Harden provider and plugin edge cases

Author: Evan1108-Coder

src/errors/index.ts

@@ -136,14 +136,14 @@ export function classifyCommandFailure(input: {
 }
 
 export function classifyAIProviderError(error: unknown, context: Partial<SetuprErrorInput> = {}): SetuprError {
-  const raw = error instanceof Error ? error.message : String(error || "");
+  const raw = providerErrorText(error);
   const lower = raw.toLowerCase();
   let code: SetuprErrorCode = "AI_PROVIDER_REQUEST_FAILED";
   if (/timed? out|timeout|abort/.test(lower)) code = "AI_PROVIDER_TIMEOUT";
   else if (/401|unauthorized|invalid api key|authentication/.test(lower)) code = "AI_PROVIDER_AUTH_FAILED";
   else if (/403|forbidden|access denied/.test(lower)) code = "AI_PROVIDER_AUTH_FAILED";
+  else if (/insufficient[_ -]?quota|quota|credit|insufficient balance|billing hard limit|out of credits/.test(lower)) code = "AI_PROVIDER_QUOTA_EXHAUSTED";
   else if (/429|rate limit|too many requests/.test(lower)) code = "AI_PROVIDER_RATE_LIMITED";
-  else if (/quota|credit|insufficient balance|billing|exceeded/.test(lower)) code = "AI_PROVIDER_QUOTA_EXHAUSTED";
   else if (/500|502|503|504|unavailable|overloaded/.test(lower)) code = "AI_PROVIDER_UNAVAILABLE";
   else if (/json|parse|invalid response|protocol/.test(lower)) code = "AI_PROVIDER_PROTOCOL_ERROR";
 
@@ -160,6 +160,37 @@ export function classifyAIProviderError(error: unknown, context: Partial<SetuprE
   });
 }
 
+function providerErrorText(error: unknown): string {
+  const parts: string[] = [];
+  const seen = new Set<unknown>();
+
+  const collect = (value: unknown, depth: number) => {
+    if (value === null || value === undefined || seen.has(value) || depth > 2) return;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      parts.push(String(value));
+      return;
+    }
+    if (value instanceof Error) {
+      parts.push(value.name);
+      parts.push(value.message);
+    }
+    if (typeof value !== "object") return;
+    seen.add(value);
+    const record = value as Record<string, unknown>;
+    for (const key of ["status", "statusCode", "code", "type", "name", "message", "statusText"]) {
+      const hint = record[key];
+      if (typeof hint === "string" || typeof hint === "number") parts.push(`${key}: ${hint}`);
+    }
+    for (const key of ["error", "response", "body", "data", "cause"]) {
+      if (record[key] !== undefined) collect(record[key], depth + 1);
+    }
+  };
+
+  collect(error, 0);
+  const raw = parts.filter(Boolean).join(" | ").trim();
+  return raw || String(error || "");
+}
+
 export function sanitizeSecret(value: string): string {
   let result = value;
   result = result.replace(

src/plugins/runtime.ts

@@ -1,12 +1,13 @@
 import { readFile } from "fs/promises";
 import { existsSync } from "fs";
 import { pathToFileURL } from "url";
-import { join, resolve } from "path";
+import { isAbsolute, join, relative, resolve } from "path";
 import type { SetupStep } from "../ai/planner.js";
 import type { ProjectContext } from "../ai/dsl.js";
 import { collectContext } from "../context/collector.js";
 import { loadConfig, type PluginEntry } from "../state/config.js";
 import { scanProject, type ScanResult } from "../scanner/index.js";
+import { createSetuprError } from "../errors/index.js";
 import type {
   SetuprPlugin,
   SetuprPluginContext,
@@ -173,7 +174,17 @@ export async function tryRunPluginCommand(input: {
   for (const { plugin } of plugins) {
     const command = plugin.commands?.find((candidate) => candidate.name === input.command);
     if (!command) continue;
-    await command.run(await pluginContext(input.cwd, scan, context, input.log), input.args);
+    try {
+      await command.run(await pluginContext(input.cwd, scan, context, input.log), input.args);
+    } catch (err) {
+      throw createSetuprError({
+        code: "PLUGIN_LOAD_FAILED",
+        command: input.command,
+        cwd: input.cwd,
+        details: [`Plugin: ${plugin.name}`, err instanceof Error ? err.message : String(err)],
+        cause: err,
+      });
+    }
     return true;
   }
 
