mirror of
https://github.com/stablyai/orca.git
synced 2026-11-14 01:47:24 +00:00
Neil
fdc03848a5
* fix(plugins): protect every security and destructive string from language packs Language packs could rewrite trust copy outside a hand-kept list of app areas (catalog-link dialog, browser-extension Allow/Deny, Node mirror). Protected keys are now generated from structure: every key in a file that renders a security surface, a destructive confirmation, or a native message box, or that carries a // @protected-copy pragma, plus same-directory copy modules. verify:localization-catalogs fails when the list is stale. Pack strings are also capped at max(64, 4x English) characters and may not contain control or bidi characters. Validation stays strict; loading drops only the offending entries. * chore(plugins): resync protected copy keys with main * fix(plugins): cap pack strings in shared strict checks and pin new trust copy * fix(plugins): keep the packaged CLI off the English catalog * chore(plugins): resync protected copy keys with main * chore(plugins): resync protected copy keys with main
33 lines
1.1 KiB
JavaScript
33 lines
1.1 KiB
JavaScript
import process from 'node:process'
|
|
import { pathToFileURL } from 'node:url'
|
|
import {
|
|
collectLocalizationReferences,
|
|
main as verifyCatalog
|
|
} from './verify-localization-catalog.mjs'
|
|
import { main as verifyRuntimeCatalog } from './generate-runtime-required-english-catalog.mjs'
|
|
import { main as verifyProtectedCopyKeys } from './protected-copy-keys.mjs'
|
|
|
|
export async function main(root = process.cwd()) {
|
|
// Share only this invocation's scan, never cached evidence from another checkout.
|
|
const references = await collectLocalizationReferences(root)
|
|
const results = await Promise.allSettled([
|
|
verifyCatalog(root, {}, references),
|
|
verifyRuntimeCatalog(root, [], references),
|
|
verifyProtectedCopyKeys(root, [])
|
|
])
|
|
let exitCode = 0
|
|
for (const result of results) {
|
|
if (result.status === 'rejected') {
|
|
console.error(result.reason)
|
|
exitCode = 1
|
|
} else if (result.value !== 0) {
|
|
exitCode = 1
|
|
}
|
|
}
|
|
return exitCode
|
|
}
|
|
|
|
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
|
|
process.exit(await main())
|
|
}
|