Remote project plugins: replace the host mirror (Windows hosts, per-file framing)

Abierto
  • ¿Algo no está bien?
#7,226 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
developer-experience

Línea de trabajo

Start by reading agentPlugins/discovery.ts and the existing host mirror flow introduced by #6426. The proposal is to make discovery and plugin readers use an in-memory read-only runtime, with per-file framing in the listing; check the relevant tests and add coverage for Windows hosts and concurrent file changes. Done means remote project plugins are read without host filesystem paths and per-file content boundaries are verified.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

After #6426 (#7220, #7222, #7224), Xum reads the project plugins of a trusted SSH or Docker checkout through a host mirror: one remote listing, rebuilt in a private temp folder, parsed by the unchanged discoverAgentPlugins. Three gaps remain. They have one common fix, so this issue tracks them together.

  1. Windows hosts load no remote project plugins. Windows path rules (8.3 short names, reserved device names, trailing dots and spaces) can alias mirror paths, so createSnapshot returns no snapshot when process.platform is win32 (fail closed).
  2. No per-file framing. The listing sends file sizes in one pass (wc -c) and bytes in a second pass (cat), and checks only that the sizes add up. A concurrent writer in a trusted checkout can shift file boundaries (two files changing by equal and opposite sizes, or a rename between the passes). That gives wrong content, never an escape from the mirror.
  3. The mirror is the source of this class of findings. Case folding, Unicode normalization and Windows paths are all host-filesystem effects.

Proposal

Replace the host mirror with an in-memory read-only runtime fed by the listing, so discoverAgentPlugins and the plugin readers never touch the host filesystem for remote content. This needs agentPlugins/discovery.ts to read through a runtime or file-reader interface instead of node:fs. Then:

  • Windows hosts work, because no host paths are created.
  • Per-file framing can be done in the listing format (for example a size and a digest per file).

Refs #6426.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Lenguaje dominante
TypeScript
Estrellas
2.1k
Forks
139
Merge medio
3 h 35 min
PR fusionados (30 d)
950

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de coder/xum

Todos los issues de coder/xum

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.