The plan with custom extensions

[GarboMuffin]

Checkboxes mean "the code has been written", not necessarily "you can use it now"

• Store custom extension URLs in the project
• Add confirmation for loading non-extensions.turbowarp.org extensions
• Automatically load extensions (with user consent)
• In the packager, parse customExtensions and inform the user ahead of time
• Implement an unsandboxed extension mode
• Figure out the local development and debugging situation
• Remove the temporary development support hack (localhost:8000)
• make global.Scratch actually unique per extension
• Use unsandboxed extensions in the packager because the Worker sandbox sucks and the iframe sandbox doesn't work Load custom extension locally in the packager packager#550
• Add APIs like Scratch.vm
• Convert extensions on extensions.turbowarp.org to IIFE
• Allow extensions from extensions.turbowarp.org to run unsandboxed
• Add Box2D to extensions.turbowarp.org (like I am porting the well known Box2D extension to turbowarp #632)
• Add Utilities to extensions.turbowarp.org
• Add gamepad extension to extensions.turbowarp.org
• Add file reading extension to extensions.turbowarp.org New extension: File read and download extensions#19
• Add pointer lock extension to extensions.turbowarp.org New extension: Pointerlock extensions#18
• Figure out the deal with non-edge-activated hats: isEdgeActivated: false
• Open submissions to extensions.turbowarp.org with some guidelines
• Advertise extensions.turbowarp.org in the editor
• Make extensions.turbowarp.org a bit less ugly
• Figure out how to make this work offline with the desktop app
• Document the correct way to do casting
• ScratchX

[David-Orangemoon]

Awesome. Glad to see unsandboxed extensions getting full support! Plan to add any community ones to the extension list?

[GarboMuffin]

The plan is to restrict unsandboxed extensions to extensions.turbowarp.org (no change for current sandboxed extensions), but allow community contributions to that website as long as they follow guidelines like "don't break compatibility with old extension versions" and "don't introduce security bugs"

[GarboMuffin]

https://twitter.com/GarboMuffin/status/1584025942376448001

The hope is that users will be able to start using this in ~1wk

[GarboMuffin]

Prototypes can be tested now:

• https://experiments.turbowarp.org/unsandboxed-extensions/
• https://extensions.turbowarp.org/

Extension URLs will be stored in the project. Extensions from https://extensions.turbowarp.org/ will be loaded automatically and unsandboxed. For extensions from other places, a prompt will be displayed and they will be loaded with the sandbox. The prompt is rather ugly and needs some more work.

It's not clear what the final solution will be for locally testing unsandboxed extensions. For now, I've made it so extensions with a URL beginning with http://localhost:8000/ exactly will be loaded as unsandboxed. This is temporary for testing purposes.

extensions.turbowarp.org can probably start accepting contributions over here: https://github.com/TurboWarp/extensions. The acceptance criteria is basically something like "nothing malicious, no security bugs, don't break compatibility".