@bibobonking/opensol 3.1.5 → 3.2.0

package/shared/plugin-package.mjs

@@ -1,197 +0,0 @@
-const MAX_ARCHIVE_BYTES = 5 * 1024 * 1024
-const MAX_PACKAGE_BYTES = 10 * 1024 * 1024
-const MAX_FILES = 100
-const MAX_MANIFEST_BYTES = 64 * 1024
-const CAPABILITIES = new Set([
-  'workspace.list',
-  'workspace.read',
-  'workspace.write',
-  'workspace.edit',
-  'ui.commands',
-  'ui.panels',
-  'ui.themes',
-  'network.request',
-])
-const MANIFEST_KEYS = new Set([
-  'id',
-  'name',
-  'version',
-  'apiVersion',
-  'entry',
-  'stylesheet',
-  'capabilities',
-  'domains',
-])
-
-function packageError(message) {
-  throw new Error(`Invalid plugin package: ${message}`)
-}
-
-function bytesToString(bytes) {
-  if (typeof bytes === 'string') return bytes
-  return new TextDecoder('utf-8').decode(bytes)
-}
-
-function stringToBytes(str) {
-  return new TextEncoder().encode(str)
-}
-
-function validateSource(path, content, apiVersion) {
-  // API v2: skip validation — full kernel access, blob isolation is enough
-  if (apiVersion === 2) return
-
-  const source = bytesToString(content)
-  const rule = path.endsWith('.js')
-    ? [
-        /\b(?:import|export)\b|\b(?:fetch|XMLHttpRequest|WebSocket|EventSource|importScripts)\s*\(|\bnavigator\s*\.\s*sendBeacon\s*\(/i,
-        'module imports and unmanaged network calls are forbidden',
-      ]
-    : path.endsWith('.css')
-      ? [
-          /@import\b|url\s*\(\s*(['"]?)(?!data:image\/(?:png|jpeg|gif|webp);base64,)[^)]*\)/i,
-          'external CSS resources and imports are forbidden',
-        ]
-      : null
-  if (!rule) return
-  const found = rule[0].exec(source)
-  if (!found) return
-  const line = source.slice(0, found.index).split('\n').length
-  const hit = found[0].length > 60 ? `${found[0].slice(0, 60)}…` : found[0]
-  packageError(`${rule[1]}: found "${hit}" at ${path}:${line}`)
-}
-
-function safePath(value) {
-  if (
-    typeof value !== 'string' ||
-    !value ||
-    value.includes('\0') ||
-    value.includes('\\') ||
-    value.startsWith('/') ||
-    /^[a-zA-Z]:/.test(value) ||
-    value.split('/').some((part) => !part || part === '.' || part === '..')
-  ) {
-    packageError(`unsafe path "${String(value)}"`)
-  }
-  return value
-}
-
-function validateDomain(value) {
-  if (typeof value !== 'string' || value.length > 253 || value.endsWith('.')) {
-    packageError('invalid domain')
-  }
-  const labels = value.split('.')
-  if (
-    labels.length < 2 ||
-    labels.some((label) => !/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label))
-  ) {
-    packageError(`invalid domain "${value}"`)
-  }
-  return value.toLowerCase()
-}
-
-export function validatePluginManifest(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) packageError('manifest must be an object')
-  if (Object.keys(value).some((key) => !MANIFEST_KEYS.has(key))) packageError('unknown manifest field')
-  const { id, name, version, apiVersion, entry, stylesheet, capabilities, domains } = value
-  if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9-]{1,63}$/.test(id)) packageError('invalid plugin id')
-  if (typeof name !== 'string' || !name.trim() || name.length > 100) packageError('invalid plugin name')
-  if (typeof version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
-    packageError('invalid plugin version')
-  }
-  if (apiVersion !== 1 && apiVersion !== 2) packageError('unsupported API version')
-  safePath(entry)
-  safePath(stylesheet)
-  if (!entry.endsWith('.js') || !stylesheet.endsWith('.css')) packageError('entry must be JavaScript and stylesheet must be CSS')
-
-  // API v2: capabilities optional (defaults to [])
-  const normalizedCapabilities = capabilities ?? []
-  if (!Array.isArray(normalizedCapabilities)) packageError('capabilities must be an array')
-  if (apiVersion === 1 && normalizedCapabilities.some((item) => !CAPABILITIES.has(item))) {
-    packageError('invalid capability')
-  }
-
-  if (domains !== undefined && !Array.isArray(domains)) packageError('domains must be an array')
-  const normalizedDomains = (domains ?? []).map(validateDomain)
-  if (new Set(normalizedDomains).size !== normalizedDomains.length) packageError('duplicate domain')
-  return {
-    id,
-    name: name.trim(),
-    version,
-    apiVersion,
-    entry,
-    stylesheet,
-    capabilities: [...new Set(normalizedCapabilities)],
-    domains: normalizedDomains,
-  }
-}
-
-function normalizeFiles(files, manifest) {
-  if (!files || typeof files !== 'object' || Array.isArray(files)) packageError('files must be a path-to-source object')
-  const paths = Object.keys(files)
-  if (paths.length > MAX_FILES) packageError('too many files')
-  const normalized = {}
-  let total = 0
-  for (const rawPath of paths) {
-    const filePath = safePath(rawPath)
-    if (filePath === 'manifest.json') packageError('manifest is generated from the manifest field')
-    if (/\.(?:mjs|cjs|jsx|ts|tsx)$/i.test(filePath) && filePath !== manifest.entry) {
-      packageError(`undeclared executable file "${filePath}"`)
-    }
-    if (filePath !== manifest.entry && filePath !== manifest.stylesheet && /\.(?:js|css)$/i.test(filePath)) {
-      packageError(`undeclared executable file "${filePath}"`)
-    }
-    const content = files[rawPath]
-    if (typeof content !== 'string' && !(content instanceof Uint8Array)) {
-      packageError(`file "${filePath}" must be text or bytes`)
-    }
-    const data = typeof content === 'string' ? stringToBytes(content) : content
-    total += data.byteLength
-    if (total > MAX_PACKAGE_BYTES) packageError('package is too large')
-    if (filePath === manifest.entry || filePath === manifest.stylesheet) validateSource(filePath, data, manifest.apiVersion)
-    normalized[filePath] = typeof content === 'string' ? content : bytesToString(data)
-  }
-  if (!(manifest.entry in normalized)) packageError('entry file is missing')
-  if (!(manifest.stylesheet in normalized)) packageError('stylesheet file is missing')
-  if (stringToBytes(normalized[manifest.entry]).byteLength > 2 * 1024 * 1024) packageError('entry file is too large')
-  return normalized
-}
-
-export function buildPluginArchive(sources) {
-  const manifest = validatePluginManifest(sources?.manifest)
-  const files = normalizeFiles(sources?.files, manifest)
-  const manifestJson = JSON.stringify(manifest)
-  if (stringToBytes(manifestJson).byteLength > MAX_MANIFEST_BYTES) packageError('manifest is too large')
-
-  const packageData = {
-    format: 'cordis-plugin',
-    manifest,
-    files,
-  }
-
-  const encoded = stringToBytes(JSON.stringify(packageData))
-  if (encoded.byteLength > MAX_ARCHIVE_BYTES) packageError('package is too large')
-  return encoded
-}
-
-export function readPluginArchive(bytes) {
-  if (!bytes || !(bytes instanceof Uint8Array) || bytes.byteLength === 0) {
-    packageError('package archive is empty or invalid')
-  }
-  let parsed
-  try {
-    const text = new TextDecoder('utf-8').decode(bytes)
-    parsed = JSON.parse(text)
-  } catch {
-    packageError('package is not a valid JSON archive')
-  }
-
-  if (!parsed || typeof parsed !== 'object') packageError('invalid package format')
-  const manifest = validatePluginManifest(parsed.manifest)
-  const files = parsed.files
-  if (!files || typeof files !== 'object') packageError('missing package files')
-
-  return {
-    manifest,
-    files,
-  }
-}

