Expand description
Addon bootstrap engine (#1105, Phase 2): install an addon’s upstream package
through a real package manager as part of addon add, idempotently and
with mandatory version pinning — then uninstall it on addon remove.
Security model — the engine never goes through a shell. Each supported
Manager owns its argv template; the manifest only supplies package +
version (validated to be pinned and free of shell metacharacters), and the
engine inserts them as discrete argv elements via std::process::Command.
Because there is no string interpolation into a shell, a hostile registry
entry cannot inject a command — the worst it can do is name a different
package, which is already disclosed in the install preview and audited.
The manager binary is resolved from PATH by default, or pinned to an exact
path via LEANCTX_BOOTSTRAP_<MANAGER> (e.g. LEANCTX_BOOTSTRAP_UV=/opt/uv)
for locked-down / enterprise environments.
Structs§
- Addon
Install - The
[install]block — howaddon addprovisions the addon’s upstream package before wiring its[mcp]server. Absent (all-empty) ⇒ the addon is either an ephemeral runner (npx/uvx, installs lazily on first spawn) or already on the host; no bootstrap runs. - Bootstrap
Outcome - Result of a successful
ensure_installed. - Install
Receipt - What
[install]actually did, persisted ininstalled.jsonsoremovecan uninstall exactly whataddinstalled.
Enums§
- Bootstrap
Status - Outcome of
ensure_installed. - Manager
- A supported package manager. The set is closed on purpose: the engine only runs managers whose install/uninstall argv it fully controls.
Functions§
- ensure_
installed - Provision
install’s package idempotently. Returns immediately if it is already satisfied; otherwise runs the manager (streaming its output so the user sees real progress) and re-checks. A non-zero manager exit is an error; a clean exit whose binary is not yet on PATH is a non-fatal warning. - uninstall
- Uninstall a previously bootstrapped package (best-effort; the caller logs a note on failure rather than blocking the unwire).