Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remote project plugins: replace the host mirror (Windows hosts, per-file framing)

Open
  • Is something wrong?
#7,226 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
developer-experience

Research direction

Start by reading agentPlugins/discovery.ts and the existing host mirror flow introduced by #6426. The proposal is to make discovery and plugin readers use an in-memory read-only runtime, with per-file framing in the listing; check the relevant tests and add coverage for Windows hosts and concurrent file changes. Done means remote project plugins are read without host filesystem paths and per-file content boundaries are verified.

Written by the indexing model from the issue text.

Description

Summary

After #6426 (#7220, #7222, #7224), Xum reads the project plugins of a trusted SSH or Docker checkout through a host mirror: one remote listing, rebuilt in a private temp folder, parsed by the unchanged discoverAgentPlugins. Three gaps remain. They have one common fix, so this issue tracks them together.

  1. Windows hosts load no remote project plugins. Windows path rules (8.3 short names, reserved device names, trailing dots and spaces) can alias mirror paths, so createSnapshot returns no snapshot when process.platform is win32 (fail closed).
  2. No per-file framing. The listing sends file sizes in one pass (wc -c) and bytes in a second pass (cat), and checks only that the sizes add up. A concurrent writer in a trusted checkout can shift file boundaries (two files changing by equal and opposite sizes, or a rename between the passes). That gives wrong content, never an escape from the mirror.
  3. The mirror is the source of this class of findings. Case folding, Unicode normalization and Windows paths are all host-filesystem effects.

Proposal

Replace the host mirror with an in-memory read-only runtime fed by the listing, so discoverAgentPlugins and the plugin readers never touch the host filesystem for remote content. This needs agentPlugins/discovery.ts to read through a runtime or file-reader interface instead of node:fs. Then:

  • Windows hosts work, because no host paths are created.
  • Per-file framing can be done in the listing format (for example a size and a digest per file).

Refs #6426.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Dominant language
TypeScript
Stars
2.1k
Forks
140
Avg merge
5h 8m
Merged PRs (30d)
952

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from coder/xum

All issues in coder/xum

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.