插件安装被「未审核权限」拦截但文案误报为「账号/插件/版本已变化」(Web Search、GitHub 等)
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 395
- Avg merge
- 21h 48m
- Merged PRs (30d)
- 776
Description
**提交人**: lima
**客户端版本**: 0.1.28
---
## 现象
从插件市场安装 **Web Search**(cindy-web-search)或 **GitHub**(cindy-github)等插件时,安装失败,提示:
> 操作期间账号、插件或版本已发生变化,请确认最新状态后重试。
GitHub 此前从未安装过,同样报错。说明不是单个插件的旧记录冲突,而是共性问题。
## 真实根因(来自应用日志)
提示文案不准确,实际拦截原因在 `main-2026-08-05.log` 中明确记录为权限审核校验失败:
Web Search:
```
[WARN] [brain] market package declares unreviewed permissions { ghostId: 'cindy-web-search', keys: [ 'tool:search_web' ] }
[ERROR] Error occurred in handler for 'plugin-market:install': Error: [PRECONDITION_FAILED] 下载包申请的权限多于安装确认框展示的内容,已阻止安装(请向插件来源反馈)
```
GitHub:
```
[WARN] [brain] market package declares unreviewed permissions { ghostId: 'cindy-github', keys: [ 'tool:list_tools', 'tool:call_tool' ] }
[ERROR] ... [PRECONDITION_FAILED] 下载包申请的权限多于安装确认框展示的内容,已阻止安装(请向插件来源反馈)
```
即:插件包声明的工具权限(如 tool:search_web、tool:list_tools、tool:call_tool)未在安装确认框中展示/未经审核,客户端安全校验拦截了安装。
## 期望行为
1. 这类权限审核不全的插件,提示文案应准确反映原因(当前「账号、插件或版本已变化」的文案有误导性,让人误以为是账号问题)。
2. 插件来源尽快补齐权限审核,或客户端针对这些已上架插件的权限给出明确提示。
## 实际行为
安装被安全校验拦截,但提示文案与真实原因不符,导致无法定位。
## 复现
插件市场 → 安装 Web Search 或 GitHub → 报错。
(注:此前提交的 #1725 将原因误判为账号身份归属冲突,实际是权限审核校验,以此 issue 为准。)
---
**OS**: darwin arm64 (25.4.0)
**界面语言**: zh-CN
Contributor guide
Research direction
Start by reproducing installation of cindy-web-search or cindy-github from the plugin market and inspect the `plugin-market:install` handler alongside `main-2026-08-05.log`. Trace how the PRECONDITION_FAILED permission-review error becomes the user-facing message. Done means incomplete permission review is reported accurately instead of as an account, plugin, or version change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100