[github-actions]

Closes #1193. Submitted by @bendavid.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1193.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Editor Plus v0.1.2 is approved and published, @bendavid. I completed the registry pin using your overview, description and screenshots. No changes are needed from you.

Review data

• Policy: main REVIEW.md blob 8da1286fd8870c87ff53767e8644858627b7371f. Read the submission issue, PR body and all available discussion; the submission and repository owner are bendavid.
• Reviewed registry head: 2f8cf086cd5e8a1c960f1b51ce9a60b7b600a805, based on main 620c16a8f5687c220baf0129db22607a0f2a78ca.
• Install artifact: {"kind":"git","remote":"https://github.com/bendavid/paseo-editor-plus.git","commit":"aa90f097ac850cdb3dbf67b4b1693310f8fb536b","tag":"v0.1.2"}. Resolved the annotated tag to that exact commit and fetched it without submodules or hooks. Git archive SHA-256: 91cbd2a1423182d54e95232fb9a7dc15617ef6e38e149e7de6e7676d6fd3861c. Checked archive paths and entry types before confined extraction.
• Inspected scope: manifest, package metadata, README, author overview, translated name/description, supplied images, server entry and modules, RPC definitions, language profiles, download catalogs/lockfiles, client install confirmations, file saving, LSP transport and preview execution/rendering paths. Scanned 56 production modules and checked their local imports resolve. No obfuscated bundle prevents inspection.
• Installation: manifest preparation is npm ci --omit=dev --ignore-scripts --no-audit --no-fund. Root lock and five component/server locks match their manifests; all 757 package entries have exact versions, npm registry sources and integrity values, with no unresolved declared dependency edge. Lifecycle scripts are suppressed in preparation and runtime npm installation. Development tests and release-catalog maintenance scripts are not invoked by preparation.
• Runtime software: settings and editor banners open an Install confirmation before calling the installation RPC; status/preview/spellcheck paths do not install missing components. Downloads and destinations are disclosed in the overview. GitHub server releases carry pinned SHA-256 checks; npm servers, PDF.js and cspell use the shipped locks. gopls selects golang.org/x/tools/gopls@v0.24.0; inspected its published module metadata, whose 29 direct/indirect requirements have checksum entries. No downloaded server or dependency was executed during review.
• Access/execution: opening an editor launches the configured/discovered language server with argument arrays in the project directory (index.server.ts, server/session.ts). Discovery reads PATH/login-shell PATH and probes versions. Compile invokes the intended Typst/LaTeX server operation; compile-on-save defaults off. File edits use Paseo's file interface with conflict handling. PDF/log/local image reads support previews; dictionary and managed-software writes/removal stay in the plugin's data folders. Processes inherit the daemon user's environment and permissions, as expected for local language tooling. No unrelated credential collection or concealed transmission was found in the inspected paths.
• Preview code: loopback preview connections require a port announced by the session's server. Tinymist supplies its executable preview page. Markdown disables raw HTML and removes executable elements/handlers before display; remote image URLs remain browser requests. PDF.js is loaded from the confirmed, locked component through blob modules; PDF evaluation and XFA are disabled. cspell loads from its installed component and reads project configuration. Language-server package/module/schema requests are disclosed in the overview. Third-party server/dependency internals and every possible project configuration were not comprehensively audited.
• Registry edits: added plugins/bendavid/editor-plus.json, preserved the requested tag, categories and attribution, set submission time from the issue, and removed submissions/1193.json. The author-supplied English overview, description and two PNG screenshots remain authoritative; both media URLs return HTTP 200 with image/png. No registry overview override was needed.
• Trusted current-main local online validation passes: 387 well-formed records, one changed record matches its pinned artifact. GitHub Validate passed on the exact reviewed head: https://github.com/getpaseo/plugins/actions/runs/40259712287.
• Publication: merged as 93bf53ca6b442c9b280a4039dc98bf3b2bab986a; the Publish workflow built and deployed successfully, and the public registry serves this exact artifact. Post-merge full-registry validation separately fails on the existing Prometheus Status entry’s unavailable Git commit; Editor Plus passed its reviewed-head check.
• Limitations: static artifact review only. No plugin, dependency, installation, build, tests, language server or live UI/service flow was run. No outstanding author requirement or factory incompatibility identified.