fix: resolve open issues #13, #14, #15 — env filter, macOS paths, changelog cleanup#18
Merged
wat-hiroaki merged 2 commits intomainfrom Mar 31, 2026
Merged
Conversation
…dge cases - Filter extraEnvVars through denylist before merging with plugin env - Remove $ anchor from api.?key pattern to catch API_KEY_FILE variants - Wire PluginPermissions into PluginManifest type Closes #13 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add explanatory comment for DA response regex in utils.ts - Clean up CHANGELOG v0.9.1 to remove duplicate entries Closes #15 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all open issues from the PR #12 review.
Issue #13 — Plugin env filter hardening
extraEnvVarsis now filtered throughfilterEnvForPlugin()before merging with the plugin env, preventing denylist bypass via spread override$anchor fromapi.?keypattern soSOME_API_KEY_FILE,API_KEY_PATHetc. are also blockedpermissions?: PluginPermissionsfield toPluginManifestinterfaceIssue #14 — macOS command path support
/usr/local/binand/opt/homebrew/binto allowed paths ondarwin~/Library/Application Support/claude-code-studio/pluginspathisInstalled()andresolveCommand()to check Homebrew paths on macOSIssue #15 — Cleanup
utils.tsTest plan
npm run lint— 0 errorsnpx tsc --noEmit— cleannpm run build— cleannpm test— 27/27 pass (14 new for env filter pattern edge cases)Closes #13, closes #14, closes #15
🤖 Generated with Claude Code