Ported from the host's in-tree scanner (crates/punktfunk-host/src/library/gog.rs). Walks
`HKLM\SOFTWARE\WOW6432Node\GOG.com\Games` for installed products and resolves each one's
primary play task out of its `goggame-<id>.info` manifest.
GOG launches the game's exe DIRECTLY — Galaxy is never involved — so the launch value stays
the host's tab-separated `<exe>\t<args>\t<workdir>` spawn triple under the `gog` kind, and
the host still owns turning that into a process (D1). The registry subkey name IS the GOG
product id, so `external_id` matches and the host composes `gog:<id>` byte-identically to
the built-in scanner: entry ids, GameStream app ids and client art caches all survive.
The load-bearing part is `confinedJoin`, carried over verbatim from the Rust scanner
(security-review 2026-07-17). A `goggame-*.info` is attacker-writable in the threat model,
and on Windows a drive prefix, a root, or a `..` component all let a naive join REPLACE or
climb out of the install dir — handing the host an arbitrary program to run. So an exe path
that escapes refuses the ENTRY outright, while a working dir that escapes degrades to the
install root: the working dir is not the thing being executed, and refusing a whole title
over it would cost more than it buys. Both behaviours are pinned by tests.
Art is deliberately NOT emitted: GOG covers come from the public api.gog.com, which the
host's background warmer already resolves and caches by entry id. Keeping it there means
this plugin makes no network calls at all and the reconcile payload stays tiny.
Runs under the runner's principal — NT AUTHORITY\LocalService on Windows. Probed on
hardware 2026-08-06: HKLM is readable there, which is what makes this port viable
de-privileged; nothing here reaches for HKCU or a user profile.
No launcher tile yet: the host has no verified `launcher_ui` activation for Galaxy, so one
would be refused with a 400. The config switch is present and off.
Gates: tsc --noEmit clean, 5 tests pass, biome clean, `bun run build` produces both entry
points, and the CLI answers honestly off-platform (`detect` -> absent, `scan` -> []).
Still owed: `parity --compare` on a Windows box with GOG installed, under the runner.
enricobuehler
455108603f