[ShookEagle]

Summary

Manage each SourcePawn repository directly in .source/plugins.json without requiring plugin CI pipelines or published releases.

repository ref + include dependencies
  → exact commit archives
  → pinned SourceMod compiler
  → staged package
  → exact approval
  → installation at the next normal restart

Recipes select source files, include directories, dependency repositories, and mappings for plugins/gamedata/translations/config. Existing release recipes and approval identities remain compatible. Builds retain private configuration, support rollback, and preserve installed files and earlier staging on failure.

Evidence

• Before: source recipes failed with json: unknown field "ref"; acquisition only selected release assets.
  After: repository acquisition, compilation, include-only updates, approval/restart lifecycle, configuration preservation, and rollback tests pass.
• go test ./...
• go test -race ./internal/plugins ./internal/egg
• go vet ./... and builds of both commands
• Real compilation using the official pinned SourceMod 1.13.0.7478 toolchain passed.
• Review regressions cover cache symlink confinement, repair of corrupted same-ID snapshots, cancellation, bounded diagnostics, and credential redaction across truncation/overlap boundaries. Scoped review is clear.

Merge Danger

Door: Two-way

Source builds are opt-in. Reverting requires removing source-build entries from the manifest; existing installed plugin files remain usable.

Blast Radius: Plugins

Private GitLab projects require a server-local read_api credential; their live builds have not been validated. Native extensions continue to use binary packages. Compilation runs the trusted compiler with fixed arguments and a minimal environment; it is not an OS security sandbox.