Plugin error boundaries

A plugin invocation loop without per-handler try/catch means a single third-party plugin throwing an uncaught error crashes the host, stops subsequent handlers from running, and surfaces as a 500 to every user — not just the user whose request triggered the broken plugin. CWE-755 (Improper Exception Handling) and ISO 25010 reliability.fault-tolerance both require that component failures be contained. The economic impact is proportional: one buggy plugin in an ecosystem of ten takes down applications that have nine functioning plugins installed.

Wrap each handler invocation in an individual try/catch inside the loop. Log the plugin name and hook name alongside the error so operators can identify the offending plugin without a stack trace investigation.

async function invokeHook(name: string, context: HookContext): Promise<void> {
  for (const { pluginName, handler } of this.getHandlers(name)) {
    try {
      await handler(context);
    } catch (error) {
      this.logger.error(`Plugin "${pluginName}" threw in hook "${name}":`, error);
      this.emit('plugin:error', { pluginName, hook: name, error });
      // Continue to next handler
    }
  }
}