From 0fe9f74b4ec2ad7fc7f525f9c3f21c29e8dcb36c Mon Sep 17 00:00:00 2001 From: Mario Zechner Date: Mon, 29 Dec 2025 22:30:24 +0100 Subject: [PATCH] Return defensive copies from SettingsManager getters getHookPaths(), getCustomToolPaths(), and getSkillsSettings() now return copies of arrays instead of references to internal state. This prevents callers from accidentally mutating settings without going through setters. Fixes #361 --- packages/coding-agent/src/core/settings-manager.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/coding-agent/src/core/settings-manager.ts b/packages/coding-agent/src/core/settings-manager.ts index 4d58a5c1..3a116d63 100644 --- a/packages/coding-agent/src/core/settings-manager.ts +++ b/packages/coding-agent/src/core/settings-manager.ts @@ -314,7 +314,7 @@ export class SettingsManager { } getHookPaths(): string[] { - return this.settings.hooks ?? []; + return [...(this.settings.hooks ?? [])]; } setHookPaths(paths: string[]): void { @@ -332,7 +332,7 @@ export class SettingsManager { } getCustomToolPaths(): string[] { - return this.settings.customTools ?? []; + return [...(this.settings.customTools ?? [])]; } setCustomToolPaths(paths: string[]): void { @@ -360,9 +360,9 @@ export class SettingsManager { enableClaudeProject: this.settings.skills?.enableClaudeProject ?? true, enablePiUser: this.settings.skills?.enablePiUser ?? true, enablePiProject: this.settings.skills?.enablePiProject ?? true, - customDirectories: this.settings.skills?.customDirectories ?? [], - ignoredSkills: this.settings.skills?.ignoredSkills ?? [], - includeSkills: this.settings.skills?.includeSkills ?? [], + customDirectories: [...(this.settings.skills?.customDirectories ?? [])], + ignoredSkills: [...(this.settings.skills?.ignoredSkills ?? [])], + includeSkills: [...(this.settings.skills?.includeSkills ?? [])], }; }