Tighten opaque plugin content boundaries

platform_web/utils/pluginBridgeHost.ts

@@ -113,13 +113,10 @@ export function validateBridgeExecutionRequest(context: PluginBridgeHostContext,
   if (encodedSize > 16 * 1024) {
     return { code: "payload_too_large", message: "bridge payload is too large" };
   }
-  for (const [key, value] of Object.entries(payload)) {
+  for (const key of Object.keys(payload)) {
     if (!key.trim() || key !== key.trim()) {
       return { code: "validation", message: "bridge payload key is invalid" };
     }
-    if (containsUnsafeBridgeContent(key) || containsUnsafeBridgeContent(value)) {
-      return { code: "unsafe_payload", message: "bridge payload contains unsafe content" };
-    }
   }
   return null;
 }
@@ -161,11 +158,6 @@ export function parsePluginArtifactReference(result: Record<string, string> | un
   if (!reference.downloadUrl.startsWith(`/api/v1/artifacts/${encodeURIComponent(reference.artifactId)}/content`)) {
     return null;
   }
-  for (const value of Object.values(reference)) {
-    if (typeof value === "string" && containsUnsafeBridgeContent(value)) {
-      return null;
-    }
-  }
   return reference;
 }
 
@@ -197,23 +189,3 @@ function requiredPermissions(action: PluginBridgeAction): PluginPermission[] {
       return [];
   }
 }
-
-function containsUnsafeBridgeContent(value: string): boolean {
-  const lowered = value.trim().toLowerCase();
-  if (!lowered) {
-    return false;
-  }
-  return (
-    lowered.includes("/users/") ||
-    lowered.includes("/private/") ||
-    lowered.includes("unix://") ||
-    lowered.includes("tcp://") ||
-    lowered.includes("bearer ") ||
-    lowered.startsWith("sk-") ||
-    lowered.includes("password=") ||
-    lowered.includes("api_key=") ||
-    lowered.includes("apikey=") ||
-    lowered.includes("host path") ||
-    lowered.includes("rawapikey")
-  );
-}