Release v0.2.0 — plugins, MCP, twelve frameworks - #5
Merged
Conversation
Hono, Koa, Hapi, Sails.js, Astro, Remix, and Gatsby now have profiles, remediation on every rule, and a square vulnerable/clean matrix. Expand ssrf, open-redirect, and sensitive-data-logged shapes across all twelve stacks, fix cookie/header false matches found in review, and rewrite README/npm copy in plain language. Co-authored-by: Cursor <cursoragent@cursor.com>
Sandboxed source-only plugins via wasmtime, stdio MCP tools, agent-rules init, and SDK/scaffold support — with README messaging that states the limits plainly. Co-authored-by: Cursor <cursoragent@cursor.com>
Containment fixes from the whitebox pass, MCP/agent messaging up front, and allow CDLA-Permissive-2.0 plus a versioned transport dev-dep so supply-chain CI does not fail on push. Co-authored-by: Cursor <cursoragent@cursor.com>
Wrap tool results in a trust-boundary envelope, strip control/invisible characters and chat role markers, sanitise plugin why at emit time, and warn agents via init --agent-rules that findings are evidence not orders. Co-authored-by: Cursor <cursoragent@cursor.com>
Require tempting + safe-redirect on every clean twin, lock multi-fire counts to named source shapes (fetch/axios, redirect/Location, …), and assert SHARED_FIRES through the npm CLI on all twelve frameworks. Co-authored-by: Cursor <cursoragent@cursor.com>
Mark the ROADMAP bar shipped, point security reports at GitHub advisories, and keep npm/README claims honest about source-only plugins and read-only MCP. Co-authored-by: Cursor <cursoragent@cursor.com>
The non-unix open path used fs::symlink_metadata without importing std::fs, and OpenOptions was unix-only so -D warnings failed the Windows CI job. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Pull request overview
Release v0.2.0 of owlwarden: adds a sandboxed WASM plugin host and an MCP (stdio) surface for coding agents, expands supported Node framework coverage to twelve frameworks with a square fixture matrix, and aligns docs/manifests/messaging with what ships.
Changes:
- Add v0.2 plugin + agent surface:
owlwarden mcp,init --agent-rules, andplugin scaffold, plus plugin loading via--plugin. - Expand framework support (static + dynamic fixtures, routing/taint vocab) and extend rule remediations across the new frameworks.
- Bump versions to 0.2.0 across Cargo/npm and update SECURITY/ROADMAP/docs to match shipped capabilities and hardening.
Reviewed changes
Copilot reviewed 213 out of 214 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| SECURITY.md | Update vulnerability reporting + v0.2 threat model details |
| ROADMAP.md | Mark v0.2 as shipped; clarify remaining work |
| CONTRIBUTING.md | Update fixture-matrix size reference (12×12) |
| deny.toml | Allow CDLA-Permissive-2.0 (webpki-roots) |
| Cargo.toml | Workspace v0.2.0 bump; add plugin-host + wasmtime deps |
| docs/reference/errors.md | Document E_PLUGIN_INVALID |
| docs/explanation/agent-integration.md | Document shipped MCP + init --agent-rules |
| docs/adr/README.md | Add ADR 0015 to index |
| packages/sdk/src/index.ts | Export plugin authoring schemas/types |
| packages/sdk/src/report.ts | Add new builtin frameworks to schema |
| packages/sdk/src/plugin.ts | Add plugin manifest/capability schemas |
| packages/sdk/test/plugin.test.ts | Tests for plugin manifest validation rules |
| packages/sdk/test/contract.test.ts | Update golden framework list expectations |
| packages/sdk/package.json | Bump @dointhai/owlwarden-sdk to 0.2.0 |
| packages/config/package.json | Bump @dointhai/owlwarden-config to 0.2.0 |
| packages/cli/package.json | Bump CLI to 0.2.0; keywords/description update |
| packages/cli/src/args.ts | Add mcp/init/plugin-scaffold + plugin flags parsing |
| packages/cli/src/run.ts | Wire new commands into CLI runner |
| packages/cli/src/help.ts | Update help text for new commands/options |
| packages/cli/src/safe-write.ts | Add parent dir creation + symlink protections for writes |
