()` routes command arguments through `to_c_string()` to strip embedded null bytes before CString conversion.
 
 ---
 

README.md

@@ -54,6 +54,9 @@ cd plug.cross/linux && ./make.sh
 | `/?` | None | Displays help details. |
 | `/a` | None | Displays system environment and memory statistics. |
 | `/tab` | None | Spawns a new workspace tab. |
+| `/cmd` | `[query]` | Spawns a Windows Command Prompt tab or executes a CMD query. |
+| `/ps` | `[query]` | Spawns a Windows PowerShell tab or executes a PowerShell query. |
+| `/sh` | `[query]` | Spawns a Linux shell tab or executes a shell query. |
 | `/plug*` | None | Lists available online registry plugins and hashes. |
 | `/plug` | `[hash]` | Downloads and initializes a plugin. |
 | `/plug-` | `[hash]` | Unloads the specified plugin. |

docs/ARCHITECTURE.md

@@ -18,46 +18,14 @@ The framework splits operations into two layers connected via C FFI:
 
 ### C++ Functions (Called by Rust / Plugins)
 - `main_*_print_info(str)` / `main_*_print_error(str)`: Output logs to active text buffers.
-- `main_*_add_tab(name)`: Spawns a new tab context.
+- `main_*_add_tab(name)`: Spawns a new tab context. Note that the WASM FFI layer exposes a platform-neutral import named `host_add_tab` which the host runtime routes to these platform-specific functions.
 - `main_*_set_prompt_visibility(visible)`: Controls standard input prompt fields.
-- `main_*_get_tab_owner(idx)` / `main_*_set_tab_owner(idx, name)`: Syncs tab ownership state.
+- `main_*_get_tab_owner(idx, buf, max_len)` / `main_*_set_tab_owner(idx, name)`: Syncs tab ownership state. The `get` function writes the owner string into `buf` up to `max_len` to ensure buffer safety and avoid ABI crashes.
 
 ---
 
 ## Command Routing & Permissions
 
 Inputs starting with `/` invoke built-in commands (e.g., `/tab` or `/plug`). Other inputs are dispatched to the WASM plugin owning the active tab.
 
-If a plugin requests access to sensitive FFI imports (such as `host_exec` to run local shell subprocesses), the runtime validates its manifest permissions list (`plugin.toml`) before delegating the call to the host OS.
-
----
-
-## Security Model & Sandbox Limits
-
-### 1. The FFI Gate Architecture
-The WebAssembly sandbox isolates memory space and prevents direct OS API execution. System capabilities are exposed exclusively through imported FFI functions. The core runtime acts as a **binary gate**:
-- When a plugin attempts an operation (e.g., `host_exec`), the host runtime checks if the permission is listed in the plugin's manifest.
-- **Escape Vector by Design**: If a plugin is granted `host_exec` permission, the WASM boundary is crossed. A plugin with `host_exec` can potentially launch processes and interact with the host OS, making it a critical capability.
-
-### 2. Execution Containment for Untrusted Plugins
-For third-party or untrusted plugins that require `host_exec` to run specific external tasks, the host runtime applies strict validation checks:
-- **Interpreter / LOLBin Ban**: Common shell binaries (`cmd.exe`, `powershell.exe`, `bash`, `python`) and code-execution LOLBins (`rundll32.exe`, `regsvr32.exe`) are explicitly banned.
-- **Canonical-Path Allowlist**: The target binary's canonical path must be explicitly mapped in the plugin manifest's `allowed_commands`.
-- **Regex Argument Filtering**: The command line arguments are evaluated against a linear-time regex pattern declared in the manifest.
-
-### 3. Trust Tiers & Shell Emulator Bypass
-Core system utilities (like the shell terminal emulator `pTerm`) require execution of host shells to operate:
-- **Compile-Time Hash Pinning**: During compilation, the builder script computes the SHA-256 hash of the compiled `pTerm.wasm` binary and embeds it directly into the host Rust library (`plugin_mgr.rs` via `pterm_hash.txt`).
-- **Trust Bypass**: If a plugin's SHA-256 matches this hardcoded trust list (`TRUSTED_PLUGIN_HASHES`), it is marked as `is_trusted`. Trusted plugins bypass the interpreter bans and allowlist validations inside `host_exec`.
-- **Tamper Protection**: If a trusted plugin is modified, its hash changes. It falls back to the standard flow, requiring an `.integrity` file, and is blocked if tampered.
-
-### 4. Cryptographic Integrity Validation
-- **Single-Read Verification**: To mitigate TOCTOU (Time-of-Check to Time-of-Use) filesystem attacks, plugin binaries are read into memory in a single syscall. The runtime computes the SHA-256 hash of this memory buffer and verifies it against the sidecar before Wasmer compiles it.
-- **Atomic Sidecar Writes**: Plugin installations write both the WASM binary and `.integrity` file to temporary files, followed by an atomic rename to prevent corrupted states.
-- **Registry Hash Pinning**: Remote plugin downloads are validated against SHA-256 hashes pinned in the official registry (`pluglists.json`) to prevent MITM attacks.
-- **Global Migration**: Pre-existing plugins are backfilled with `.integrity` files on startup, and a global marker is written. Post-migration, any loaded plugin lacking a valid `.integrity` sidecar is blocked.
-
-### 5. Upstream Dependency Security Notes
-- **Wasmer & memmap2 Soundness (`RUSTSEC-2026-0186`)**:
-  - The unsoundness vulnerability in `memmap2` (`RUSTSEC-2026-0186` for versions `< 0.9.11`) is currently ignored in [.cargo/audit.toml](file:///O:/prj/p01/.wip/plug/plug.app/rt/.cargo/audit.toml) because our current Wasmer version does not invoke the unsound functions (`advise_range` or `flush_range`).
-  - **Upgrade Checklist**: Every time `wasmer` is upgraded, the developers must audit if the new Wasmer version invokes these `memmap2` range advising/flushing routines. If it does, `memmap2` must be upgraded to a safe patched version (e.g. `>= 0.9.11`) or Wasmer must be configured to bypass those calls to maintain full system safety.
+If a plugin requests access to sensitive FFI imports (such as `host_exec` to run local shell subprocesses, `get_env` to read environment variables, or `net_post` for outbound HTTP), the runtime validates its manifest permissions list (`plugin.toml`) at load time and again at call time before delegating to the host OS.

