The extension executor runs commands via 'sh -c' with user-controlled
values interpolated into the command string without escaping. A value
containing shell metacharacters (;, |, $(), backticks) is executed by
the shell, enabling command injection.
User input flows from content processed through a pattern into the
extension system via the InputSentinel, then into formatCommand which
interpolates it into the cmd_template, then into exec.Command('sh', '-c').
No escaping is applied at any point.
Fix: wrap all user-controlled values (value, numbered pipe-split values)
in single quotes with embedded-single-quote escaping before interpolation.
This ensures sh -c treats them as literal arguments, not shell syntax.
The existing tests pass unchanged because the inner sh strips the single
quotes, so the executed command receives the same argument values.
Regression test added: ShellInjectionBlocked verifies that input
'hello; touch /marker' does not create the marker file.
Signed-off-by: John Kearney <johndanielkearney@gmail.com>
- Replace `fmt.Errorf("%s", ...)` with `errors.New()` across all packages
- Add `errors` import where needed, remove unused `fmt` imports
- Lowercase error message strings in i18n locale files for Go conventions
- Add `plugin_registry_run_setup_select_defaults` i18n key for setup prompt
- Add `plugin_registry_could_not_find_vendor` i18n key for vendor errors
- Internationalize hardcoded English strings in `plugin_registry.go`
- Update `db_error_loading_env_file` format verb from `%s` to `%w` for wrapping
- Normalize error casing in en, de, es, fr, it, ja, pt-BR, pt-PT, zh, fa locales
### CHANGES
- Implement internationalization support for all AI vendor plugins
- Update localization files for multiple languages with new keys
- Replace hardcoded strings in Spotify and YouTube tools
- Add unit tests for localized error handling in Ollama
- Refactor template plugins to use localized system error messages
- Standardize setup questions using the new i18n translation framework
- Add new error messages for fetch operations
- Rename `errInvalidLocationFormat` to `errInvalidLocationFormatKey`
- Use `errors.New` instead of `fmt.Errorf` for fetch errors
- Update Chinese locale with fetch-related error messages
- Add VertexAI error message translations across 10 locale files
- Add Gemini TTS and audio error translations to all locales
- Add AWS Bedrock client error translations to all locales
- Add fetch plugin error message translations to all locales
- Replace hardcoded English strings with `i18n.T()` calls in Bedrock plugin
- Replace hardcoded English strings with `i18n.T()` calls in Gemini plugin
- Replace hardcoded English strings with `i18n.T()` calls in VertexAI plugin
- Replace hardcoded English strings with `i18n.T()` calls in fetch plugin
- Use `errors.New` instead of `fmt.Errorf` for non-formatted error strings
- Replace hardcoded strings with i18n keys in chatter.go
- Add translation keys for errors, warnings, and metadata in locale files
- Update file.go to use i18n for operation messages and errors
- Provide translations in German, English, Spanish, Persian, French, Italian, Japanese, Portuguese, and Chinese
- Enable localized output for stream updates and file plugin operations
- Ensure consistent error handling across supported languages
- Maintain backward compatibility with existing functionality
- Update default summarize model to `claude-sonnet-4-5`
- Replace `gpt-4o` references with `gpt-5.2` throughout docs
- Replace `gpt-4o-mini` references with `gpt-5-mini`
- Add MiniMax-M2.5 and M2.5-lightning to static models list
- Update image generation warning to suggest `gpt-5.2`
- Update OpenAI chat example script to use `gpt-5-mini`
- Update REST API docs and examples with current model names
## CHANGES
- Upgrade GitHub Actions to latest versions (v6, v21)
- Add modernization check step in CI workflow
- Replace strings manipulation with `strings.CutPrefix` and `strings.CutSuffix`
- Replace manual loops with `slices.Contains` for validation
- Use `strings.SplitSeq` for iterator-based string splitting
- Replace `bytes.TrimPrefix` with `bytes.CutPrefix` for clarity
- Use `strings.Builder` instead of string concatenation
- Replace `fmt.Sprintf` with `fmt.Appendf` for efficiency
- Simplify padding calculation with `max` builtin
- Replace reflect.TypeOf with TypeFor generic syntax
- Convert traditional for loops to range-based iterations
- Simplify reflection usage in CLI flag handling
- Update test loops to use range over integers
- Refactor string processing loops in template plugin
- Part 1 of incorporating `modernize` tool into Fabric.
- Replace `interface{}` with `any` in slice type declarations
- Update map types from `map[string]interface{}` to `map[string]any`
- Change variadic function parameters to use `...any` instead of `...interface{}`
- Modernize JSON unmarshaling variables to `any` for consistency
- Update struct fields and method signatures to prefer `any` alias
- Ensure all type assertions and conversions use `any` throughout codebase
- Add PR guidelines in docs to encourage focused, reviewable changes
- Add prominent warning at top of Extensions guide with visual indicators
- Update main README with brief Extensions section and link to full guide
- Remove misleading examples showing direct piping to fabric
- Add clear examples: ❌ what DOES NOT WORK vs ✅ what WORKS
- Consolidate all extension documentation in Examples/README.md
- Explain technical reason: extensions only processed via ApplyTemplate()
- Prevents user confusion about extension syntax processing
- Extract InputSentinel constant to shared constants.go file
- Remove duplicate inputSentinel definitions from template.go and patterns.go
- Create withTestExtension helper function to reduce test code duplication
- Refactor 3 test functions to use the helper (reduces ~40 lines per test)
- Fix shell script to use $@ instead of $* for proper argument quoting
Addresses review comments from @ksylvan and @Copilot AI
- Replace fmt.Fprintf/os.Stderr with centralized debuglog.Log across CLI
- Add unconditional Log function to debuglog for important messages
- Improve OAuth flow messaging and token refresh diagnostics
- Update tests to capture debuglog output via SetOutput
- Convert Perplexity streaming errors to unified debug logging
- Emit file write notifications through debuglog instead of stderr
- Warn on ambiguous model selection using centralized logger
- Announce large audio processing steps via debuglog progress messages
- Standardize extension registry and patterns warnings through debuglog
### CHANGES
- Introduce `cmd` directory for all main application binaries.
- Move all Go packages into the `internal` directory.
- Rename the `restapi` package to `server` for clarity.
- Consolidate patterns and strategies into a new `data` directory.
- Group all auxiliary scripts into a new `scripts` directory.
- Move all documentation and images into a `docs` directory.
- Update all Go import paths to reflect the new structure.
- Adjust CI/CD workflows and build commands for new layout.