| packages/cli/src/commands/scan.ts | Enforce --allow-plugins under --ci; pass plugins to native |
| packages/cli/src/commands/init.ts | Implement init --agent-rules output generation |
| packages/cli/src/commands/plugin-scaffold.ts | Implement plugin scaffold output generation |
| packages/cli/test/args.test.ts | Tests for new commands and flags |
| packages/cli/test/mcp-protocol.test.ts | Tests for MCP stdio protocol handling |
| packages/cli/test/agent-safety.test.ts | Tests for agent-safety sanitization/envelope framing |
| fixtures/golden/coverage.json | Update golden coverage for new frameworks |
| fixtures/should-not-fire/README.md | Update fixture grid docs for 12 frameworks |
| fixtures/vulnerable/next-api/package.json | Add axios dependency for SSRF shape parity |
| fixtures/vulnerable/next-api/app/api/users/route.ts | Add accessToken logging shape for sensitive-data-logged |
| fixtures/vulnerable/next-api/app/api/proxy/route.ts | Add axios + Location-header redirect shape |
| fixtures/vulnerable/nuxt-api/package.json | Add axios dependency |
| fixtures/vulnerable/nuxt-api/server/api/session.post.ts | Add accessToken logging shape |
| fixtures/vulnerable/nuxt-api/server/api/proxy.get.ts | Add axios SSRF + manual Location redirect shape |
| fixtures/vulnerable/nest-api/package.json | Add axios dependency |
| fixtures/vulnerable/nest-api/src/users/users.controller.ts | Add axios SSRF + manual Location redirect shape |
| fixtures/vulnerable/express-api/package.json | Add axios dependency |
| fixtures/vulnerable/express-api/src/app.ts | Add accessToken logging shape |
| fixtures/vulnerable/express-api/src/account.ts | Add axios SSRF + manual Location redirect shape |
| fixtures/vulnerable/fastify-api/package.json | Add axios dependency |
| fixtures/vulnerable/fastify-api/src/server.ts | Add axios SSRF + manual Location redirect shape |
| fixtures/vulnerable/hono-api/package.json | New vulnerable Hono fixture |
| fixtures/vulnerable/hono-api/src/app.ts | Hono vulnerable shapes (cookies/redirect/ssrf/logging) |
| fixtures/vulnerable/hono-api/src/account.ts | Hono weak-crypto shapes |
| fixtures/vulnerable/hono-api/src/billing.ts | Hono hardcoded-secret fixture |
| fixtures/vulnerable/hono-api/.github/workflows/ci.yml | Hono unpinned-action fixture |
| fixtures/vulnerable/koa-api/package.json | New vulnerable Koa fixture |
| fixtures/vulnerable/koa-api/src/app.ts | Koa vulnerable shapes (ctx.body, redirect, ssrf, etc.) |
| fixtures/vulnerable/koa-api/src/account.ts | Koa weak-crypto shapes |
| fixtures/vulnerable/koa-api/src/billing.ts | Koa hardcoded-secret fixture |
| fixtures/vulnerable/koa-api/.github/workflows/ci.yml | Koa unpinned-action fixture |
| fixtures/vulnerable/hapi-api/package.json | New vulnerable Hapi fixture |
| fixtures/vulnerable/hapi-api/src/server.ts | Hapi vulnerable shapes (h.response, h.redirect, etc.) |
| fixtures/vulnerable/hapi-api/src/account.ts | Hapi weak-crypto shapes |
| fixtures/vulnerable/hapi-api/src/billing.ts | Hapi hardcoded-secret fixture |
| fixtures/vulnerable/hapi-api/.github/workflows/ci.yml | Hapi unpinned-action fixture |
| fixtures/vulnerable/sails-api/package.json | New vulnerable Sails fixture |
| fixtures/vulnerable/sails-api/config/security.js | Sails config presence for profile resolution |
| fixtures/vulnerable/sails-api/config/http.js | Sails middleware order fixture |
| fixtures/vulnerable/sails-api/api/controllers/AuthController.js | Sails vulnerable controller shapes |
| fixtures/vulnerable/sails-api/api/controllers/account.js | Sails weak-crypto shapes |
| fixtures/vulnerable/sails-api/api/controllers/billing.js | Sails hardcoded-secret fixture |
| fixtures/vulnerable/sails-api/.github/workflows/ci.yml | Sails unpinned-action fixture |
| fixtures/vulnerable/astro-api/package.json | New vulnerable Astro fixture |
| fixtures/vulnerable/astro-api/astro.config.ts | Astro missing security headers fixture |