docs/BUILD.md

@@ -22,14 +22,14 @@ Run the platform-specific scripts to compile the Rust core runtime, build WASM p
 cd plug.cross\windows
 .\make.bat
 ```
-Outputs: `release/x64/plug.exe` and `plugins/`
+Outputs: `plug.cross/release/x64/plug-x64.exe` and `plugins/`
 
 ### Linux
 ```bash
 cd plug.cross/linux
 ./make.sh
 ```
-Outputs: `release_linux_x64/plug` and `plugins/`
+Outputs: `plug.cross/release/x86_64/plug-x64` and `plugins/`
 
 ---
 

docs/PLUGIN_DEVELOPMENT.md

@@ -39,9 +39,12 @@ version = "1.0.0"
 author = "Dev"
 api_version = "xxx"
 permissions = [
-  "host_exec",         # Spawning local commands (CMD / PowerShell)
-  "main_w_add_tab",    # Spawning new tabs
-  "host_set_tab_owner" # Taking tab ownership
+  "host_exec",         # Spawning local commands (CMD / PowerShell / shell)
+  "host_add_tab",      # Spawning new tabs
+  "host_set_tab_owner", # Taking tab ownership
+  "host_get_tab_label", # Reading active tab label
+  "get_env",           # Reading host environment variables
+  "net_post"           # HTTP POST requests from plugin runtime
 ]
 ```
 

