pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
730 B
Markdown
18 lines
730 B
Markdown
---
|
|
id: plugin-ecosystem/third-party-plugin-sidecars-are-unconfined
|
|
title: "Third-party plugin sidecars are unconfined"
|
|
theme: plugin-ecosystem
|
|
status: open
|
|
created: 2026-08-18
|
|
date_source: section
|
|
order: 2
|
|
---
|
|
|
|
**Third-party plugin sidecars are unconfined.** A plugin sidecar runs `bun run <script>` with
|
|
`cwd: PLATFORM_DIR`, so Bun auto-loads `.env` and it gets `POSTGRES_URL`; it runs as the service
|
|
user, which owns `secrets/officer-keys.db` and can therefore mint an owner JWT. Fine for
|
|
first-party plugins, total compromise for anyone else's.
|
|
|
|
The mechanism to fix it already exists and is pointed elsewhere: `spawn-as-member.ts` drops
|
|
privileges with `setpriv --reset-env` and a six-name allowlist for exactly this reason.
|