Programs

With exec:<program> in its manifest, a plugin can run that program and no other:

const dir = await this.app.files.temp()
await this.app.files.write(`${dir}/book.html`, book.html)
const res = await this.app.exec.run('pandoc', ['book.html', '-o', 'book.odt'], { cwd: dir, timeout: 120_000 })
if (res.code !== 0) throw new Error(res.stderr || 'Pandoc failed')
const odt = await this.app.files.read(`${dir}/book.odt`)

How it runs:

The program: found by name on the PATH, as the system would find it. A path isn't accepted, and a program that isn't installed is an error that says so.
Arguments: go to it as given, with no shell. $HOME, ;, | and * are just characters.
input: goes to its standard input.
cwd: a folder the writer chose for the plugin, or its temporary one (the default).
Time and output: it's stopped after timeout (a minute unless you say, ten at most; timedOut says so), and at 50 MB of output. Anything it started is stopped with it.
Its environment: only what a program needs to find its way: PATH, HOME, the language and the like. Not Bläck Studio's own, with whatever keys and tokens it may hold.
The result: code, stdout as bytes (text() for text), stderr and timedOut.

Allowing a program means trusting the plugin with whatever that program can be made to do with the arguments it's given. Pandoc converts documents, and also runs Lua filters it's given; git runs hooks. So every exec: permission comes with a warning, and a shell, Python or Node with a stronger one. Ask only for the programs you need, and say in your description what you run them for.

#Programs

Programs