docs/TESTING_SYSTEM.md

@@ -29,15 +29,15 @@ tests/
 
 To distinguish target environment mismatches from code failures, `preflight.py` executes before the orchestrator to verify requirements:
 - **Rust Target**: Verifies `wasm32-unknown-unknown` target is installed via `rustup target list --installed`. If missing, installs it or halts with setup instructions.
-- **Version Ranges**: Checks that `cargo` and `wasmer` match the verified toolchain versions (defined as hardcoded constants inside `preflight.py`) to prevent flaky behavior.
+- **Version Ranges**: Checks that `cargo` is present and reports the configured minimum cargo version from `preflight.py`.
 - **Zero-Dependency Path-Based Orphan Cleanup**:
   - To avoid installing third-party Python modules like `psutil` in CI/dev setups, path lookup uses native command utilities.
   - **Windows**: Invokes `powershell "Get-Process plug -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Path"` to retrieve the executable path of matching active processes.
   - **Linux**: Reads `/proc/<pid>/exe` using `os.readlink()` for processes owned by the current user.
   - If a process matches the exact absolute target path of our compiled build binary in the workspace, it is terminated.
 - **OS Mapping**: Detects hosting environment parameters (`platform.system()`) to assign OS-specific configurations:
-  - Binary names: `plug.exe` (Windows) vs `plug` (Linux).
-  - Executable permissions: Performs `chmod +x` on Unix targets.
+  - Binary names: `plug-{arch}.exe` (Windows) vs `plug-{arch}` (Linux).
+  - Release directories: `plug.cross/release/{arch}` on Windows and `plug.cross/release/x86_64` for Linux x64.
   - Path separator configurations.
 - **Output**: Generates a unified `EnvContext` JSON object containing all pathing and platform context, which is forwarded to subsequent test scripts.
 
