From 1d6fcfd0c4012a720eb4ef0de68da471939fac8d Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Thu, 28 May 2026 01:24:08 -0300 Subject: [PATCH] feat(authz): mark traffic-inspector LOCAL_ONLY + SPAWN_CAPABLE (F6) --- src/server/authz/routeGuard.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/server/authz/routeGuard.ts b/src/server/authz/routeGuard.ts index f077f274ac..18636c1d4d 100644 --- a/src/server/authz/routeGuard.ts +++ b/src/server/authz/routeGuard.ts @@ -31,6 +31,8 @@ export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray = [ "/api/services/", // T-10: embedded service lifecycle (spawn child processes) "/dashboard/providers/services/", // T-07: reverse proxy to embedded service UIs "/api/copilot/", // unauthenticated LLM driver — CLI-only by default; admins can opt-in to remote access via manage-scope bypass + "/api/tools/agent-bridge/", // F5: start/stop MITM server + DNS edits + "/api/tools/traffic-inspector/", // F6: http-proxy listener + system proxy ]; /** @@ -51,6 +53,8 @@ export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray = [ export const SPAWN_CAPABLE_PREFIXES: ReadonlyArray = [ "/api/cli-tools/runtime/", "/api/services/", // T-10: can run npm install + spawn node processes + "/api/tools/agent-bridge/", // start/stop MITM server + DNS edits + "/api/tools/traffic-inspector/", // http-proxy listener + system proxy ]; /**