 rUv
|
1e105c799b
|
fix: v3.5.8-v3.5.14 ADR-061 security fixes, cross-platform hooks, Windows parity
ADR-061 Deep Audit Fixes (12 P0/P1/D issues):
- S-1: Replace execSync with execFileSync to prevent command injection (GCS)
- S-2: Add MAX_BUFFER constant (10MB) to prevent unbounded stdout capture
- S-3: Add validatePackageName() to sanitize plugin names
- S-4: Add IPFS CID format validation before fetch
- S-5: Add buffer size limits to execSync calls
- D-1: Fix CFP magic-number check (use subarray, not slice)
- D-2: Fix unsupported format error (throw instead of silent fallback)
- D-3: Fix MCP partial-JSON accumulator (per-session buffering)
- D-4: Fix duplicate provider registration guard
- D-5: Fix memory namespace parameter passthrough
- D-6: Fix process command error handler (use err.message)
- D-7: Fix GCS credential loading (resolve path, validate fields)
ADR-062 Cross-Platform Hook Commands:
- Replace node -e "..." one-liners with node script subcommand invocation
- Add cmd /c prefix on Windows to bypass PowerShell stdin issues
- Fix stdin reading with 500ms timeout (prevents Windows hanging)
- Guarantee process.exitCode = 0 in all hook scripts
- StatusLine uses plain node (no cmd /c) for proper stdin forwarding
- Fix invalid SubagentEnd → SubagentStop hook event name
- Restore valid SubagentStart hook event
Tests: 1600 passed, 46 skipped across 23 test files
Co-Authored-By: claude-flow <ruv@ruv.net>
|
2026-03-06 00:25:28 +00:00 |
|