Resource cleanup on removal

When removing a plugin leaves its intervals ticking, its event listeners attached, and its registered routes still responding to requests, the application enters a state where disabled plugins continue to affect users. CWE-404 (Improper Resource Shutdown) is the direct classification. In practice this means: a removed analytics plugin continues to log user data; a deactivated payment plugin still intercepts checkout webhooks; orphaned timers accumulate until they cause performance degradation. The only reliable remediation — a full restart — creates downtime every time an operator needs to remove a plugin.

Track every resource a plugin registers in a per-plugin disposables list. On removal, call the plugin's destroy() method and then dispose every tracked resource, so cleanup happens even when plugin authors forget to do it themselves.

class PluginManager {
  private pluginResources = new Map<string, Disposable[]>();

  registerHook(pluginName: string, hook: string, handler: Function) {
    const disposable = this.hooks.on(hook, handler);
    this.pluginResources.get(pluginName)?.push(disposable);
  }

  async removePlugin(pluginName: string) {
    await this.plugins.get(pluginName)?.destroy();
    for (const disposable of this.pluginResources.get(pluginName) ?? []) {
      disposable.dispose();
    }
    this.pluginResources.delete(pluginName);
  }
}