@@ -231,18 +242,46 @@ async function loadPluginFromDir(name: string, dir: string): Promise<LoadedPlugi
 function resolveEntrypoint(dir: string, manifest: PluginManifest): string | null {
   const candidates = [
     typeof manifest.exports === "string" ? manifest.exports : undefined,
+    ...exportsObjectEntrypoints(manifest.exports),
     manifest.main,
     "dist/index.js",
     "index.js",
   ].filter((item): item is string => Boolean(item));
 
   for (const candidate of candidates) {
-    const entry = join(dir, candidate);
+    const entry = resolve(dir, candidate);
+    if (!isInsideDirectory(dir, entry)) {
+      throw new Error(`Plugin entrypoint escapes plugin directory: ${candidate}`);
+    }
     if (existsSync(entry)) return entry;
   }
   return null;
 }
 
+function exportsObjectEntrypoints(value: PluginManifest["exports"]): string[] {
+  if (!value || typeof value === "string") return [];
+  const results: string[] = [];
+  const visit = (node: unknown, depth: number) => {
+    if (depth > 3 || !node) return;
+    if (typeof node === "string") {
+      results.push(node);
+      return;
+    }
+    if (typeof node !== "object") return;
+    const record = node as Record<string, unknown>;
+    for (const key of [".", "import", "default", "node", "require"]) {
+      if (record[key] !== undefined) visit(record[key], depth + 1);
+    }
+  };
+  visit(value, 0);
+  return results;
+}
+
+function isInsideDirectory(dir: string, entry: string): boolean {
+  const rel = relative(resolve(dir), entry);
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
 async function pluginContext(
   cwd: string,
   scan: ScanResult,

tests/errors.test.ts

@@ -51,6 +51,17 @@ describe("centralized error system", () => {
     expect(classifyAIProviderError(new Error("invalid json response")).code).toBe("AI_PROVIDER_PROTOCOL_ERROR");
   });
 
+  it("classifies structured provider errors from SDK status and code fields", () => {
+    expect(classifyAIProviderError(Object.assign(new Error("provider refused request"), { status: 401 })).code)
+      .toBe("AI_PROVIDER_AUTH_FAILED");
+    expect(classifyAIProviderError(Object.assign(new Error("too many requests"), { status: 429 })).code)
+      .toBe("AI_PROVIDER_RATE_LIMITED");
+    expect(classifyAIProviderError(Object.assign(new Error("too many requests"), { status: 429, code: "insufficient_quota" })).code)
+      .toBe("AI_PROVIDER_QUOTA_EXHAUSTED");
+    expect(classifyAIProviderError({ response: { status: 502, statusText: "Bad Gateway" } }).code)
+      .toBe("AI_PROVIDER_UNAVAILABLE");
+  });
+
   it("sanitizes common secret formats", () => {
     const value = sanitizeSecret("OPENAI_API_KEY=sk-abcdef1234567890 GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz");
 

