Feat v0.5.1 chat core (#31)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/packages.go

@@ -299,6 +299,38 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
 		}
 	}
 
+	// Unicode security gate — scan all scannable files for invisible/deceptive
+	// characters before writing anything to the extension store.
+	scanExts := map[string]bool{".star": true, ".json": true, ".js": true, ".html": true}
+	for _, f := range zr.File {
+		if f.FileInfo().IsDir() {
+			continue
+		}
+		ext := strings.ToLower(filepath.Ext(f.Name))
+		if !scanExts[ext] {
+			continue
+		}
+		rc, err := f.Open()
+		if err != nil {
+			continue
+		}
+		data, err := io.ReadAll(rc)
+		rc.Close()
+		if err != nil {
+			continue
+		}
+		findings := sandbox.ScanSource(string(data), f.Name)
+		if len(findings) > 0 {
+			if blocked, reason := sandbox.Verdict(findings); blocked {
+				c.JSON(http.StatusUnprocessableEntity, gin.H{
+					"error":  "extension_blocked",
+					"reason": fmt.Sprintf("%s (file: %s)", reason, f.Name),
+				})
+				return
+			}
+		}
+	}
+
 	// Validate required fields
 	pkgID, _ := manifest["id"].(string)
 	title, _ := manifest["title"].(string)