iamtoruk 67320432ca feat(plugins): ed25519 release-key verification and plugin add/remove (9b) ... Ships ed25519 signature verification for plugins with two new components: - src/plugins/keys.ts: RELEASE_PUBLIC_KEYS map with one release keypair - scripts/sign-plugin.mjs: keygen and sign commands for plugin developers - verifyPlugin() in loader.ts: validates ed25519 signatures, rejects unsigned plugins unless CODEBURN_PLUGIN_DEV=1 - plugin add <path>: installs signed plugins to ~/.config/codeburn/plugins/ - plugin remove <name> --confirm: removes installed plugins All three gates pass: tsc clean, vitest zero new failures, smoke test complete. Design decision: public keys stored as base64-encoded PEM format rather than raw 32-byte keys. Node.js crypto.verify requires PEM/DER format or KeyObject for ed25519; raw bytes alone fail. PEM is standard and portable. Private key written to: /tmp/codeburn-signing/codeburn-signing-key.pem		2026-08-28 00:30:43 -07:00
..
upgrade-path	merge(main): rematch #1118 after #1116/#1122 — daily cache v29	2026-08-23 21:18:07 +05:30
bundle-litellm.mjs	fix(models): price gpt-5.6-codex and gpt-5.6-codex-max	2026-08-21 14:53:00 -07:00
sign-plugin.mjs	feat(plugins): ed25519 release-key verification and plugin add/remove (9b)	2026-08-28 00:30:43 -07:00
smoke-plugin-socket.mjs	feat(plugins): ed25519 release-key verification and plugin add/remove (9b)	2026-08-28 00:30:43 -07:00