refactor(plugin install): speed up plugin installation with native ZIP extraction

[codewithchai0605]

Summary

This PR improves plugin installation performance, especially for plugins containing many small files such as file/folder icon providers.

The previous installer extracted archive entries in JavaScript with a concurrency limit of 2. This caused significant overhead from repeated JS-to-native filesystem calls.

This change moves archive extraction to native Android code and writes files directly from the ZIP archive.

Changes

• Extract plugin ZIP archives natively using ZipFile.
• Stream archive entries directly to a staging directory.
• Activate updates through a directory swap, preserving the existing plugin if extraction fails.
• Restore the previous plugin installation if an earlier update was interrupted during the swap.
• Prevent concurrent installations of the same plugin.
• Validate plugin IDs and archive paths to prevent path traversal.
• Add archive size and entry-count limits.
• Optimize extraction for many small files:
  • shared 64 KiB buffer
  • direct output streams
  • no per-entry canonical filesystem lookup

[greptile-apps]

Greptile Summary

The PR moves plugin ZIP extraction into the Android bridge and activates extracted contents through staging and backup directory swaps.

• Adds native archive path validation, size limits, and direct streaming extraction.
• Adds per-plugin installation exclusion and recovery of interrupted swaps.
• Updates JavaScript cleanup to distinguish fresh installations from updates and recovered installations.

Confidence Score: 4/5

The PR should not merge until orphan recovery parses temporary directory ownership unambiguously, because valid plugin IDs can currently cause recovery to restore or delete the wrong directory.

The global recovery sweep interprets .install- and .backup- substrings inside otherwise valid plugin IDs as structural delimiters, allowing interrupted-install artifacts to be misclassified and mishandled.

Files Needing Attention: src/plugins/pluginContext/src/android/Tee.java

Important Files Changed

Filename	Overview
src/lib/installPlugin.js	Delegates extraction to the native bridge, tracks pre-extraction installation state, and removes failed fresh installations after activation.
src/plugins/pluginContext/src/android/Tee.java	Implements native staged ZIP extraction and interrupted-swap recovery, but marker-substring parsing can assign temporary directories to the wrong plugin or type.

Sequence Diagram

sequenceDiagram
    participant JS as installPlugin.js
    participant Tee as Tee.extractPluginArchive
    participant FS as Plugin filesystem
    JS->>Tee: extract(archive, destination, manifest)
    Tee->>FS: Recover orphan backups
    Tee->>FS: Extract into .install-UUID
    alt Existing plugin
        Tee->>FS: Rename destination to .backup-UUID
    end
    Tee->>FS: Rename staging to destination
    Tee->>FS: Delete superseded backup
    Tee-->>JS: "success({ recovered })"
    JS->>JS: Load and initialize plugin
    alt Fresh plugin fails to load
        JS->>FS: Delete activated destination
    end

Loading

_{Reviews (4): Last reviewed commit: "fix: restore cross-plugin backups during..." | Re-trigger Greptile}

[codewithchai0605]

@greptile-apps review

[codewithchai0605]

@greptile-apps review

[RohitKushvaha01]

Why did you change Tee.java? It's for security related stuff this doesn't make any sense put that code in System.java

[codewithchai0605]

@greptile-apps review

[greptile-apps]

Marker substrings corrupt orphan recovery

When a valid plugin ID contains .install- or .backup-, the orphan sweep interprets that part of the ID as a structural delimiter. A backup can consequently be classified as staging and lose its preservation guard, or staging contents can be restored under an unrelated plugin name, causing recoverable plugin data to be deleted or activated at the wrong destination.

Knowledge Base Used: Plugin System