| fixtures/vulnerable/astro-api/src/pages/api/users.ts | Astro vulnerable route shapes |
| fixtures/vulnerable/astro-api/src/pages/api/proxy.ts | Astro ssrf + redirect shapes |
| fixtures/vulnerable/astro-api/src/lib/crypto.ts | Astro weak-crypto shapes |
| fixtures/vulnerable/astro-api/src/lib/billing.ts | Astro hardcoded-secret fixture |
| fixtures/vulnerable/astro-api/.github/workflows/ci.yml | Astro unpinned-action fixture |
| fixtures/vulnerable/remix-api/package.json | New vulnerable Remix fixture |
| fixtures/vulnerable/remix-api/remix.config.js | Remix missing security headers fixture |
| fixtures/vulnerable/remix-api/app/routes/api.users.ts | Remix vulnerable loader/action shapes |
| fixtures/vulnerable/remix-api/app/lib/crypto.ts | Remix weak-crypto shapes |
| fixtures/vulnerable/remix-api/app/lib/billing.ts | Remix hardcoded-secret fixture |
| fixtures/vulnerable/remix-api/.github/workflows/ci.yml | Remix unpinned-action fixture |
| fixtures/vulnerable/gatsby-api/package.json | New vulnerable Gatsby fixture |
| fixtures/vulnerable/gatsby-api/gatsby-config.js | Gatsby missing security headers fixture |
| fixtures/vulnerable/gatsby-api/src/api/users.ts | Gatsby Functions vulnerable shapes |
| fixtures/vulnerable/gatsby-api/src/api/proxy.ts | Gatsby ssrf + redirect shapes |
| fixtures/vulnerable/gatsby-api/src/lib/crypto.ts | Gatsby weak-crypto shapes |
| fixtures/vulnerable/gatsby-api/src/lib/billing.ts | Gatsby hardcoded-secret fixture |
| fixtures/vulnerable/gatsby-api/.github/workflows/ci.yml | Gatsby unpinned-action fixture |
| fixtures/should-not-fire/next-api-clean/package.json | Add axios dep for clean parity |
| fixtures/should-not-fire/next-api-clean/app/lib/tempting.ts | Add tempting cases for clean fixture |
| fixtures/should-not-fire/next-api-clean/app/lib/safe-redirect.ts | Add safe redirect helper |
| fixtures/should-not-fire/next-api-clean/app/api/users/route.ts | Clean: log presence, not token |
| fixtures/should-not-fire/next-api-clean/app/api/proxy/route.ts | Clean: allowlisted SSRF + safe redirect |
| fixtures/should-not-fire/nuxt-api-clean/package.json | Add axios dep for clean parity |
| fixtures/should-not-fire/nuxt-api-clean/server/utils/tempting.ts | Add tempting cases for clean fixture |
| fixtures/should-not-fire/nuxt-api-clean/server/utils/safe-redirect.ts | Add safe redirect helper |
| fixtures/should-not-fire/nuxt-api-clean/server/api/session.post.ts | Clean: log presence, not token |
| fixtures/should-not-fire/nuxt-api-clean/server/api/proxy.get.ts | Clean: allowlisted SSRF + safe redirect |
| fixtures/should-not-fire/nest-api-clean/package.json | Add axios dep for clean parity |
| fixtures/should-not-fire/nest-api-clean/src/tempting.ts | Add tempting cases for clean fixture |
| fixtures/should-not-fire/nest-api-clean/src/safe-redirect.ts | Add safe redirect helper |
| fixtures/should-not-fire/nest-api-clean/src/users/users.controller.ts | Clean: allowlisted SSRF + safe redirect |
| fixtures/should-not-fire/express-api-clean/package.json | Add axios dep for clean parity |
| fixtures/should-not-fire/express-api-clean/src/app.ts | Clean: log presence, not token |
| fixtures/should-not-fire/express-api-clean/src/account.ts | Clean: allowlisted SSRF + safe redirect |
| fixtures/should-not-fire/fastify-api-clean/package.json | Add axios dep for clean parity |
| fixtures/should-not-fire/fastify-api-clean/src/tempting.ts | Add tempting cases for clean fixture |
| fixtures/should-not-fire/fastify-api-clean/src/safe-redirect.ts | Add safe redirect helper |
| fixtures/should-not-fire/fastify-api-clean/src/server.ts | Clean: allowlisted SSRF + safe redirect |
| fixtures/should-not-fire/hono-api-clean/package.json | New clean Hono twin |
| fixtures/should-not-fire/hono-api-clean/src/tempting.ts | Tempting cases for Hono clean fixture |
| fixtures/should-not-fire/hono-api-clean/src/safe-redirect.ts | Safe redirect helper for Hono clean fixture |
