Function installPlugin

packages/insomnia/src/main/install-plugin.ts:65–179

(pluginName: string, allowScopedPackageNames = false)

 * @param pluginName - The npm package name of the plugin to install
 */
export default async function installPlugin(pluginName: string, allowScopedPackageNames = false): Promise<void> {
  const validationError = validatePluginName(pluginName, allowScopedPackageNames);

  if (validationError) {
    throw new Error(validationError);
  }

  let tmpDir = '';

  try {
    // Step 1: Validate the plugin and fetch its npm metadata
    const info: InsomniaPlugin = await getPluginInfo(pluginName, allowScopedPackageNames);

    // Get the normalized module name (without version suffixes)
    const moduleName = info.name;

    // Check the module name for any invalid characters
    // This is a basic validation to ensure the module name is safe
    // and doesn't contain any unexpected characters.
    const validationError = validatePluginName(moduleName, allowScopedPackageNames);

    if (validationError) {
      throw new Error(validationError);
    }

    // Determine the target plugin installation directory
    const userDataPath = process.env['INSOMNIA_DATA_PATH'] || app.getPath('userData');
    const pluginDir = path.resolve(userDataPath, 'plugins', moduleName);

    console.log(`[plugins] Installing plugin ${moduleName} to ${pluginDir}`);

    // Step 2: Create the plugin directory if it doesn't exist
    await mkdir(pluginDir, { recursive: true });

    if (!info.dist?.tarball) {
      throw new Error('Invalid plugin metadata: missing tarball URL');
    }

    // Step 3: only allow tarballs from known hosts
    let tarballUrl: URL;
    try {
      tarballUrl = new URL(info.dist.tarball);
    } catch {
      throw new Error(`Invalid tarball URL in plugin metadata: ${info.dist.tarball}`);
    }
    const allowedTarballHostnames = await getAllowedTarballHostnames();
    if (!allowedTarballHostnames.includes(tarballUrl.hostname)) {
      throw new Error(`Tarball must come from an allowed host. Got: ${tarballUrl.hostname}`);
    }
    // and require https, unless it's the user's own http registry (same host:port)
    const registryUrl = new URL(await getRegistryUrl());
    const isUsersHttpRegistry =
      registryUrl.protocol === 'http:' && tarballUrl.protocol === 'http:' && tarballUrl.host === registryUrl.host;
    if (tarballUrl.protocol !== 'https:' && !isUsersHttpRegistry) {
      throw new Error(`Tarball must be served over https. Got: ${info.dist.tarball}`);
    }

    // Step 4: Install the plugin into a temporary directory