platform/todo/plugin-ecosystem/third-party-plugin-sidecars-are-unconfined.md at master

Files

T

pastilhasandClaude Fable 5 6071ded175 todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-21 05:42:39 +00:00

730 B

Raw Permalink Blame History

id, title, theme, status, created, date_source, order

id	title	theme	status	created	date_source	order
plugin-ecosystem/third-party-plugin-sidecars-are-unconfined	Third-party plugin sidecars are unconfined	plugin-ecosystem	open	2026-08-18	section	2

Third-party plugin sidecars are unconfined. A plugin sidecar runs bun run <script> with cwd: PLATFORM_DIR, so Bun auto-loads .env and it gets POSTGRES_URL; it runs as the service user, which owns secrets/officer-keys.db and can therefore mint an owner JWT. Fine for first-party plugins, total compromise for anyone else's.

The mechanism to fix it already exists and is pointed elsewhere: spawn-as-member.ts drops privileges with setpriv --reset-env and a six-name allowlist for exactly this reason.

730 B Raw Permalink Blame History

730 B

Raw Permalink Blame History