| fixtures/should-not-fire/hono-api-clean/src/app.ts | Clean Hono implementation (headers/cors/cookies/etc.) |
| fixtures/should-not-fire/hono-api-clean/src/account.ts | Clean Hono crypto/cache/jitter shapes |
| fixtures/should-not-fire/hono-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/koa-api-clean/package.json | New clean Koa twin |
| fixtures/should-not-fire/koa-api-clean/src/tempting.ts | Tempting cases for Koa clean fixture |
| fixtures/should-not-fire/koa-api-clean/src/safe-redirect.ts | Safe redirect helper for Koa clean fixture |
| fixtures/should-not-fire/koa-api-clean/src/app.ts | Clean Koa implementation (helmet/cors/cookies/etc.) |
| fixtures/should-not-fire/koa-api-clean/src/account.ts | Clean Koa crypto/cache/jitter shapes |
| fixtures/should-not-fire/koa-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/hapi-api-clean/package.json | New clean Hapi twin |
| fixtures/should-not-fire/hapi-api-clean/src/tempting.ts | Tempting cases for Hapi clean fixture |
| fixtures/should-not-fire/hapi-api-clean/src/safe-redirect.ts | Safe redirect helper for Hapi clean fixture |
| fixtures/should-not-fire/hapi-api-clean/src/account.ts | Clean Hapi crypto/cache/jitter shapes |
| fixtures/should-not-fire/hapi-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/sails-api-clean/package.json | New clean Sails twin |
| fixtures/should-not-fire/sails-api-clean/config/security.js | Clean Sails CORS config |
| fixtures/should-not-fire/sails-api-clean/config/http.js | Clean Sails helmet middleware order |
| fixtures/should-not-fire/sails-api-clean/api/controllers/AuthController.js | Clean Sails controller (allowlists/safe redirect) |
| fixtures/should-not-fire/sails-api-clean/api/controllers/account.js | Clean Sails crypto/cache/jitter shapes |
| fixtures/should-not-fire/sails-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/astro-api-clean/package.json | New clean Astro twin |
| fixtures/should-not-fire/astro-api-clean/astro.config.ts | Clean Astro baseline headers |
| fixtures/should-not-fire/astro-api-clean/src/pages/api/users.ts | Clean Astro route implementation |
| fixtures/should-not-fire/astro-api-clean/src/pages/api/proxy.ts | Clean Astro allowlists + safe redirect |
| fixtures/should-not-fire/astro-api-clean/src/lib/tempting.ts | Tempting cases for Astro clean fixture |
| fixtures/should-not-fire/astro-api-clean/src/lib/safe-redirect.ts | Safe redirect helper for Astro clean fixture |
| fixtures/should-not-fire/astro-api-clean/src/lib/crypto.ts | Clean Astro crypto/cache/jitter shapes |
| fixtures/should-not-fire/astro-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/remix-api-clean/package.json | New clean Remix twin |
| fixtures/should-not-fire/remix-api-clean/remix.config.js | Clean Remix config |
| fixtures/should-not-fire/remix-api-clean/app/routes/api.users.ts | Clean Remix allowlists + safe redirect |
| fixtures/should-not-fire/remix-api-clean/app/lib/tempting.ts | Tempting cases for Remix clean fixture |
| fixtures/should-not-fire/remix-api-clean/app/lib/safe-redirect.ts | Safe redirect helper for Remix clean fixture |
| fixtures/should-not-fire/remix-api-clean/app/lib/crypto.ts | Clean Remix crypto/cache/jitter shapes |
| fixtures/should-not-fire/remix-api-clean/app/entry.server.tsx | Clean Remix baseline headers |
| fixtures/should-not-fire/remix-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| fixtures/should-not-fire/gatsby-api-clean/package.json | New clean Gatsby twin |
| fixtures/should-not-fire/gatsby-api-clean/gatsby-config.js | Clean Gatsby baseline headers |
| fixtures/should-not-fire/gatsby-api-clean/src/api/users.ts | Clean Gatsby Function implementation |
| fixtures/should-not-fire/gatsby-api-clean/src/api/proxy.ts | Clean Gatsby allowlists + safe redirect |
| fixtures/should-not-fire/gatsby-api-clean/src/lib/tempting.ts | Tempting cases for Gatsby clean fixture |
| fixtures/should-not-fire/gatsby-api-clean/src/lib/safe-redirect.ts | Safe redirect helper for Gatsby clean fixture |