tests/plugin-runtime.test.ts

@@ -3,7 +3,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "fs/promises";
 import { join } from "path";
 import { tmpdir } from "os";
 import { env } from "process";
-import { applyPluginPlanners, runPluginDoctorChecks, tryRunPluginCommand } from "../src/plugins/runtime.js";
+import { applyPluginPlanners, loadEnabledPlugins, runPluginDoctorChecks, tryRunPluginCommand } from "../src/plugins/runtime.js";
 import { saveConfig } from "../src/state/config.js";
 import type { ScanResult } from "../src/scanner/index.js";
 import type { SetupStep } from "../src/ai/planner.js";
@@ -96,4 +96,95 @@ describe("plugin runtime", () => {
     expect(commandHandled).toBe(true);
     expect(logs.join("\n")).toContain("team command one");
   });
+
+  it("loads plugins that expose an exports object entrypoint", async () => {
+    const pluginDir = join(tempDir, ".setupr", "plugins", "exported");
+    await mkdir(join(pluginDir, "build"), { recursive: true });
+    await writeFile(join(pluginDir, "package.json"), JSON.stringify({
+      name: "setupr-plugin-exported",
+      version: "0.1.0",
+      type: "module",
+      exports: { ".": { import: "./build/plugin.js" } },
+      setupr: { apiVersion: "1" },
+    }));
+    await writeFile(join(pluginDir, "build", "plugin.js"), `
+      export default {
+        name: "setupr-plugin-exported",
+        apiVersion: "1",
+        commands: [{ name: "exported-ok", summary: "OK", run(context) { context.log("exported command"); } }],
+      };
+    `);
+    await saveConfig(configWithPlugins([
+      { name: "setupr-plugin-exported", version: "0.1.0", enabled: true, source: ".setupr/plugins/exported" },
+    ]));
+
+    const loaded = await loadEnabledPlugins(tempDir);
+
+    expect(loaded.diagnostics).toContainEqual(expect.objectContaining({ name: "setupr-plugin-exported", status: "loaded" }));
+    expect(loaded.plugins.map((item) => item.plugin.name)).toContain("setupr-plugin-exported");
+  });
+
+  it("rejects plugin entrypoints that escape the plugin directory", async () => {
+    const pluginDir = join(tempDir, ".setupr", "plugins", "escape");
+    await mkdir(pluginDir, { recursive: true });
+    await writeFile(join(tempDir, ".setupr", "plugins", "evil.js"), "export default { name: 'evil', apiVersion: '1' };\n");
+    await writeFile(join(pluginDir, "package.json"), JSON.stringify({
+      name: "setupr-plugin-escape",
+      version: "0.1.0",
+      type: "module",
+      main: "../evil.js",
+      setupr: { apiVersion: "1" },
+    }));
+    await saveConfig(configWithPlugins([
+      { name: "setupr-plugin-escape", version: "0.1.0", enabled: true, source: ".setupr/plugins/escape" },
+    ]));
+
+    const loaded = await loadEnabledPlugins(tempDir);
+
+    expect(loaded.plugins).toHaveLength(0);
+    expect(loaded.diagnostics[0]).toMatchObject({ name: "setupr-plugin-escape", status: "failed" });
+    expect(loaded.diagnostics[0].message).toContain("escapes plugin directory");
+  });
+
+  it("turns throwing plugin commands into structured plugin errors", async () => {
+    const pluginDir = join(tempDir, ".setupr", "plugins", "thrower");
+    await mkdir(pluginDir, { recursive: true });
+    await writeFile(join(pluginDir, "package.json"), JSON.stringify({
+      name: "setupr-plugin-thrower",
+      version: "0.1.0",
+      type: "module",
+      main: "index.js",
+      setupr: { apiVersion: "1" },
+    }));
+    await writeFile(join(pluginDir, "index.js"), `
+      export default {
+        name: "setupr-plugin-thrower",
+        apiVersion: "1",
+        commands: [{ name: "explode", summary: "Fail", run() { throw new Error("plugin boom"); } }],
+      };
+    `);
+    await saveConfig(configWithPlugins([
+      { name: "setupr-plugin-thrower", version: "0.1.0", enabled: true, source: ".setupr/plugins/thrower" },
+    ]));
+
+    await expect(tryRunPluginCommand({ cwd: tempDir, command: "explode", args: [] }))
+      .rejects.toMatchObject({ code: "PLUGIN_LOAD_FAILED", details: expect.arrayContaining(["Plugin: setupr-plugin-thrower", "plugin boom"]) });
+  });
 });
+
+function configWithPlugins(plugins: Array<{ name: string; version: string; enabled: boolean; source: string }>) {
+  return {
+    ai: { enabled: true, timeoutMs: 30000, maxRetries: 3, retryDelayMs: 1000, rateLimitPerMinute: 20 },
+    preferences: {
+      theme: "dark",
+      confirmBeforeInstall: true,
+      autoUpdate: false,
+      telemetry: false,
+      defaultBranch: "main",
+      commitConvention: "conventional",
+      ciPlatform: "auto",
+    },
+    plugins,
+    remembered: {},
+  };
+}