Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remote plugin listing: tar checksum check and read-only snapshot bytes

Open
  • Is something wrong?
#7,267 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
backend, security

Research direction

Start with src/node/services/agentPlugins/remotePluginListing.ts, especially parseTarFiles and tarMemberAt, then inspect MemoryPluginFs.readFileCapped and the callers that may mutate its returned bytes. Check the tar checksum and end-of-archive handling, and trace which callers need writable bytes. Done means corrupt tar data is rejected and cached snapshot bytes cannot be corrupted by callers, while preserving the intended warm-read behavior.

Written by the indexing model from the issue text.

Description

Follow-up from the final check of #7246 (remote plugin listing parser, Refs #6426). Neither item is a blocker: every name in the listing is validated again, and a bad archive refuses the whole listing.

  1. parseTarFiles (src/node/services/agentPlugins/remotePluginListing.ts, tarMemberAt) does not check the tar header checksum, and it ignores bytes after the end-of-archive block. A checksum check would catch a corrupt transport earlier.
  2. MemoryPluginFs.readFileCapped returns a view of the cached snapshot Buffer, not a copy. This is intended: the perf owner asked for a view so a warm read never copies (#6426). A caller that mutates the returned bytes corrupts the cache. Options: document the read-only contract at each caller, or return a copy only for callers that write.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Dominant language
TypeScript
Stars
2.1k
Forks
140
Avg merge
5h 8m
Merged PRs (30d)
952

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from coder/xum

All issues in coder/xum

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.