fix(sdk): fail closed on hosted extension dispatch - #549

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

CI follow-up at 989f7483: the failure was the closed preflight refusal-taxonomy guard. The dispatcher introduced plugin_event_ambiguous, but the exhaustive corpus did not yet exercise that code path. The corpus now constructs two installed-extension handler surfaces claiming the same normalized github pull_request.labeled event, calls the real dispatcher, captures the typed PluginError, and keeps the exact taxonomy assertion intact.

Literal targeted verification:

$ npm run typecheck --prefix packages/sdk
> @relayflows/sdk@2.0.25 typecheck
> tsc --noEmit && tsc -p tsconfig.type-tests.json

$ npm run build --prefix packages/sdk
> @relayflows/sdk@2.0.25 build
> tsc && node scripts/make-cli-executable.mjs

$ npm run typecheck:tests --prefix packages/sdk
> @relayflows/sdk@2.0.25 typecheck:tests
> tsc -p tsconfig.tests.json

$ cd packages/sdk && ./node_modules/.bin/vitest run tests/preflight.test.ts tests/authored-flow.test.ts tests/flow-extension-compose.test.ts
 Test Files  3 passed (3)
      Tests  108 passed (108)
   Duration  12.70s

I also ran the entire SDK suite locally. The original taxonomy failure is gone, but that local invocation is not green: it ran without the workflow's pinned Bun 1.4.0 and under enough concurrency to trip 34 existing 5-second timing/lease tests (12 failed | 151 passed | 1 skipped). I am not claiming that as a pass; the replacement canonical CI run is the authority for the full gate.

Security follow-up at exact head 482d2562df158b8f49e6b924c94f1f8e1c9f5c16:

• direct-run input.event no longer participates in selection; the regression proves a crafted matching envelope runs only the base body
• verified-delivery dispatch is out-of-band and branded with a non-serializable symbol; a JSON round-trip loses authority and is refused
• a valid matching dispatch refuses with plugin_unsupported before either base or extension body runs because manifest permissions remain unenforced
• duplicate exact handlers and generic/action overlap refuse with plugin_event_ambiguous
• malformed provider/event/delivery/provenance descriptors refuse with plugin_event_unroutable
• docs no longer claim handler execution or permission enforcement

Literal local verification after the workflow-equivalent built-local-Surface override:

$ npm run typecheck --prefix packages/sdk
> @relayflows/sdk@2.0.25 typecheck
> tsc --noEmit && tsc -p tsconfig.type-tests.json

$ npm run build --prefix packages/sdk
> @relayflows/sdk@2.0.25 build
> tsc && node scripts/make-cli-executable.mjs

$ npm run typecheck:tests --prefix packages/sdk
> @relayflows/sdk@2.0.25 typecheck:tests
> tsc -p tsconfig.tests.json

$ cd packages/sdk && ./node_modules/.bin/vitest run tests/preflight.test.ts tests/authored-flow.test.ts tests/flow-extension-compose.test.ts
 Test Files  3 passed (3)
      Tests  115 passed (115)
   Duration  11.68s

Canonical CI at this exact head:

validate             pass  15s
packed-consumer      pass  34s
guard                pass   5s
linux-x64-artifact   pass  8m18s
Cursor Bugbot        pass  4m16s
CodeRabbit           pass

Fresh human review is now requested. This remains unmerged and unreleased.