Module plugin_git 

Git-backed plugin distribution: add, update, remove.

The par-term plugin add|update|remove CLI subcommands and their Settings UI equivalents run through this module. Everything shells out to the git binary (the same pattern as the root crate’s status-bar git poller) rather than adding a git crate, and EVERY invocation runs with GIT_TERMINAL_PROMPT=0 under a hard deadline: these calls run inside the GPU process (Settings UI) where an auth prompt has no terminal to answer it. The env var covers git’s own prompts; the deadline is the backstop for prompts it cannot reach — an ssh passphrase ask writes to the controlling tty directly, and the kill turns that hang into an error.

Security shape (board card 01a0c5253b287cb39a11bf6182634197):

• add clones to a staging directory first (a clone target named by the URL says nothing about the manifest id, which must equal the final directory name), validates the manifest on the final path, and refuses to overwrite an existing target. Plugins land disabled by construction: nothing here touches the enabled set.
• update fetches, shows a diff, and fast-forwards only. A history rewrite upstream is refused, never reset — the trust model rests on the user reading plugin code before enabling it, and a reset would silently discard exactly that (decision D3).
• remove only touches directories add could have created: a .git directory WITH an origin remote. A hand-copied plugin (no .git) and a bare git init (no remote) are both refused.

Structs

UpdatePreview

A fetched-but-not-applied update, for display before the fast-forward runs.

Functions

add

Clone url into root under the plugin’s manifest id, validating the result. Refuses non-URL sources (decision D1: local installs stay the documented hand-copy), refuses an existing target directory by naming it, and removes everything it staged on any failure. The plugin lands disabled: enabling is a separate config step nothing here performs.

is_git_installed

True when dir looks installed by add: a .git directory with an origin remote. Hand-copied plugins have no .git; a bare git init has .git but no remote. The Settings UI uses this to decide which rows offer Update/Remove.

remove

Remove a git-installed plugin directory. Refuses anything add could not have created: no .git directory (hand-copied), or .git without an origin remote (a bare git init).

update_apply

Fast-forward a git-installed plugin to the fetched upstream. Refuses when a fast-forward is impossible — never resets. Nothing is changed on refusal; if upstream rewrote history, removing and re-adding the plugin is the user’s explicit way to take the rewritten version (decision D3).

update_fetch

Fetch upstream for a git-installed plugin and describe what applying would bring, without applying anything — the user sees this diff before the fast-forward runs.