Visitar URL original
Add Alexs7zzh/hunk-extensions to hunk-extension marketplace by benvinegar · Pull Request #1104 · modem-dev/hunk · GitHub
Skip to content

Add Alexs7zzh/hunk-extensions to hunk-extension marketplace - #1104

Open
benvinegar wants to merge 1 commit into
mainfrom
claude/funny-keller-6xjcs7
Open

Add Alexs7zzh/hunk-extensions to hunk-extension marketplace#1104
benvinegar wants to merge 1 commit into
mainfrom
claude/funny-keller-6xjcs7

Conversation

@benvinegar

@benvinegar benvinegar commented Sep 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds Alexs7zzh/hunk-extensions to the hunk.dev/extensions marketplace catalog (website/src/data/extensions.ts).
  • This repository was tagged hunk-extension on GitHub and pushed to within the last 24 hours (found via a scheduled topic:hunk-extension search); it is not yet in the existing catalog.
  • It ships a single documented extension, hunk-plastic (Plastic SCM support), registering a VCS backend (hunk.apiVersion: 14, version: 0.1.0), installed as hunk extension install Alexs7zzh/hunk-extensions.
  • Adds an empty Changeset per CONTRIBUTING.md, since this is a website-data-only change and does not affect the published hunkdiff package.

Test plan

  • Reviewed the new entry against the ExtensionListing interface and existing catalog entries for shape/ordering (alphabetical by repo, after Hunk's own modem-dev/* entries).
  • Confirmed repository details (description, manifest version/apiVersion, category) via the repository's README and plastic/package.json on GitHub.
  • Did not run bun run check (Astro typecheck) — website dependencies are not installed in this environment; the added object matches the existing ExtensionListing shape used by 18 sibling entries.

🤖 Generated with Claude Code

https://claude.ai/code/session_014FzX8iHTcBR1twzPEYuTPX

Generated by Claude Code

@claude
feat(extensions): add Alexs7zzh/hunk-extensions to the marketplace
2f0467d 
Newly tagged hunk-extension repository discovered in the last 24 hours:
Plastic SCM VCS backend support.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014FzX8iHTcBR1twzPEYuTPX
@vercel

vercel Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
hunk-web Ready Ready Preview Sep 14, 2026 1:08pm UTC

Request Review

@greptile-apps

greptile-apps Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR adds the Alexs7zzh/hunk-extensions repository and its Plastic SCM integration metadata to the extension marketplace catalog. It also includes an intentionally empty changeset because no published package is affected.

  • Adds a marketplace listing categorized as a VCS backend.
  • Records extension version 0.1.0 and required API version 14.
  • Uses the repository-based installation command already generated by the catalog.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule issues identified.

The new listing matches the catalog contract, API version 14 is supported, and the installer explicitly handles repositories containing extension manifests in subfolders.

Important Files Changed

Filename Overview
website/src/data/extensions.ts Adds a structurally valid extension listing whose installation layout and API requirement are supported by the current implementation.
.changeset/gentle-hunts-listen.md Adds the intentionally empty changeset required for a website-data-only update.

Reviews (1): Last reviewed commit: "feat(extensions): add Alexs7zzh/hunk-ext..." | Re-trigger Greptile

@benvinegar

benvinegar commented Nov 7, 2026

Copy link
Copy Markdown
Member Author

Holding the Plastic SCM marketplace submission for follow-up source hardening; #1024 and #1089 propose the same listing. Static review of Alexs7zzh/hunk-extensions at 6c69be53920b22419a7595870c9fd8b769d88d5b found no deliberate malware, credential harvesting, direct network uploader, runtime npm dependencies or install hooks. Collection installation is structurally valid; plastic/package.json confirms version 0.1.0 / API 14 (not the API-16 placeholder in #1024).

However, plastic/src/adapter.ts:257–270,360–370 uses lexical workspace containment, while plastic/src/files.ts:17–24 follows symlinked ancestor directories, races the final-component lstat/open, and opens non-regular files. This can read outside the intended workspace or block on special files if those paths are reported by the provider. Please enforce symlink-safe containment/regular-file access.

The runner also launches bare cm with the reviewed workspace as cwd (plastic/src/process.ts:81–106,222–228). Current-directory/relative-PATH executable lookup is a conditional concern (particularly on Windows), not a verified exploit; resolve a trusted executable independently of the reviewed directory or demonstrate that the supported runtime excludes workspace-local lookup.

Leaving this open rather than treating a source-only review as a safety guarantee. No extension code, installers or dependency scripts were executed.

This comment was generated by Pi using gpt-6.1-sol

This was referenced Nov 7, 2026
Open
Closed

This branch was successfully deployed

1 active deployment
Preview — 2f0467d2 Deployed Sep 14, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@benvinegar @claude