Namespace plugin-emitted hook events to plugin.<id>.*

[DavidBabinec]

Summary

Security fix: any plugin granted cms.hooks could forge core/system events. handleHooksEmit (server/plugins/host/handlers/hooks.ts) passed the plugin-supplied event name straight to hookBus.emit, so plugin A could fire a fake content.entry.created at plugin B's listeners or spoof settings.changed / publish.before / publish.after.

Plugin-emitted events are now force-namespaced to plugin.<pluginId>.<name> by the host, making event provenance explicit and unforgeable. The contract (one coherent rule — auto-prefix, never spoof):

• a bare name (sync.done) is delivered as plugin.<id>.sync.done — including reserved core names, so a raw emit of content.entry.created becomes the harmless plugin.<id>.content.entry.created
• a name already in the plugin's own namespace passes through unchanged (no double prefix)
• a name in another plugin's namespace (plugin.<other-id>.*) is rejected with a clear impersonation error
• subscriptions (cms.hooks.on) stay unrestricted — cross-plugin eventing works by listening to the full namespaced name
• cms.hooks.emit now resolves to the canonical namespaced name

Changes

• server/plugins/host/handlers/hooks.ts — kernel of correctness: handleHooksEmit canonicalizes via the worker-verified msg.pluginId (never plugin-supplied data) and replies with the canonical name
• src/core/plugins/hookBus.ts — canonicalPluginEventName() + CORE_HOOK_EVENTS as the single source of truth for reserved host events (settings.changed, content.entry.created/updated/deleted, publish.before/after); HookBus.emit is typed CoreHookEvent | PluginScopedHookEvent, so a host emit site cannot introduce a core event without adding it to the list (compile-time anti-drift)
• src/core/plugin-sdk/types/hooks.ts — ServerPluginHooksApi.emit documents the namespacing and returns Promise<string> (the canonical name); fixed the cross-plugin naming example
• server/plugins/quickjs/bootstrap/src/buildApi.ts — VM-side contract comment; bun run bootstrap:sync ran (generated artifacts byte-identical — comments are stripped by bundling; plugin-bootstrap-fresh.test.ts green)
• docs/features/plugin-system.md — namespace rule, reserved host-event list, cross-plugin listening; removed the phantom media.uploaded event (documented but never emitted)
• Editor-side plugin API exposes no hook emit (src/core/plugins/runtime.ts / events.ts are unrelated surfaces) — nothing to change there
• examples/plugins/template/ does not use hooks.emit — unchanged

Tests

• src/__tests__/plugins/pluginHookBus.test.ts — unit coverage of all four canonicalization rules + host core emits still reaching bare-name listeners
• src/__tests__/server/pluginServerRuntime.test.ts — new end-to-end test through real plugin install/activate: bare emit lands namespaced; forged content.entry.created never reaches core-name listeners; self-prefixed emit not double-prefixed; other-namespace emit rejected with a clear error; emit resolves to the canonical name
• Updated existing tests that listened on raw plugin-emitted names (cmsPlugins.test.ts, pluginServerRuntime.test.ts, pluginVmPermissions.test.ts)

Verification

• bun test — 4915 pass, 0 fail
• bun run build (tsc -b && vite build) — clean
• bun run lint — clean

🤖 Generated with Claude Code