iamtoruk 8b0e9af431 fix(plugins): sign and install plugin trees recursively; sections stay runtime-mutable ... Closes security hole: plugin commands (executable .mjs files under commands/) are now part of the signed digest, preventing tampering. getPluginFilesList and sign-plugin.mjs getFilesList now walk directories recursively with relative POSIX paths, hashing all regular files while excluding codeburn-plugin.sig (the signature itself) and sections/ (runtime-mutable plugin output). plugin add copies the full tree recursively, preserving directory structure including commands/ and commands/subdir/*.mjs. Installed plugins verify correctly without CODEBURN_PLUGIN_DEV. checkForSymlinks now recurses to catch symlinks anywhere in the tree. Sections may change at runtime without breaking verification because they are excluded from the canonical digest.		2026-08-28 02:14:51 -07:00
..
upgrade-path	merge(main): rematch #1118 after #1116/#1122 — daily cache v29	2026-08-23 21:18:07 +05:30
bundle-litellm.mjs	fix(models): price gpt-5.6-codex and gpt-5.6-codex-max	2026-08-21 14:53:00 -07:00
sign-plugin.mjs	fix(plugins): sign and install plugin trees recursively; sections stay runtime-mutable	2026-08-28 02:14:51 -07:00
smoke-plugin-socket.mjs	feat(plugins): ed25519 release-key verification and plugin add/remove (9b)	2026-08-28 00:30:43 -07:00