 Jesse Merhi
|
d90e47783d
|
fix(plugins): remove local dependency denylist (#101813)
|
2026-08-11 12:21:29 +10:00 |
|
|
Peter Steinberger
|
98e3f729bc
|
refactor: remove dead plugin loader exports (#105937)
* refactor(plugins): trim activation and contract exports
* test(plugins): restore fixture cleanup
* refactor(plugins): trim install and loader exports
* test(plugins): fully reset loader caches
* refactor(plugins): trim metadata and catalog exports
* test(plugins): preserve catalog trust coverage
* refactor(plugins): trim provider and plugin exports
* refactor(plugins): trim runtime and tool exports
* test(plugins): update dead-export consumers
* test(plugins): remove empty dead-export suites
* refactor(plugins): align exports with split registry
* refactor(plugins): trim drifted loader exports
* style(plugins): format test fixtures
* refactor(scripts): use supported plugin APIs
* refactor(plugins): finish dead export cleanup
* chore(deadcode): refresh export baseline
* test(cli): mock production memory state
* chore(deadcode): sync latest export baseline
* fix(tests): keep plugin fixtures inside core
* chore(deadcode): refresh rebased export baseline
* chore(deadcode): sync current ratchets
* fix(plugins): retain reserved slot invariant
* fix(plugins): preserve dead-export invariants
* test(plugins): use neutral catalog query fixture
* test(plugins): satisfy catalog lint
* test(plugins): preserve integrity drift coverage
* fix(ci): register skill experience live proof
|
2026-07-13 01:29:33 -07:00 |
|
|
Vincent Koc
|
e7f9a430e3
|
refactor(plugins): remove obsolete plain-file installer (#105205)
|
2026-07-12 17:00:50 +08:00 |
|
|
Jesse Merhi
|
ec737ee74d
|
fix: rebase clawhub install trust (#81364)
|
2026-06-26 18:33:19 +10:00 |
|
|
Peter Steinberger
|
6a2b1b2198
|
docs: document plugin metadata helpers
|
2026-06-04 04:14:06 -04:00 |
|
|
Peter Steinberger
|
9b6cd2ea75
|
docs: document plugin security channel helpers
|
2026-06-03 21:01:33 -04:00 |
|
|
Josh Avant
|
154f439c81
|
Add operator install policy and remove dangerous-code install scanners (#89516)
* feat: add operator install policy
* test: cover plain-file plugin install code
* fix: preserve locationless install policy findings
* refactor: remove install-time plugin scanner
* test: remove stale plugin install helper
* fix: preserve before-install builtin scan type
* fix: preserve plugin dependency denylist
---------
Co-authored-by: Mainframe <mainframe@MainfraacStudio.localdomain>
|
2026-06-03 14:17:29 -07:00 |
|
|
Pavan Kumar Gondhi
|
39bcd1e088
|
fix(plugins): scan installed dependency runtime code [AI] (#81066)
* fix: scan installed plugin dependency code
* addressing review-skill
* addressing review-skill
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing ci
* addressing ci
* docs: add changelog entry for PR merge
|
2026-05-13 10:26:24 +05:30 |
|
|
Pavan Kumar Gondhi
|
a5dce367ce
|
fix: scan plugin runtime entries during install [AI] (#80998)
* fix: scan plugin runtime entries during install
* addressing review-skill
* addressing claude review
* docs: add changelog entry for PR merge
|
2026-05-12 20:28:40 +05:30 |
|
|
Vincent Koc
|
5ecd01ff94
|
fix(plugins): trust managed npm peer links
|
2026-05-03 01:49:24 -07:00 |
|
|
Peter Steinberger
|
7ddf28c0d4
|
feat: support git plugin installs
|
2026-05-01 10:59:10 +01:00 |
|
|
Vincent Koc
|
95bc417944
|
fix(cycles): split residual shared type seams
|
2026-04-11 02:46:40 +01:00 |
|
|
Michael Appel
|
9f97ad857a
|
fix(security): pin axios to 1.15.0 and add dependency denylist for plugin installs [AI-assisted] (#63891)
* fix: address issue
* fix: address review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* Plugins: fix install security CI regressions
* Plugins: make manifest traversal linear
* Plugins: bound manifest security traversal
* Plugins: block denied node_modules package dirs
* Plugins: match node_modules case-insensitively
* Plugins: block denied package symlink paths
* Tests: normalize blocked symlink assertion
* Plugins: fail closed on unreadable denied paths
* Plugins: block denied node_modules file aliases
* Plugins: inspect node_modules symlink targets
* Plugins: preserve symlink target package paths
* fix: address PR review feedback
* chore(changelog): add axios pin and dependency denylist entry
---------
Co-authored-by: Devin Robison <drobison@nvidia.com>
|
2026-04-10 11:20:05 -06:00 |
|
|
Peter Steinberger
|
bf96c67fd1
|
fix: align skill install security gate
|
2026-03-31 15:53:29 +01:00 |
|
|
Peter Steinberger
|
0d7f1e2c84
|
feat(security): fail closed on dangerous skill installs
|
2026-03-31 23:27:20 +09:00 |
|
|
Peter Steinberger
|
44b9936136
|
feat(plugins): add dangerous unsafe install override
|
2026-03-31 23:16:11 +09:00 |
|
|
Jacob Tomlinson
|
7a953a5227
|
Plugins: block install when source scan fails (#57729)
* Plugins: block unsafe install scan fallthrough
* Tests: normalize install scanner formatting
* Plugins: avoid duplicate scan failure messaging
* Plugins: preserve hook install block codes
|
2026-03-30 15:36:08 +01:00 |
|
|
George Zhang
|
150faba8d1
|
plugins: enrich before_install policy context
|
2026-03-29 12:35:01 -07:00 |
|
|
George Zhang
|
7cd9957f62
|
plugins: add before_install hook for install scanners
|
2026-03-29 12:35:01 -07:00 |
|
|
Peter Steinberger
|
3fa2300ba1
|
perf: reduce plugin runtime startup overhead
|
2026-03-22 16:34:09 +00:00 |
|