opencode-api-security-testing 3.0.6 → 3.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-api-security-testing",
-  "version": "3.0.6",
+  "version": "3.0.8",
   "description": "API Security Testing Plugin for OpenCode - Automated vulnerability scanning and penetration testing",
   "type": "module",
   "main": "src/index.ts",
@@ -10,10 +10,12 @@
     "core/",
     "references/",
     "SKILL.md",
-    "postinstall.mjs"
+    "postinstall.mjs",
+    "preuninstall.mjs"
   ],
   "scripts": {
-    "postinstall": "node postinstall.mjs"
+    "postinstall": "node postinstall.mjs",
+    "preuninstall": "node preuninstall.mjs"
   },
   "keywords": [
     "opencode",
@@ -37,5 +39,9 @@
   "dependencies": {
     "@opencode-ai/plugin": "^1.1.19",
     "@opencode-ai/sdk": "^1.1.19"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.2",
+    "typescript": "^6.0.2"
   }
 }

package/preuninstall.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+
+/**
+ * preuninstall.mjs - API Security Testing Plugin Cleanup
+ * 
+ * Removes:
+ * 1. agents from ~/.config/opencode/agents/
+ * 2. SKILL.md and references from ~/.config/opencode/skills/api-security-testing/
+ */
+
+import { unlinkSync, existsSync, readdirSync, rmdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = join(__filename, "..");
+
+function getOpencodeBaseDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || "/root";
+  return join(home, ".config", "opencode");
+}
+
+const AGENTS_TO_REMOVE = [
+  "api-cyber-supervisor.md",
+  "api-probing-miner.md",
+  "api-resource-specialist.md",
+  "api-vuln-verifier.md",
+];
+
+function main() {
+  const agentsTargetDir = join(getOpencodeBaseDir(), "agents");
+  const skillTargetDir = join(getOpencodeBaseDir(), "skills", "api-security-testing");
+  
+  console.log("[api-security-testing] Cleaning up...");
+  console.log(`  Home: ${getOpencodeBaseDir()}`);
+
+  let totalRemoved = 0;
+  let totalFailed = 0;
+
+  console.log("\n[1/2] Removing agents...");
+  for (const agent of AGENTS_TO_REMOVE) {
+    const agentPath = join(agentsTargetDir, agent);
+    try {
+      if (existsSync(agentPath)) {
+        unlinkSync(agentPath);
+        console.log(`  ✓ ${agent}`);
+        totalRemoved++;
+      }
+    } catch (err) {
+      console.error(`  ✗ ${agent}: ${err.message}`);
+      totalFailed++;
+    }
+  }
+
+  console.log("\n[2/2] Removing skill files...");
+  try {
+    if (existsSync(skillTargetDir)) {
+      rmSync(skillTargetDir, { recursive: true, force: true });
+      console.log(`  ✓ ${skillTargetDir}`);
+      totalRemoved++;
+    }
+  } catch (err) {
+    console.error(`  ✗ ${skillTargetDir}: ${err.message}`);
+    totalFailed++;
+  }
+
+  console.log(`\n========================================`);
+  if (totalFailed === 0) {
+    console.log(`✓ Removed ${totalRemoved} item(s)`);
+    console.log(`\nThanks for using api-security-testing!`);
+  } else {
+    console.log(`⚠ Removed ${totalRemoved}, failed ${totalFailed}`);
+  }
+}
+
+main();

package/src/hooks/directory-agents-injector.ts

@@ -1,18 +1,24 @@
 import type { PluginInput } from "@opencode-ai/plugin";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
 
 const AGENTS_FILENAME = "AGENTS.md";
 const AGENTS_DIR = ".config/opencode/agents";
 
+function getHomeDir(): string {
+  return process.env.HOME || process.env.USERPROFILE || "/root";
+}
+
 export function createDirectoryAgentsInjectorHook(ctx: PluginInput) {
+  const injectedPaths = new Set<string>();
+
   function resolveAgentsDir(): string | null {
-    const home = process.env.HOME || process.env.USERPROFILE;
-    if (!home) return null;
+    const home = getHomeDir();
     return join(home, AGENTS_DIR);
   }
 
   function findAgentsMdUp(startDir: string, agentsDir: string): string | null {
+    const home = getHomeDir();
     let current = startDir;
 
     while (true) {
@@ -35,8 +41,6 @@ export function createDirectoryAgentsInjectorHook(ctx: PluginInput) {
     return `api-sec-inject-${sessionID}`;
   }
 
-  const injectedPaths = new Set<string>();
-
   const toolExecuteAfter = async (
     input: { tool: string; sessionID: string; callID: string },
     output: { title: string; output: string; metadata: unknown }

package/src/index.ts

@@ -1,6 +1,6 @@
 import type { Plugin } from "@opencode-ai/plugin";
 import { tool } from "@opencode-ai/plugin";
-import { join } from "path";
+import { join, dirname, resolve } from "path";
 import { existsSync, readFileSync } from "fs";
 
 const SKILL_DIR = "skills/api-security-testing";
@@ -54,6 +54,12 @@ To activate these agents, simply mention their name in your response (e.g., "@ap
   }
 }
 
+async function execShell(ctx: unknown, cmd: string): Promise<string> {
+  const shell = ctx as { $: (strings: TemplateStringsArray, ...expr: unknown[]) => Promise<{ toString(): string }> };
+  const result = await shell.$`${cmd}`;
+  return result.toString();
+}
+
 const ApiSecurityTestingPlugin: Plugin = async (ctx) => {
   console.log("[api-security-testing] Plugin loaded");
 
@@ -78,8 +84,7 @@ tester = DeepAPITesterV55(target='${args.target}', headless=True)
 results = tester.run_test()
 print(results)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -100,8 +105,7 @@ fuzzer = APIFuzzer('${args.endpoint}')
 results = fuzzer.fuzz(method='${args.method || 'GET'}')
 print(results)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -122,8 +126,7 @@ verifier = VulnVerifier()
 result = verifier.verify('${args.vuln_type}', '${args.endpoint}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -145,8 +148,7 @@ print(f'发现 {len(endpoints)} 个端点:')
 for ep in endpoints:
     print(ep)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -166,8 +168,7 @@ parser = JSParser()
 endpoints = parser.parse_file('${args.file_path}')
 print(f'从 JS 发现 {len(endpoints)} 个端点')
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -187,8 +188,7 @@ analyzer = SmartAnalyzer()
 result = analyzer.graphql_test('${args.endpoint}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -208,8 +208,7 @@ tester = CloudStorageTester()
 result = tester.full_test('${args.bucket_url}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -230,8 +229,7 @@ tester = IDORTester()
 result = tester.test('${args.endpoint}', '${args.resource_id}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -252,8 +250,7 @@ tester = SQLiTester()
 result = tester.test('${args.endpoint}', '${args.param}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
 
@@ -273,8 +270,7 @@ tester = AuthTester()
 result = tester.test('${args.endpoint}')
 print(result)
 "`;
-          const result = await ctx.$`${cmd}`;
-          return result.toString();
+          return await execShell(ctx, cmd);
         },
       }),
     },
@@ -344,9 +340,4 @@ print(result)
   };
 };
 
-function resolve(filePath: string): string {
-  if (filePath.startsWith("/")) return filePath;
-  return join(process.cwd(), filePath);
-}
-
-export default ApiSecurityTestingPlugin;
+export default ApiSecurityTestingPlugin;