mirror of
https://github.com/Kong/insomnia.git
synced 2026-09-21 05:35:28 -04:00
Jack Kavanaghandkwburns-kong
e3121d28fc
* refactor(templating): retire templateTagSandboxEnabled, unify on pluginSandboxEnabled The experimental `templateTagSandboxEnabled` toggle only ever gated template-tag execution and had been superseded by `pluginSandboxEnabled`, which sandboxes every untrusted plugin surface. Retire the legacy flag: - drop it from the Settings type + defaults - simplify `isSandboxEnabled` to read only `pluginSandboxEnabled` - bundle plugins are trusted, so their tags always run in-process (the legacy all-modules/all-caps bundle sandbox branch is removed) - remove the "Run template tags in sandbox" Preferences toggle - carry a user's prior opt-in forward via a settings migration (templateTagSandboxEnabled === true -> pluginSandboxEnabled = true), then delete the stale field Smoke helpers repointed to the surviving `toggle-plugin-sandbox`; the now -duplicate `enablePluginSandbox` helper is folded into `enableSandbox`. * refactor(plugins): rename 'trusted' execution mode to 'internal' 'trusted' is an internal-only PluginExecutionMode label for built-in bundled plugins the user can't install or change; it's never surfaced in the UI (the Plugins badge shows 'In-process'). Rename it to the more neutral, descriptive 'internal' to match the docs. Distinct from the plugin *registry* trust concept (resolveTrustedPlugin, the 'trusted-plugin' guard), which is unchanged. * sandbox: reject bundle-plugin name impersonation, remove stale doc (#10376) * docs(settings): simplify 'Sandbox all plugin code' toggle description Address review nit: drop implementation jargon (QuickJS-WASM, default-deny) from the Preferences copy in favour of plain language, keeping the coverage list and the full-host-access escape-hatch pointer. --------- Co-authored-by: kwburns-kong <kyle.burns@konghq.com>