ptx_RSSFeedWatch: 4 require() calls break post-luadch-#206 sandbox

[Aybook]

Summary

ptx_RSSFeedWatch breaks on luadch master post-#206 (2026-05-23). Four require() calls at lines 112, 114, 116, 386 hit "attempt to call a nil value (global 'require')" because Tier-2 Sub-PR-1 of #206 dropped require from the plugin sandbox.

Affected lines

-- ptx_RSSFeedWatch.lua
112:  local socket = require "socket"
114:  local http = require("socket.http")
116:  local https = require("ssl.https")
386:  local SLAXML = require 'slaxml'

Why each is tricky

1. require "socket" (line 112)

Trivial: socket is already a global in the plugin env (luadch loads it as an extern lib in core/init.lua). Replace with local socket = socket. Same pattern as cmd_hubinfo did in luadch-ng/luadch-ng#211 for the ssl global.

2. require("socket.http") (line 114)

socket.http is a SUBMODULE of socket. luasocket loads it on demand via require. On luadch master, that path is unreachable from the plugin sandbox.

Options:

• A: Add a one-line preload to luadch's core/init.lua similar to the ssl.x509 preload added in fix(scripts): drop require + package from sandbox (Tier-2 Sub-PR-1 of #206) luadch-ng#211:

  -- in init.lua, after socket loads:
  if _global.socket then
      local ok, http = pcall(require, "socket.http")
      if ok then _global.socket.http = http end
  end

  Then plugins do local http = socket.http. Mirror the existing ssl.x509 pattern - low-risk, well-tested.

• B: Rewrite ptx_RSSFeedWatch to use raw socket primitives (socket.tcp() + manual HTTP framing). Bigger refactor, more error-prone. Not recommended.

3. require("ssl.https") (line 116)

Same shape as #2 but for HTTPS. ssl.https is built on top of socket.http via luasec. Same preload-pattern fix.

4. require 'slaxml' (line 386)

slaxml is a 3rd-party pure-Lua XML parser bundled WITH the ptx_RSSFeedWatch plugin at scripts/ptx_RSSFeedWatch/slaxml/slaxml.lua. It's NOT in luadch's _global namespace.

Options:

• A: Add slaxml as an OPTIONAL lib in luadch's core/init.lua _optional list, alongside dkjson / basexx / zlib_stream. Then the plugin does local SLAXML = slaxml. Downside: forces every operator to install slaxml hub-wide even if they don't use this plugin. Wrong scope - slaxml is a plugin-local dep.

• B: Refactor ptx_RSSFeedWatch to dofile() slaxml at the plugin's onStart. Blocked: #206 removed dofile.

• C: Refactor ptx_RSSFeedWatch to inline slaxml at module-load via util.loadtable_string or similar (requires a one-time read + load). luadch's util already has loadtable (returns a table from a file) but NOT a generic loadcode (returns a callable chunk).

• D: Add a new luadch helper util.load_plugin_module(path) that wraps util.loadtable_string-style loading but for executable plugin code (loaded into the plugin's restricted env). Slightly broader than loadtable because it allows non-table returns. Recommended. Then ptx_RSSFeedWatch does:

  local SLAXML = util.load_plugin_module("scripts/ptx_RSSFeedWatch/slaxml/slaxml.lua")

  The hub-side helper handles the loadfile-with-restricted-env construction that's now blocked in plugin code.

5. slaxml's internal io.write calls (lines 15-26)

Cosmetic concern only - those are DEFAULT callbacks in SLAXML._call. ptx_RSSFeedWatch overrides them at line 391 with its own builder callbacks, so the default io.write path is unreachable in practice. No fix needed unless slaxml is parsed without a complete callback override somewhere else in the plugin (verify on impl).

Recommended path forward

1. luadch-ng/luadch side:

   • Add socket.http + ssl.https preload to core/init.lua (mirrors the ssl.x509 pattern from #211). 4-line change.
   • Add util.load_plugin_module(path) helper in core/util.lua so plugins can load bundled-with-plugin Lua modules without needing require / loadfile. ~20 LoC.
   • Document both in docs/PLUGIN_API.md.

2. luadch-ng/scripts side (this repo):

   • Replace the 4 require calls in ptx_RSSFeedWatch with the new patterns.
   • Possibly patch slaxml.lua to drop the io.write/print debug defaults so it's also strict-mode safe (minor cleanup, not strictly required).

3. Migration doc in luadch repo (separate work item) so other third-party plugin authors can migrate.

Scope

Both hub-side changes are small. The plugin-side refactor is ~10 lines. The whole thing is one PR per repo.

Refs luadch-ng/luadch-ng#206.

[Aybook]

Additional finding from #325-driven sweep

Sweep of the whole scripts/ tree for post-#206 sandbox-removed primitives surfaced one more crash site in this same plugin, in the same bug-family but NOT in the original four require() sites:

os.remove (line 174 alias, line 983 call site)

-- ptx_RSSFeedWatch.lua:174
local delete, os_time = os.remove, os.time

-- ptx_RSSFeedWatch.lua:983
delete(del.filepath)

os.remove is not in the curated _os_safe shim (only time / date / difftime, plus clock after luadch-ng/luadch-ng#326). The alias at L174 captures nil, and the cleanup call at L983 crashes the RSS-cache deletion path with attempt to call a nil value.

os.remove is a filesystem write — deliberately NOT exposed (#206 Tier-2 Sub-PR-2 §142-147 in core/scripts.lua). The fix is plugin-side: route the file removal through the standard plugin file-I/O surface (util.atomic_write for in-place truncate, or open a new plugin-callable helper if the use case is truly "remove file" rather than "overwrite with empty").

Looking at the call site: del.filepath is an RSS-cache file the plugin no longer wants. Two options:

• A: Add util.remove_file(path) to the hub-side plugin file API (mirrors util.atomic_write which we added in fix(util): atomic-by-default for savearray / savetable (F-PLG-1 of #133) luadch-ng#134 for the same write-side reason). Path-safety via the existing util.safe_path gate (added in Plugin Sandbox Bypass - Unrestricted File I/O via util Module luadch-ng#266 for the same family). Plugin then calls util.remove_file.
• B: Replace the remove with an empty util.atomic_write(path, "") — leaves zero-length files behind but no longer crashes. Cheaper, but accumulates filesystem droppings over time.

A is the consistent fix per CLAUDE.md §1a.1 ("fix the pattern everywhere") and ties into the same hub-side work as the existing require items in this issue.

Sweep summary

Other primitives scanned and clean across all 31 plugins: package.X, debug.X, getfenv/setfenv, raw*, real dofile / loadfile / load, os.execute/exit/rename/tmpname/tmpfile/setlocale/getenv, io.popen/input/output/read/write/lines/tmpfile/type/stdin/stdout/stderr. Only post-#206 fallout in the scripts repo is THIS plugin (4× require + 1× os.remove + the slaxml io.write cosmetic defaults already noted in the original analysis).

So the full plugin-side change for this issue is:

1. Replace the 4 require() calls per options in the original issue.
2. Replace os.remove -> util.remove_file (assuming hub-side adds it; otherwise option B above).
3. Cosmetic slaxml io.write defaults stay (overridden in practice).