@wrongstack/plugin-sdk 0.318.0 → 0.319.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/runtime.js +7 -0
- package/package.json +3 -3
package/dist/runtime.js
CHANGED
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
import { execFile } from "node:child_process";
|
|
3
3
|
import { existsSync, readdirSync, statSync } from "node:fs";
|
|
4
4
|
import { basename, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
|
|
5
|
+
import { buildChildEnv } from "@wrongstack/core/utils";
|
|
5
6
|
|
|
6
7
|
// src/runtime/llm.ts
|
|
7
8
|
function stripOuterMarkdownFence(text) {
|
|
@@ -769,6 +770,12 @@ function runRunnerCommand(argv, options) {
|
|
|
769
770
|
invocation.args,
|
|
770
771
|
{
|
|
771
772
|
cwd: trimmedCwd,
|
|
773
|
+
// H-8 (security report VF-09): plugin subprocesses inherit the FULL
|
|
774
|
+
// environment by default — every provider API key and the vault
|
|
775
|
+
// passphrase were visible to any plugin exec(). Route through the
|
|
776
|
+
// shared allowlist + secret-strip child env (operators can widen it
|
|
777
|
+
// deliberately via WRONGSTACK_CHILD_ENV_PASSTHROUGH).
|
|
778
|
+
env: buildChildEnv(),
|
|
772
779
|
timeout: options.timeoutMs,
|
|
773
780
|
signal: options.signal,
|
|
774
781
|
maxBuffer: MAX_BUFFER_BYTES,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@wrongstack/plugin-sdk",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.319.0",
|
|
4
4
|
"description": "Authoring SDK for WrongStack plugins — the plugin contract types, definePlugin, and shared runtime helpers. Third-party plugins should depend on this package only.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "ECOSTACK TECHNOLOGY OÜ",
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
"vitest": "^4.1.11"
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@wrongstack/core": "0.
|
|
33
|
-
"@wrongstack/tools": "0.
|
|
32
|
+
"@wrongstack/core": "0.319.0",
|
|
33
|
+
"@wrongstack/tools": "0.319.0"
|
|
34
34
|
},
|
|
35
35
|
"scripts": {
|
|
36
36
|
"build": "node ../../scripts/build-package.mjs",
|