Let manifest sources be declared in JSON - #46
Open
cheapmanga wants to merge 1 commit into
Open
Conversation
The sources the app can fetch from are fixed at build time, so following a
repo that moved, or adding a community one, means cutting a release. A
`.json` file under %AppData%\LuaToolsGui\sources\ now declares extra
sources; they appear as rows on the Add page and install through the
existing pipeline.
Data only, by design. A file says WHERE manifests come from and nothing
else: it names one of the shapes the app already consumes (a zip or a lua
per appid) and the app does the fetching. There is no way for one of these
files to supply code, a binary, or a routine of its own, so installing one
from a stranger cannot execute anything.
Pack rows are appended after the app's own sources rather than ranked among
them - that order is the app's decision, not a dropped-in file's. They are
also exempt from the lua.tools sign-in gate, since they are fetched from
the url the file names and never touch lua.tools.
The availability probe goes through GithubProxy like the download does; one
that skipped it would report "doesn't have the game" whenever GitHub was
blocked while the download would have succeeded through a mirror. A host
that refuses HEAD is probed with a one-byte ranged GET, because these urls
are whatever host the author picked.
Refusals are shown in Settings with their reason - a name the app already
uses, a non-https url, a missing {appid}, an unknown kind - and one bad
entry never takes a file's good ones with it. Files are re-read when the
Settings page opens, so nothing needs a restart. All 29 languages.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BPSigFCgHqiUUbL9RRPZWs
Owner
|
cool, will merge after dealing with conflits |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As discussed — the JSON half only. No plugin loader, no dll, nothing loaded.
A
.jsonfile under%AppData%\LuaToolsGui\sources\declares extra manifest sources. They appear as rows on the Add page and install through the existing pipeline.{ "schema": 1, "name": "Example sources", "sources": [{ "name": "example-zip", "displayName": "Example", "kind": "manifestZip", "url": "https://raw.githubusercontent.com/someone/some-repo/main/{appid}.zip", "badge": "Free" }] }Why: the sources the app can fetch from are fixed at build time, so following a repo that moved means cutting a release. This makes it a line of JSON.
A file can only say where manifests come from. It names one of two shapes the app already consumes —
manifestZip(<appid>.zip) orluaFile(<appid>.lua) — and the app does the fetching. There is no way for one to supply code, a binary, or a routine of its own, so installing one from a stranger cannot execute anything.Three choices worth flagging for review:
GithubProxylike the download does — one that skipped it would report "doesn't have the game" whenever GitHub was blocked, while the download would have gone through a mirror. Hosts that refuseHEADget a one-byte rangedGET.Refusals (a name already in use, non-https, missing
{appid}, unknownkind) are listed in Settings → Manifest sources with the reason; one bad entry doesn't take a file's good ones with it. Files are re-read when that page opens, so no restart.All 29 languages. Format documented in
SOURCES.md. Happy to change any of it, or drop it if you'd rather not have the surface.