[helen]

Summary

Adds plugin_failure_policy to both the root composite action and the find action, forwarding it to the URL scanner. Accepted values are log-and-continue (compatibility default) and abort; invalid values reject before scanning.

• log-and-continue preserves existing behavior: scan errors are logged and partial findings are returned. A thrown plugin failure skips the remaining scans on that URL, but subsequent URLs still run. Existing plugin loading/skipping behavior is unchanged.
• abort checks that every requested plugin name is available after loading before invoking plugins. Missing/skipped/invalid/failed-to-load requested plugins and propagated invocation failures stop further plugins, core scans on that URL, and subsequent URLs. The action publishes no findings file or output, including results from earlier URLs, so normal downstream filing/cache steps do not run.

The policy is generic for built-in, local, and NPM plugins. Built-in/local precedence over NPM plugins of the same name is preserved. Axe and AccessLint failure behavior is unchanged.

Verification

• 60 tests passed across findForUrl, action entry point, plugin failure policy, plugin manager, and NPM loader suites.
• Mocked faults cover asynchronous rejection, synchronous throw, finding callback failure, loader rejection, and unavailable requested built-in/local/NPM plugin names. Action-entry-point tests verify no file/output publication after an abort, including earlier successful URL findings, and verify compatibility partial results.
• Find action TypeScript build, targeted ESLint, Prettier checks, and git diff --check passed.

Boundaries and coordination

Independent draft based on main, not stacked on #305. No reflow-specific caller logic, plugin implementation changes, generic watchdog/runtime recovery, reporting-schema changes, or reconciliation changes.

For #303, abort-before-filing is an opt-in guarantee requiring plugin_failure_policy: abort and a plugin that propagates its failure. The compatibility default explicitly permits logged failures and partial findings; it does not guarantee complete coverage. Neither mode detects swallowed plugin errors or terminates hung plugin/browser work. Browser cleanup still runs and remains unbounded by this policy.

Relates to #303. Companion plugin-local work: #305.

🤖 Assisted by Copilot