smashimo/oh-my-pi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(plugins): loaded legacy extensions safely

Browse Source 
Restored the pi-ai OAuth device-code helper expected by legacy provider packages and rewrote extension-owned bare dependencies to file URLs during validation so compiled binaries do not rely on Bun's runtime bare resolver.

Excluded worker entry modules from the compiled legacy bundled registry so validation does not import worker-only code on the main thread.

Fixes #3508
This commit is contained in:
roboomp
2026-06-26 00:06:25 +00:00
parent 0fc6d136c3
commit b7706f1a44
10 changed files with 367 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/coding-agent/scripts/generate-legacy-pi-bundled-registry.ts
+10
View File
@@ -117,6 +117,15 @@ function isSafeWildcardBasename(basename: string): boolean {
return true;
}
// Worker entry modules intentionally throw when imported outside a Worker. The
// bundled registry loads on the main thread during legacy extension validation,
// so these exported subpaths must stay out of the static registry.
const MAIN_THREAD_UNSAFE_WILDCARD_BASENAMES = new Set(["worker-entry"]);
function isMainThreadSafeWildcardBasename(basename: string): boolean {
return !MAIN_THREAD_UNSAFE_WILDCARD_BASENAMES.has(basename);
}
interface WildcardPattern {
readonly exportPrefix: string;
readonly exportSuffix: string;
@@ -217,6 +226,7 @@ async function collectEntries(): Promise<RegistryEntry[]> {
if (!match.endsWith(pattern.sourceSuffix)) continue;
const basename = match.slice(0, match.length - pattern.sourceSuffix.length);
if (!isSafeWildcardBasename(basename)) continue;
if (!isMainThreadSafeWildcardBasename(basename)) continue;
if (basename.includes("/")) continue;
const subpath = `${pattern.exportPrefix}${basename}${pattern.exportSuffix}`;
const key = `${pkg.name}/${subpath}`;