J3vbandClaude Opus 4.8 420eec227c fix(plugin): serialize wazero guest calls with a per-Instance mutex ...

invokeCommand drove a shared wazero module (allocate/mem.Write/command_dispatch/mem.Read) with no per-instance lock, so concurrent invocations of the same plugin command raced the module's linear-memory buffer. Add a per-Instance mutex around the guest-call sequence. Confirmed under -race. (Security scan F2)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 11:59:13 +02:00

..

examples/hello

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

audit_closure_test.go

docs(audit): correct CRITICAL #4 closure — Dispatch has a live hub caller

2026-07-20 14:36:24 +02:00

dbstore_test.go

refactor(server): remove the store abstraction layer (D3)

2026-07-19 16:33:58 +00:00

errors.go

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

host_commands.go

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

host_events.go

docs(audit): correct CRITICAL #4 closure — Dispatch has a live hub caller

2026-07-20 14:36:24 +02:00

host_http_test.go

feat(api): proxy Klipy GIF requests server-side so no key ships to clients

2026-07-20 13:29:46 +02:00

host_http.go

feat(api): proxy Klipy GIF requests server-side so no key ships to clients

2026-07-20 13:29:46 +02:00

host_storage.go

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

host_ui_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

host_ui.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

loader_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

loader.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

manifest_nottoml.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

manifest_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

manifest_toml.go

feat(phase-bc): TOML plugin manifests + Solid vitest preset

2026-04-06 23:25:16 +02:00

manifest.go

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

plugin_test.go

feat(plugin): enforce manifest-declared per-command ACL

2026-07-20 14:10:02 +02:00

pluginstore.go

refactor(server): remove the store abstraction layer (D3)

2026-07-19 16:33:58 +00:00

registry.go

fix(plugin): serialize wazero guest calls with a per-Instance mutex

2026-07-23 11:59:13 +02:00

sandbox_default.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

sandbox_wazero_test.go

fix(plugin): serialize wazero guest calls with a per-Instance mutex

2026-07-23 11:59:13 +02:00

sandbox_wazero.go

fix(plugin): serialize wazero guest calls with a per-Instance mutex

2026-07-23 11:59:13 +02:00