Refuse path-trust migration from corrupt stores

Author: TheGreatAxios

src/trust/path-trust.ts

@@ -189,6 +189,13 @@ export async function revokePathPlugin(
  * (expand marketplaces, drop missing paths). Callers supply expansion so this
  * module stays free of the plugin loader. `onMigrated` fires only on the run
  * that seeds grants, so callers can surface the one-time event to the user.
+ *
+ * A corrupt store (`invalid`: unreadable, zero-byte, or malformed) refuses to
+ * seed: re-granting from `pluginPaths` here would undo an explicit revoke the
+ * moment the file becomes unreadable. Migration leaves the file untouched and
+ * returns no grants, so path plugins load metadata-only until the user either
+ * repairs the file (deleting it restores first-launch seeding) or re-consents
+ * explicitly through add-by-path / enable.
  */
 export async function migratePathTrustFromPluginPaths(
   pluginPaths: string[],
@@ -200,6 +207,10 @@ export async function migratePathTrustFromPluginPaths(
   if (existing.state === "valid") {
     return existing.store;
   }
+  if (existing.state === "invalid") {
+    logger.warn`refusing path-trust migration from a corrupt store at ${pathTrustPath(home)}: delete the file to re-seed from settings.pluginPaths or re-consent through add-by-path`;
+    return emptyStore();
+  }
   if (pluginPaths.length === 0) {
     return emptyStore();
   }

tests/unit/path-trust.test.ts

@@ -240,39 +240,52 @@ describe("path-trust (global)", () => {
     }
   });
 
-  test("a zero-byte store file is invalid and migration re-seeds it", async () => {
+  test("a zero-byte store file is invalid and migration refuses to seed it", async () => {
     const { home, cleanup } = await scratch();
     try {
       await writeStoreFile(home, "");
       expect((await readPathTrustStore(home)).state).toBe("invalid");
 
       const plugin = join(home, "shared", "plugin");
+      let resolveCalls = 0;
       const store = await migratePathTrustFromPluginPaths(
         [plugin],
-        async () => [plugin],
+        async (p) => {
+          resolveCalls += 1;
+          return [p];
+        },
         home,
       );
-      expect(isPathPluginTrusted(store, plugin)).toBe(true);
-      expect((await readPathTrustStore(home)).state).toBe("valid");
+      expect(isPathPluginTrusted(store, plugin)).toBe(false);
+      expect(store.trustedPluginPaths).toEqual([]);
+      expect(resolveCalls).toBe(0);
+      expect((await readPathTrustStore(home)).state).toBe("invalid");
     } finally {
       await cleanup();
     }
   });
 
-  test("a corrupt store file is invalid, loads empty, and migration re-seeds it", async () => {
+  test("a corrupt store file is invalid, loads empty, and migration refuses to seed it", async () => {
     const { home, cleanup } = await scratch();
     try {
       await writeStoreFile(home, "{not json");
       expect((await readPathTrustStore(home)).state).toBe("invalid");
       expect((await loadPathTrust(home)).trustedPluginPaths).toEqual([]);
 
       const plugin = join(home, "shared", "plugin");
+      let resolveCalls = 0;
       const store = await migratePathTrustFromPluginPaths(
         [plugin],
-        async () => [plugin],
+        async (p) => {
+          resolveCalls += 1;
+          return [p];
+        },
         home,
       );
-      expect(isPathPluginTrusted(store, plugin)).toBe(true);
+      expect(isPathPluginTrusted(store, plugin)).toBe(false);
+      expect(store.trustedPluginPaths).toEqual([]);
+      expect(resolveCalls).toBe(0);
+      expect((await readPathTrustStore(home)).state).toBe("invalid");
     } finally {
       await cleanup();
     }