loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from #2909)
- progressiveAging: type compression results so messages[0].content is
indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: #2903 (perf-ram) prunes idle rate-limit gates
on zero; assert no-running/empty-queue without assuming the entry persists.
The 3.8.6 variant of #2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.
Sincroniza a main com os 103 commits acumulados em release/v3.8.6 após o release v3.8.6 (agy provider, web-cookie providers, zero-latency combos, per-API-key limits, security fixes, etc). Conflito pt-BR.json resolvido por união de chaves.
Update the main and localized changelogs with the 3.8.7 release notes, including new API self-service status, analytics retention, RAM optimizations, and token accounting fixes.
Clarify release skill instructions to ensure new release branches are always created from the latest main branch.
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
