[kazemek21]

TL;DR

Expose optional plugin update discovery and explicit review queues through the existing pluginInstaller service. Reuse the host's retained checker and importer; a missing result remains unknown, not proof that a plugin is current.

What

• getSnapshot, subscribe, and refresh expose aggregate status, known candidates, and known errors. Plugin-triggered refreshes share a one-minute minimum interval.
• queueUpdates accepts opaque tokens for current candidates from a recent completed check. Each item opens the existing confirmation dialog, identifies its requesting plugin, and preserves source, publisher, access, and saved enabled-choice guards.
• Queue snapshots support observation and cancellation. A confirmed import keeps its review slot until the native operation settles, including after the watchdog, cancellation, or consumer unmount.
• Stable provider and request IDs bind replay to the exact ordered, deduplicated token list. Request IDs are namespaced by calling plugin ID; a remounted consumer can reconcile its prior request. Both subscriptions are released with the caller's lifetime.
• getQueueRequest returns admitted, not-admitted, unknown, or conflict without submitting. Only not-admitted from the same live provider proves non-admission. Replacement, restart, or queue eviction stays unknown and cannot create a duplicate on replay.
• A fresh snapshot miss does not establish that an individual plugin was checked, is eligible, or is current. Distinct submissions retain independent confirmation and cancellation; only an exact identified replay shares a queue.

Validation and limits

Focused regression coverage covers review drift and missing candidates, busy-manager admission, late native settlement, caller cleanup, request isolation, and provider replacement. Hosted CI passed on affbcd72, including all JavaScript shards and changed-file repetitions. The repairs were not run locally; normal precommit checks passed.

No native installed/runtime or fail-before/pass-after proof is claimed. Queue state lasts only for the host provider lifetime. The frontend checks and immutable prepared import preserve the existing boundary; this does not add native enforcement or cross-restart idempotency. No second checker or per-plugin checked-current result is added.

Tracking

Fixes NEXUS-4337
Pinned-link classification and ref-change disclosure are in #3024.

Generated with Codex (gpt-6.1-sol, high) on behalf of kylez

[gilgtm]

🤖 No P0/P1 findings from the completed deep-dual review of affbcd7. Reviewed the full PR against main@e02509fbe173cd60872e2addaa098a57cbee4f63 using read-only code and test inspection. Native app behavior was not exercised.

Posted by duel-review skill [driver: codex(high), mode: deep-dual, review synthesized by codex(high)]

[dr0uleau]

🤖 approved at this commit. CI is green. Native and visual checks remain unverified