fix(plugin): pass --ignore-scripts to npm install for cloned plugin repos

[Benjamin-eecs]

Description

installDependencies in src/plugin.ts runs execFileSync('npm', ['install', '--omit=dev'], ...) against a directory just cloned from a third-party Git URL via opencli adapter install. Without --ignore-scripts, npm executes preinstall / install / postinstall hooks declared in the plugin's package.json (and in every transitive dep), so a malicious plugin or a compromised dep can run arbitrary code with the user's privileges at install time. Adapter code is loaded later by the plugin discovery path; the install-time script execution is an extra vector that adapter plugins do not need.

This is Finding 2 in the #847 security audit. @Astro-Han ranked it the top-priority unfixed item in his triage: "plugin install is a real issue, and one we should treat seriously … Using --ignore-scripts plus a clear warning would be a good first step." This PR is the --ignore-scripts half; a follow-up could add a one-time advisory if useful.

Plugins that depend on install scripts to compile native modules will silently skip those hooks. If a real case appears, an opt-in such as a manifest field or env var can be added in a follow-up; opencli adapter plugins observed in the wild depend on small pure-JS packages and do not exercise lifecycle scripts.

Related issue: fixes #1753.

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 🌐 New site adapter
• 📝 Documentation
• ♻️ Refactor
• 🔧 CI / build / tooling

Checklist

• I ran the checks relevant to this PR
• I updated tests or docs if needed
• I included output or screenshots when useful

Screenshots / Output

Existing test throws when npm install fails still passes (mock-based regression check at the install error path). New test passes --ignore-scripts to npm install asserts the flag reaches the execFileSync call via the existing mockExecFileSync infrastructure. Full src/plugin*.test.ts suite: 105/105 pass on this branch.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR hardens plugin dependency installation by preventing npm lifecycle scripts from running when installing dependencies in a freshly cloned third-party plugin directory.

Changes:

• Add --ignore-scripts to npm install during plugin dependency installation.
• Add a unit test verifying the --ignore-scripts flag is passed to execFileSync.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/plugin.ts	Adds --ignore-scripts to the npm install invocation and documents the security rationale.
src/plugin.test.ts	Adds an assertion that installDependencies passes --ignore-scripts to npm.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.