package/shared/plugin-package.test.mjs

@@ -1,94 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { buildPluginArchive, readPluginArchive } from './plugin-package.mjs'
-
-const source = {
-  manifest: {
-    id: 'sample-plugin',
-    name: 'Sample Plugin',
-    version: '1.0.0',
-    apiVersion: 1,
-    entry: 'plugin.js',
-    stylesheet: 'plugin.css',
-    capabilities: ['workspace.read'],
-    domains: ['api.example.test'],
-  },
-  files: {
-    'plugin.js': 'api.registerCommand("sample", () => "ok")',
-    'plugin.css': '.sample { color: red }',
-    'icon.svg': '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
-  },
-}
-
-test('plugin archive round-trips manifest and local source files', () => {
-  const archive = buildPluginArchive(source)
-  const result = readPluginArchive(archive)
-  assert.deepEqual(result.manifest, source.manifest)
-  assert.deepEqual(result.files, source.files)
-})
-
-test('plugin archive rejects traversal paths before packaging', () => {
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, '../outside.js': 'bad' } }),
-    /path/i,
-  )
-})
-
-test('plugin archive rejects a manifest whose entry is missing', () => {
-  assert.throws(() => buildPluginArchive({ ...source, files: { 'plugin.css': 'x' } }), /entry/i)
-})
-
-test('plugin archive rejects undeclared executable source', () => {
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, 'extra.js': 'alert(1)' } }),
-    /executable/i,
-  )
-})
-
-test('plugin archive rejects remote code declarations and invalid domains', () => {
-  assert.throws(
-    () => buildPluginArchive({ ...source, manifest: { ...source.manifest, entry: 'https://evil.test/p.js' } }),
-    /entry|path/i,
-  )
-  assert.throws(
-    () => buildPluginArchive({ ...source, manifest: { ...source.manifest, domains: ['https://example.test'] } }),
-    /domain/i,
-  )
-})
-
-test('plugin archive rejects unmanaged network APIs and external CSS resources', () => {
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'fetch("https://evil.test")' } }),
-    /network|remote/i,
-  )
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.css': '@import url("https://evil.test/style.css")' } }),
-    /network|remote|external/i,
-  )
-})
-
-test('a rejected source names the file, the line and the text that matched', () => {
-  // The pattern is text-only, so a comment or a string trips it too — the message
-  // has to point at the match or the author cannot find it.
-  assert.throws(
-    () =>
-      buildPluginArchive({
-        ...source,
-        files: { ...source.files, 'plugin.js': 'maxcode.log("hi")\n// export the palette\nconst x = 1' },
-      }),
-    /found "export" at plugin\.js:2/,
-  )
-  assert.throws(() => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'fetch("https://evil.test")' } }), /"fetch\("/)
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.css': '.a{}\n@import url("https://evil.test/x.css")' } }),
-    /plugin\.css:2/,
-  )
-})
-
-test('plugin archive rejects malformed or oversized archives', () => {
-  assert.throws(() => readPluginArchive(new Uint8Array([0, 1, 2, 3])), /archive|zip|package/i)
-  assert.throws(
-    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'x'.repeat(10_485_761) } }),
-    /size|large/i,
-  )
-})

