Skip to content

docs(insomnia): plugin sandbox, permissions, and troubleshooting pages (draft) - #6597

Draft
jackkav wants to merge 6 commits into
mainfrom
docs/insomnia-plugin-sandbox
Draft

docs(insomnia): plugin sandbox, permissions, and troubleshooting pages (draft)#6597
jackkav wants to merge 6 commits into
mainfrom
docs/insomnia-plugin-sandbox

Conversation

@jackkav

@jackkav jackkav commented Aug 7, 2026

Copy link
Copy Markdown

Insomnia plugin sandbox docs (draft)

Adds three reference pages under app/insomnia/plugins/ documenting the sandboxed plugin model, registers them in the Insomnia nav (app/_indices/insomnia.yaml), and links them from the plugins landing page (app/_landing_pages/insomnia/plugins.yaml). Opened as a draft to iterate on.

New pages

  • Plugin sandbox and trust model (sandbox-and-trust.md) — in-process vs the QuickJS sandbox, the pluginSandboxEnabled setting, the execution modes shown as badges in Preferences > Plugins (Sandboxed / Elevated / In-process), the per-plugin Full host access (elevated) opt-in, and a migration guide for existing plugins.
  • Plugin permissions (permissions.md) — the insomnia.permissions manifest (modules + capabilities), the default-deny baseline, and the capability + module reference (canonical module set: path, crypto, events, ajv, uuid).
  • Plugin troubleshooting (troubleshooting.md) — the "my plugin disappeared → disabled row with a reason" behavior, reload-recovers-after-fix, plugin name-conflict resolution, and the current context.app.dialog() DOM limitation (Kong/insomnia#10292).

These complement the existing plugin-reference, context-object-reference, and hooks-and-actions pages (no overlap).

Scope notes

  • Pages describe only current, user-actionable behavior — no internal-only execution modes, retired settings, or release-notes framing.
  • Reflects Insomnia PRs #10364 (single pluginSandboxEnabled flag; the earlier templateTagSandboxEnabled experiment is retired and migrated automatically) and #10376 (bundle-plugin name-impersonation rejection).

Frontmatter, callout syntax, and nav registration follow the existing plugin pages.

🤖 Drafted by Claude Code

@netlify

netlify Bot commented Aug 7, 2026

Copy link
Copy Markdown

Deploy Preview for kongdeveloper ready!

Name Link
🔨 Latest commit 22e023e
🔍 Latest deploy log https://app.netlify.com/projects/kongdeveloper/deploys/6a7d6ef3d333160008739bf7
😎 Deploy Preview https://deploy-preview-6597--kongdeveloper.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

jackkav added 4 commits August 7, 2026 18:00
'Trusted' is an internal-only label (never surfaced in the UI) for
built-in plugins the user can't install or change, so it doesn't warrant
a security-flavoured name in public docs. Rename the execution mode to
'Internal' and describe built-in plugins neutrally.

Also drop the retired templateTagSandboxEnabled flag from the migration
prose and the caveats, now that pluginSandboxEnabled is the single flag.
- permissions: resolve the pre-publish module-list TODO with the canonical
  set (path, crypto, events, ajv, uuid); drop the OAuth-token credential
  warning callout
- sandbox-and-trust: remove the retired template-tag experiment note, the
  internal-only 'Internal' execution mode row (+ its built-in caveat), and
  the 'What changed' release-notes table
- troubleshooting: trim the fixed-bug caching backstory to the actionable
  reload instruction
Covers both a duplicate user folder and a name reserved by Insomnia
(the bundle-plugin impersonation rejection added in #10376), with a
single rename fix, matching the updated 'ambiguous or spoofed trust
grant' error.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants