Remove the legacy Plugin Applier API - #10
Conversation
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e08279b6cd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ? `the "${skill.name}" skill from the "${plugin.name}" plugin` | ||
| : `the "${plugin.name}" plugin`; | ||
| try { | ||
| await sendToBot(bot_ref, `Use ${subject} for the current task.`); |
There was a problem hiding this comment.
When the explorer is running and a browser permits cross-origin loopback requests, any webpage can issue a no-cors POST with a text/plain JSON body because readBody ignores the content type and this route checks neither Origin nor a CSRF token. Supplying a known bot/group ID therefore reaches this immediate gbot send call without the confirmation click promised by the UI, potentially prompting that target unsolicited; require a same-origin/CSRF check before executing the command.
Useful? React with 👍 / 👎.
Document the non–Team Marketplace install path and its clean-clone install/doctor proof.
1 participant
Summary
gbot sendmissing_attach_apipathsVerification
npm run check(validate, build, 18 tests, artifact validation, packed clean-consumer smoke)install.mjs,INSTALL.md,.cursor-plugin/plugin.json, and portableplugin.json; no Claude/Codex manifestsassets/data/**andscripts/**remain because they are live generated runtime paths used by the bundled server, command, and packed smoke. The pre-#7 handwritten installer files remain deleted. This private package does not use changesets.Post-merge proof
Publish Agent Bundlesucceeded for8b41f0a1e2bf547d54c9fc5b8e305ffba488781cagent-bundle-artifactupdated to5aa31ac6c5d841b5a630d9b018a493fa22105b72node ./install.mjs, thennpx --no-install agent-bundle doctor --from . --host cursor→ 0 errors (2 unrelated stale-runtime warnings, 1 host-observability info)