From 6bef50224d55a6a145a36986efe46aa627d5a77d Mon Sep 17 00:00:00 2001
From: RinZ27 <222222878+RinZ27@users.noreply.github.com>
Date: Thu, 16 Apr 2026 20:57:50 +0700
Subject: [PATCH] security: remove insecure CWD from plugin discovery paths

---
 eostudio/core/geometry/primitives.py | 17 +++++++++++++++++
 eostudio/plugins/plugin_base.py      |  1 -
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/eostudio/core/geometry/primitives.py b/eostudio/core/geometry/primitives.py
index a1b824e..088ffc2 100644
--- a/eostudio/core/geometry/primitives.py
+++ b/eostudio/core/geometry/primitives.py
@@ -156,6 +156,23 @@ class Mesh:
     faces: List[Face] = field(default_factory=list)
     normals: List[Vec3] = field(default_factory=list)
 
+    def compute_normals(self) -> None:
+        """Compute vertex normals by averaging face normals."""
+        self.normals = [Vec3(0, 0, 0) for _ in range(len(self.vertices))]
+        for face in self.faces:
+            if face.v0 >= len(self.vertices) or face.v1 >= len(self.vertices) or face.v2 >= len(self.vertices):
+                continue
+            v0 = self.vertices[face.v0]
+            v1 = self.vertices[face.v1]
+            v2 = self.vertices[face.v2]
+            edge1 = v1 - v0
+            edge2 = v2 - v0
+            n = edge1.cross(edge2).normalized()
+            self.normals[face.v0] += n
+            self.normals[face.v1] += n
+            self.normals[face.v2] += n
+        self.normals = [n.normalized() for n in self.normals]
+
 
 # ---------------------------------------------------------------------------
 # Factory functions
diff --git a/eostudio/plugins/plugin_base.py b/eostudio/plugins/plugin_base.py
index e0ca1cc..b211877 100644
--- a/eostudio/plugins/plugin_base.py
+++ b/eostudio/plugins/plugin_base.py
@@ -175,7 +175,6 @@ def __init__(
         self.hooks: Dict[PluginHook, List[Plugin]] = {h: [] for h in PluginHook}
         self.plugin_dirs: List[str] = plugin_dirs or [
             os.path.expanduser("~/.EoStudio/plugins"),
-            os.path.join(".", "plugins"),
         ]
         self._manifests: Dict[str, PluginManifest] = {}