package/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["./src/App.tsx","./src/main.tsx","./src/types.ts","./src/vite-env.d.ts","./src/agent/approval.ts","./src/agent/compact.ts","./src/agent/index.ts","./src/agent/model.ts","./src/agent/prompt.ts","./src/agent/queue.ts","./src/agent/subagent.ts","./src/agent/tools.ts","./src/agent/adapters/anthropic.ts","./src/agent/adapters/gemini.ts","./src/agent/adapters/openai-responses.ts","./src/agent/adapters/openai.ts","./src/agent/adapters/shared.ts","./src/components/ChatView.tsx","./src/components/CommandPalette.tsx","./src/components/Composer.tsx","./src/components/ContextBar.tsx","./src/components/DeployModal.tsx","./src/components/DiffView.tsx","./src/components/ErrorBoundary.tsx","./src/components/FileIcon.tsx","./src/components/HomeDashboard.tsx","./src/components/Logo.tsx","./src/components/Markdown.tsx","./src/components/McpPanel.tsx","./src/components/MessageItem.tsx","./src/components/ModelDeck.tsx","./src/components/PixleSol.tsx","./src/components/PluginBuilder.tsx","./src/components/PluginManager.tsx","./src/components/PreviewPane.tsx","./src/components/SessionsTab.tsx","./src/components/SettingsModal.tsx","./src/components/Sidebar.tsx","./src/components/Splash.tsx","./src/components/SystemPromptButton.tsx","./src/components/ToolCallCard.tsx","./src/components/TopBar.tsx","./src/components/TrajectoryView.tsx","./src/components/WorkspacePanel.tsx","./src/components/ui.tsx","./src/core/kernel.ts","./src/core/mcp-tools.ts","./src/core/types.ts","./src/core/plugins/tools/fs.ts","./src/core/plugins/tools/git.ts","./src/core/plugins/tools/grep.ts","./src/core/plugins/tools/shell.ts","./src/core/plugins/tools/skill.ts","./src/core/plugins/tools/subagent.ts","./src/core/plugins/tools/web.ts","./src/core/services/agent-loop.ts","./src/core/services/approval.ts","./src/core/services/compaction.ts","./src/core/services/llm.ts","./src/core/services/sessions.ts","./src/core/services/subagents.ts","./src/core/services/system-prompt.ts","./src/core/services/titles.ts","./src/core/services/tools.ts","./src/core/services/ui.ts","./src/data/providers.ts","./src/lib/boot.ts","./src/lib/context.ts","./src/lib/conversation.ts","./src/lib/credits.ts","./src/lib/daemon.ts","./src/lib/diff.ts","./src/lib/hooks.ts","./src/lib/mcp-config.ts","./src/lib/permissions.ts","./src/lib/pixlesol.ts","./src/lib/plugin-folder.ts","./src/lib/reasoning.ts","./src/lib/retry.ts","./src/lib/sse.ts","./src/lib/system-prompt.ts","./src/lib/themes.ts","./src/lib/usage.ts","./src/lib/utils.ts","./src/plugins/api.ts","./src/plugins/bridge.d.mts","./src/plugins/index.ts","./src/plugins/preview.ts","./src/plugins/runtime.ts","./src/plugins/types.ts","./src/store/chats.ts","./src/store/mcp.ts","./src/store/models.ts","./src/store/settings.ts","./src/store/skills.ts","./src/store/ui.ts","./src/store/workspace.ts"],"version":"5.9.3"}