ADFA-3598: address CodeRabbit review feedback

- PreviewLayoutAction: catch Exception (not Throwable) and log on resource-path
  parse failure; derive the layout base path from the last "layout/" segment
  instead of substringBefore("layout")
- EditorHandlerActivity: rebuild EDITOR_TOOLBAR plugin actions on plugin disable
  so stale PluginToolbarActionItem callbacks are cleared
- IdeProjectServiceImpl: path-validate getModuleContext via isPathAllowed()
- ToolbarAction: document why the provider callbacks stay body vars (ABI compat)

Deferred: permission-gating IdeBuildService.executeTasks needs a per-plugin
permission-aware wrapper + a new build permission (build service is a shared
singleton); to be done as a focused security change.

Author: alome007

app/src/main/java/com/itsaky/androidide/actions/etc/PreviewLayoutAction.kt

@@ -81,7 +81,8 @@ class PreviewLayoutAction(context: Context, override val order: Int) : EditorRel
     if (file != null && !viewModel.isInitializing && file.name.endsWith(".xml")) {
       val type = try {
         extractPathData(file).type
-      } catch (err: Throwable) {
+      } catch (err: Exception) {
+         LOG.warn("Failed to parse resource path for '{}'; hiding preview action", file.name, err)
         markInvisible()
         return
       }
@@ -146,7 +147,7 @@ class PreviewLayoutAction(context: Context, override val order: Int) : EditorRel
 
   private fun EditorHandlerActivity.previewXmlLayout(file: File) {
     val intent = Intent(this, EditorActivity::class.java)
-    intent.putExtra(Constants.EXTRA_KEY_FILE_PATH, file.absolutePath.substringBefore("layout"))
+    intent.putExtra(Constants.EXTRA_KEY_FILE_PATH, file.absolutePath.substringBeforeLast("layout${File.separator}"))
     intent.putExtra(Constants.EXTRA_KEY_LAYOUT_FILE_NAME, file.name.substringBefore("."))
     uiDesignerResultLauncher?.launch(intent)
   }

app/src/main/java/com/itsaky/androidide/activities/editor/EditorHandlerActivity.kt

@@ -92,6 +92,7 @@ import com.itsaky.androidide.ui.CodeEditorView
 import com.itsaky.androidide.fragments.sidebar.EditorSidebarFragment
 import com.itsaky.androidide.utils.DialogUtils.newMaterialDialogBuilder
 import com.itsaky.androidide.utils.DialogUtils.showConfirmationDialog
+import com.itsaky.androidide.utils.EditorActivityActions
 import com.itsaky.androidide.utils.EditorSidebarActions
 import com.itsaky.androidide.utils.IntentUtils.openImage
 import com.itsaky.androidide.utils.UniqueNameBuilder
@@ -1269,6 +1270,8 @@ open class EditorHandlerActivity :
 			(supportFragmentManager.findFragmentById(R.id.drawer_sidebar) as? EditorSidebarFragment)
 				?.let { EditorSidebarActions.setup(it) }
 
+			EditorActivityActions.register(this)
+
 			invalidateOptionsMenu()
 
 			Log.i("EditorHandlerActivity", "Tore down contributions for disabled plugin: $pluginId")

plugin-api/src/main/kotlin/com/itsaky/androidide/plugins/extensions/UIExtension.kt

@@ -139,6 +139,13 @@ data class ToolbarAction(
     val order: Int = 0,
     val action: () -> Unit
 ) {
+    // NOTE: the provider callbacks below are intentionally body `var` properties rather than
+    // primary-constructor parameters. Adding constructor params would change the synthesized
+    // <init>/copy()/componentN signatures and break ABI for plugins already compiled against the
+    // shipped plugin-api — the exact pattern [MenuItem] uses for the same reason. The trade-off
+    // (copy()/equals() ignore these providers) is acceptable: plugins build ToolbarAction directly
+    // and the host never copies it. Do NOT move these into the constructor.
+
     /**
      * Optional callback to compute the enabled state dynamically at render time.
      * When null, the static [isEnabled] is used. Mirrors the [MenuItem] providers.

plugin-manager/src/main/kotlin/com/itsaky/androidide/plugins/manager/services/IdeProjectServiceImpl.kt

@@ -86,6 +86,11 @@ class IdeProjectServiceImpl(
             throw SecurityException("Plugin $pluginId does not have required permissions: ${getRequiredPermissionsString()}")
         }
 
+        val path = File(filePath)
+        if (!isPathAllowed(path)) {
+            throw SecurityException("Plugin $pluginId does not have access to path: ${path.absolutePath}")
+        }
+
         return try {
             ModuleContextResolver.resolve(filePath)
         } catch (e: Exception) {