| fixtures/should-not-fire/gatsby-api-clean/src/lib/crypto.ts | Clean Gatsby crypto/cache/jitter shapes |
| fixtures/should-not-fire/gatsby-api-clean/.github/workflows/ci.yml | Clean: pinned action fixture |
| crates/core/src/detector.rs | Change DetectorMeta strings to Cow for plugins |
| crates/core/src/finding.rs | Add new frameworks + pretty labels |
| crates/core/src/limits.rs | Add plugin sandbox limits/constants |
| crates/core/src/remediation.rs | Add Remediation::manual_each helper |
| crates/core/src/owasp.rs | Update tests for DetectorMeta Cow fields |
| crates/core/src/scheduler.rs | Update test DetectorMeta fields for Cow |
| crates/detectors/src/lib.rs | Expand SUPPORTED_FRAMEWORKS to 12 frameworks |
| crates/detectors/src/build.rs | Clone meta.title (Cow) into finding builder |
| crates/detectors/tests/stack_trace_leak.rs | Update test wording for “every supported framework” |
| crates/detectors/src/stack_trace_leak.rs | Add Koa ctx.body = … sink + new framework remediations |
| crates/detectors/src/sql_injection.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/ssrf.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/open_redirect.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/sensitive_data_logged.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/weak_crypto.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/unpinned_dependency.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/hardcoded_secret.rs | Cow meta strings + remediations for new frameworks |
| crates/detectors/src/ci_unpinned_action.rs | Cow meta strings + remediations for new frameworks |
| crates/static-engine/src/engine.rs | Cow meta strings for engine DetectorMeta |
| crates/static-engine/src/taint.rs | Add new taint source hints (Hono/Astro/Remix) |
| crates/static-engine/src/framework/routing.rs | Add Astro/Remix/Gatsby route mapping + tests |
| crates/dynamic-engine/src/engine.rs | Cow meta strings for engine DetectorMeta |
| crates/dynamic-engine/tests/framework_matrix.rs | Extend dynamic fixture matrix to 12 frameworks |
| crates/dynamic-engine/Cargo.toml | Use workspace dep for owlwarden-transport |
| crates/plugin-host/Cargo.toml | New plugin-host crate manifest |
| crates/plugin-host/src/lib.rs | Plugin host crate docs + module exports |
| crates/plugin-host/src/capability.rs | Manifest capability validation (source-only in v0.2) |
| crates/napi/Cargo.toml | Link plugin-host into napi engine build |
| crates/napi/package.json | Bump native package to 0.2.0; description update |
| crates/cli-native/Cargo.toml | Link plugin-host into native CLI build |
| crates/cli-native/src/cli.rs | Add --plugin/--allow-plugins parsing |
| crates/cli-native/src/main.rs | Load plugins + refactor dynamic engine wiring |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Replace recursive mkdir/create_dir_all with a missing-suffix create that refuses symlink ancestors, so --out and init cannot mkdir through an intermediate link. Co-authored-by: Cursor <cursoragent@cursor.com>
source defaults to true for v0.2 source-only plugins; only network/active treat omission as not granted. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
plugin-host(source-only),owlwarden mcp(stdio, static/read-only),init --agent-rules, andplugin scaffold.Release / npm deploy notes
cargo deny,pnpm check, false-positive corpus,pnpm rules:check,check-version.mjs v0.2.0..github/workflows/release.yml:workflow_dispatchwith dry_run=true (default) to rehearse matrix build + pack +npm publish --dry-run.v0.2.0(versions must match the tag; provenance needsNPM_TOKEN+id-token: write).crates/napi/package.jsonmatch the release matrix (darwin x64/arm64, windows x64/arm64, linux gnu x64/arm64, linux musl x64).Test plan
npx owlwarden coverage→ 12 rules, 9/10 OWASP, 12 frameworksowlwarden mcptools list; scan_file stays under workspaceplugin-host)v0.2.0to publishMade with Cursor