Behavior
Running wk plugins install . from a plugin's source checkout (a directory containing plugin.toml alongside the rest of the repo — cmd/, pkg/, docs/, go.mod, etc.) copies the entire directory tree into ~/.wk/plugins/<name>/, not just the plugin's runtime artifacts (manifest, compiled binary, profiles).
Reported by the testing team while installing recipe-lint from a source checkout.
Root cause
Registry.Install (internal/plugin/registry.go) resolves the plugin name from plugin.toml and then calls copyDir(source, dest), which does an unfiltered filepath.WalkDir copy of every file under source. There's no allowlist/denylist — it doesn't distinguish the manifest, entrypoint binary, or any declared profile files from unrelated source-tree contents (VCS metadata, build artifacts, unrelated packages, docs).
Impact
- Bloats
~/.wk/plugins/<name>/ with irrelevant source files.
- Could leak repo contents (docs, internal code) into the plugin registry directory that aren't meant to ship with the plugin.
- No current way to scope what
install copies from a source directory install.
Suggested direction
Install should copy only what a plugin needs to run: plugin.toml, the file referenced by entrypoint, and any explicitly declared supporting assets — rather than the whole source tree.
(Filed against develop; unrelated to the v1.0.3 changelog work.)
Behavior
Running
wk plugins install .from a plugin's source checkout (a directory containingplugin.tomlalongside the rest of the repo —cmd/,pkg/,docs/,go.mod, etc.) copies the entire directory tree into~/.wk/plugins/<name>/, not just the plugin's runtime artifacts (manifest, compiled binary, profiles).Reported by the testing team while installing
recipe-lintfrom a source checkout.Root cause
Registry.Install(internal/plugin/registry.go) resolves the plugin name fromplugin.tomland then callscopyDir(source, dest), which does an unfilteredfilepath.WalkDircopy of every file undersource. There's no allowlist/denylist — it doesn't distinguish the manifest, entrypoint binary, or any declared profile files from unrelated source-tree contents (VCS metadata, build artifacts, unrelated packages, docs).Impact
~/.wk/plugins/<name>/with irrelevant source files.installcopies from a source directory install.Suggested direction
Installshould copy only what a plugin needs to run:plugin.toml, the file referenced byentrypoint, and any explicitly declared supporting assets — rather than the whole source tree.(Filed against develop; unrelated to the v1.0.3 changelog work.)