@@ -65,7 +65,7 @@ Manifest configurations (`plugin.toml`) define the permission scope of the WASM
   ```toml
   [[plugin]]
   name = "ok_plugin"
-  permissions = ["main_w_add_tab", "host_exec"]
+  permissions = ["host_add_tab", "host_exec"]
   ```
 - **`rogue_plugin` Manifest (Load-time)**:
   ```toml
@@ -76,7 +76,7 @@ Manifest configurations (`plugin.toml`) define the permission scope of the WASM
 
 WASM files check:
 - **`ok_plugin.rs`**: Baseline plugin using permitted FFI calls. Verifies normal operations and prevents false-positive test results.
-- **`rogue_plugin.rs`** (Load-time check): A plugin containing host imports not declared in its `plugin.toml` manifest permissions. Verifies that the Wasmer runtime successfully rejects module initialization.
+- **`rogue_plugin.rs`** (Load-time check): A plugin containing host imports not declared in its `plugin.toml` manifest permissions (e.g. `host_add_tab`, `get_env`, `net_post`). Verifies that the Wasmer runtime successfully rejects module initialization.
 - **`rogue_plugin_runtime.rs`** (Runtime check): A plugin with valid import declarations that calls `host_exec` with arguments exceeding its permission scope (or attempts prohibited actions). Verifies that the runtime correctly catches and traps the thread during runtime execution.
 
 ### 3.3 Unit Tests (`tests/unit/`)
@@ -94,8 +94,8 @@ WASM files check:
   - `rogue_plugin_runtime sandbox trap check` (runtime execution containment).
   - `ok_plugin integrity mismatch check` (tampered WASM with stale `.integrity` sidecar is blocked).
   - `Global migration and post-migration bypass checks` (**Plan Cases A & B**: one-time global migration backfill validation and post-migration missing sidecar blocking).
-  - `Trusted plugin bypass integrity file check` (**Plan Case C**: verifies `pTerm` with valid compiled hash loads successfully without sidecar and executes a real `dir` command via `host_exec`).
-  - `Tampered trusted plugin block check` (**Plan Case D**: verifies tampered `pTerm` is blocked and fails-closed).
+  - `Trusted plugin bypass integrity file check`
+  - `Tampered trusted plugin block check`
 
 ### 3.5 End-to-End Tests (`tests/e2e/`)
 - **`test_cli_lifecycle.py`**: Spawns the production compiled `plug` executable under test scenarios using `subprocess.Popen` with `HIDE_CONSOLE=ON` (the standard production build configuration to ensure we test the identical binary shipped).

docs/plugins/README.md

@@ -8,4 +8,4 @@ Currently, the following official plugins are deployed and verified:
 
 | Plugin Name | Version | Description | Documentation Link |
 |---|---|---|---|
-| **pTerm** | `1.0.0` | Default core terminal runner plugin bridging WASM container to host shells. | [Details](catalog/pTerm.md) |
+| **pTerm** | `1.0.1` | Default core terminal runner plugin bridging WASM container to host shells. | [Details](CATALOG/pTerm.md) |

docs/plugins/catalog/pTerm.md

@@ -6,8 +6,8 @@
 
 ## 1. Specifications
 
-- **Role**: Spawns and manages CMD and PowerShell sessions inside dedicated UI tabs.
-- **Required Permissions**: `host_exec`, `main_w_add_tab`, `host_set_tab_owner`, `host_get_tab_label`.
+- **Role**: Spawns and manages CMD, PowerShell (Windows), and sh (Linux) sessions inside dedicated UI tabs.
+- **Required Permissions**: `host_exec`, `host_add_tab`, `host_set_tab_owner`, `host_get_tab_label`.
 - **Trust Tier**: Recognized as a trusted core utility by matching the compile-time hardcoded SHA-256 hash list. Bypasses the sandbox interpreter bans (shells block) and canonical-path allowlist checks.
 
 ---
@@ -27,9 +27,9 @@ The diagram below illustrates the exact control flow when a user runs a shell co
      |
      v
 [WASM Sandbox (pTerm.wasm)]
-  1. Calls `get_args` to retrieve input ("dir")
-  2. Resolves active tab mode (PowerShell vs CMD)
-  3. Prepend shell execution wrapper (e.g. `cmd /c dir` or `powershell -Command "dir"`)
+  1. Calls `get_args` to retrieve input (e.g. "dir" or "ls")
+  2. Resolves active tab mode (PowerShell, CMD, or SH)
+  3. Prepend shell execution wrapper (e.g. `cmd /c dir`, `powershell -Command "dir"`, or `sh -c "ls"`)
      |
      v
 [Rust Host Runtime] -> 1. Verifies memory buffer SHA-256 matches compile-time TRUSTED_PLUGIN_HASHES
@@ -43,16 +43,18 @@ The diagram below illustrates the exact control flow when a user runs a shell co
 
 ## 3. Operations Routing
 
-### Spawning a new Sub-Shell (`/cmd` or `/ps`)
-1. User types `/cmd` or `/ps`.
+### Spawning a new Sub-Shell (`/cmd`, `/ps`, or `/sh`)
+1. User types `/cmd`, `/ps`, or `/sh`.
 2. Rust router catches the command and invokes the `pTerm` module with initialization arguments.
-3. `pTerm` calls `main_w_add_tab("pTerm")` to request a new UI tab from the host.
-4. `pTerm` labels the tab owner name as `"CMD"` or `"PS"` using the `host_set_tab_owner` hook.
+3. `pTerm` calls `host_add_tab("pTerm")` to request a new UI tab from the host.
+4. `pTerm` labels the tab owner name as `"CMD"`, `"PS"`, or `"SH"` using the `host_set_tab_owner` hook.
 5. The tab context is initialized, and the user can now type terminal commands directly.
 
 ### Running Subprocess Commands
-1. User types `git status` in a tab labeled `"PS"`.
+1. User types `git status` in a tab labeled `"PS"` (or `ls -la` in a tab labeled `"SH"`).
 2. The input does not start with `/`, so Rust router resolves the active tab owner (`"pTerm"`) and delegates the call.
-3. `pTerm` checks the tab label, matches it to `"PS"`, and reformats the command:
-   `powershell -NoProfile -Command "git status"`
+3. `pTerm` checks the tab label:
+   - Matches `"PS"` -> reformats to: `powershell -NoProfile -Command "git status"`
+   - Matches `"CMD"` -> reformats to: `cmd /c "git status"`
+   - Matches `"SH"` -> reformats to: `sh -c "ls -la"`
 4. `pTerm` calls `host_exec` to execute the string on the host OS, streaming the outputs directly to the UI rendering buffers.

plug.app/cmn/inc/sys/api/linux/main_l.h

@@ -2,7 +2,7 @@
 #define MAIN_L_H
 
 #ifdef __cplusplus
-// Forward declare for C++ code
+// forward declare for c++ code
 typedef struct _GtkWidget GtkWidget;
 
 #include <vector>
@@ -94,6 +94,14 @@ void main_l_cleanup(void);
 void main_l_print_banner(void);
 void main_l_print_info(const char* msg);
 void main_l_print_error(const char* msg);
+void main_l_set_prompt_visibility(int visible);
+void main_l_add_tab(const char* owner);
+void main_l_request_close(void);
+void main_l_replace_last_line(const char* msg);
+void main_l_set_tab_owner(int tab_idx, const char* owner);
+int main_l_get_tab_owner(int tab_idx, char* buf, int max_len);
+void main_l_set_tab_cwd(int tab_idx, const char* cwd);
+int main_l_get_current_print_tab(void);
 
 #ifdef __cplusplus
 }