Skip to content

[audit] :SyncPkgs installs all plugins to disk in stable mode, bypassing the core/extra tier split #317

Description

@stanfish06

What

init.lua's module table and lua/config/plugins.lua's STABLE_PKGS/load_list logic explicitly restrict what gets installed in "stable" mode — the comment at init.lua:4 states: "core" will be installed in stable mode, "extra" does not, and only nvim-treesitter, nvim-lspconfig, and dark-theme are in STABLE_PKGS.

Where

lua/config/plugins.lua:104, inside sync_packages():

vim.pack.add(package_list, { load = not vim.g.stable_mode })

This uses the full package_list (all ~27 plugins), not the tier-filtered load_list computed just above it at line 67-72. Contrast with the separate vim.pack bootstrap path near the bottom of the file (line ~202), which correctly uses load_list.

Why it matters

In stable mode, running :SyncPkgs still clones/registers every "extra" plugin to disk (just with load = false, so they aren't sourced) — not just the 3 core packages. This is inconsistent with the stated tiering design: stable mode is presumably meant to keep the install footprint minimal (e.g. for a constrained/distro nvim reached over SSH, similar to server.lua's remote-session use case), but :SyncPkgs currently defeats that by fetching everything anyway.

Recommended action

If this is unintentional: swap package_listload_list at plugins.lua:104 so stable mode's :SyncPkgs only installs the 3 core packages, matching the bootstrap path's behavior.

If this is intentional (e.g. deliberately pre-fetching all plugins to disk so a later switch from stable → full mode doesn't need a resync), it'd be worth a one-line comment at that call site explaining why it diverges from load_list, so future audits don't flag it again.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions