mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
Release v3.8.27 (#3968)
* chore(release): open v3.8.27 development cycle * fix(security): polynomial ReDoS in comboAgentMiddleware regex (#3982) * fix(security): eliminate polynomial ReDoS in comboAgentMiddleware <omniModel> regex (CodeQL js/polynomial-redos) CACHE_TAG_PATTERN wrapped the tag in an unbounded `(?:\\n|\n|\r)*` prefix/suffix. On an unanchored `.test()`/`.exec()` that is O(n²) on inputs with many newlines (CodeQL js/polynomial-redos, alerts #612/#613). The surrounding runs are irrelevant to detecting/capturing the tag, so the detection pattern now matches only the core `<omniModel>([^<]+)</omniModel>`; the global strip pattern still consumes the wrapping newlines (combo.ts streaming, #531) but BOUNDED ({0,16}) so it stays linear. Behavior preserved: detection, model extraction, multi-tag stripping (#454) and blank-line cleanup all unchanged (107 related tests green). Adds ReDoS-safety regression tests (50k-newline inputs complete in <1ms). * docs(changelog): add #3982 ReDoS fix to [3.8.27] * ci(security): harden workflows — artipacked persist-credentials + cache-poisoning + SC2086 (#3965) * Refine provider quota card display (#3969) Integrated into release/v3.8.27 * feat: add sidebar group separator toggles (#3971) Integrated into release/v3.8.27 * Gate control-plane proxy direct fallback (#3963) Integrated into release/v3.8.27 * Capture actual upstream provider requests (#3941) Integrated into release/v3.8.27 * ci(quality): flip require-tighten + osv + Trivy to blocking (v3.8.27 cycle-end) (#3984) * fix(resilience): respect connection cooldown stored as numeric epoch (#3954) (#3995) rate_limited_until is a TEXT column, but setConnectionRateLimitUntil (Antigravity full-quota path) persists a raw epoch number that SQLite coerces to a numeric string ("1781696905131.0"). The selection predicate isAccountUnavailable then did new Date("1781696905131.0") -> NaN, so the cooling connection was never skipped and the router kept dispatching to rate-limited accounts. Normalize numeric-epoch strings (and number/Date/ISO) via a shared cooldownUntilMs() helper in isAccountUnavailable / getEarliestRateLimitedUntil / filterAvailableAccounts / parseFutureDateMs. ISO behavior preserved. * fix(providers): fetch live /models for LLM7 and BytePlus (#3976) (#3996) llm7 and byteplus carry a real modelsUrl but were not classified by any live-fetch branch of the model-import route, so their hardcoded 4-entry registry catalog was served (source local_catalog) instead of the upstream catalog. Add both to NAMED_OPENAI_STYLE_PROVIDERS so the route probes <baseUrl>/models and serves the live list, falling back to the local catalog only on fetch failure. * fix(dashboard): logs auto-refresh reads live visibility, not a stale mount ref (#3972) (#3997) The auto-refresh interval gated each tick on visibleRef, seeded once at mount and updated only by a visibilitychange event. A tab mounted while document.visibilityState is 'hidden' (background load, bfcache, embedded/proxied webviews) with no later visibilitychange left the ref false forever, so the interval ticked but never fetched — only the manual button worked. Read the live document.visibilityState in the tick instead. * feat(compression): add Indonesian caveman rules and language pack (#3975) Integrated into release/v3.8.27 (cherry picked from commitc9b5b1a892) * fix(combo): shuffle strict-random fallback remainder to spread load (#3959) (#3998) strict-random shuffled only the deck-selected slot 0 and left the fallback remainder in fixed priority order, so after a failing deck pick the chain always fell through to the same top-priority model — a persistently-failing model was retried on essentially every request and fallback load never spread across peers. Shuffle the remainder too (like the random strategy). * Add provider auth visibility controls (#3953) Integrated into release/v3.8.27 * fix(claude): forward client tool-search-tool anthropic-beta on the Claude OAuth path (#3974) (#3999) The client-negotiated anthropic-beta: tool-search-tool-2025-10-19 was dropped on both Claude code paths (default executor rebuilt from static ANTHROPIC_BETA_CLAUDE_OAUTH; selectBetaFlags only read the client beta to gate thinking/effort), so claude.ai rejected deferred-tool requests with 400 'Tool reference not found'. Add an allowlist-merge (mergeClientAnthropicBeta) that unions the client's allowlisted betas into the outbound set on both paths, preserving #3415 (no forced thinking/effort). * feat(providers): add model search filter to provider dashboard (#3950) Integrated into release/v3.8.27 * fix(vision-bridge): force bridge for tokenrouter deepseek models (#3946) Integrated into release/v3.8.27 * fix(executor): strip stream_options on non-streaming requests (#3884) (#4000) Clients that send stream_options:{include_usage:true} regardless of stream (e.g. the OpenAI Python SDK) had it passed through on non-streaming calls; NVIDIA NIM rejected it with 400 'Stream options can only be defined when stream=True'. DefaultExecutor.transformRequest only injected/cleared stream_options on the streaming branch and never stripped a client-sent value when stream=false. Add a !stream strip branch; the streaming injection path is unchanged. Global to openai-compat providers. * fix(qwen-web): cookie validation false-positive - check response body for user object (#3958) Integrated into release/v3.8.27 * fix(db): persist backup retention days (#3970) Integrated into release/v3.8.27 * 大量UI显示和i18n优化 (#3973) Integrated into release/v3.8.27 * deps: bump the npm_and_yarn group across 1 directory with 2 updates (#3943) Integrated into release/v3.8.27 * deps: bump form-data from 4.0.5 to 4.0.6 (#3944) Integrated into release/v3.8.27 * deps: bump vite from 8.0.5 to 8.0.16 (#3942) Integrated into release/v3.8.27 * chore(quality): re-baseline validation.ts 4407->4428 (#3958 qwen body-check) The qwen-web validation body-check merged in #3958 pushed validation.ts past its frozen size on the integrated release tip. Bump the baseline with justification; no logic is separately extractable from the existing qwen-web validation branch. * deps: bump the production group with 13 updates (#3915) Integrated into release/v3.8.27 — low-risk group (playwright 1.60→1.61 minor + transitive patches; fumadocs-core 16.9→16.10 minor). * chore(deps): ignore jscpd major bumps (v5 Rust rewrite breaks the duplication gate) Our duplication ratchet (scripts/check/check-duplication.mjs) is pinned to jscpd@4 and parses jscpd-report.json against a frozen baseline. jscpd v5 is a native Rust binary with no Node.js API and a different report/bin, so a major bump would break the gate. Migrate deliberately, not via dependabot. Closes the noise from #3916. * fix(perplexity-web): parse schematized diff_block stream so answers aren't empty (#4001) Integrated into release/v3.8.27 — schematized diff_block parsing follow-up to #3938. * refactor: modularize providerRegistry.ts into 159 individual provider plugins (#3993) Modularize provider registry (#3594). Integrated into release/v3.8.27 after rebase + behavior-preservation verification (provider-consistency gate 159/232/0, typecheck, registry tests, build 556/556). Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * fix(registry): restore byteplus + mimocode dropped by #3993 modularization The provider-registry modularization (#3993) was cut from a base predating the byteplus (#3877) and mimocode (#3837) registry entries, so merging it silently dropped both providers (getRegistryEntry returned undefined → validation reported 'not supported'). Re-add them as registry modules in the new structure; registered count 159→161, provider-consistency 161/232/0. Also align the pre-existing qwen-web validator test to #3958: since the validator now requires a real `user` object in the 200 body, the mock must carry one. * refactor: modularize schemas (non-stacked) (#3988) Modularize validation schemas (#3594). Integrated into release/v3.8.27 after rebase (reconciled the merged hiddenSidebarGroupLabels #3971 + intelligenceSyncRequestSchema into the new modules) + behavior verification (typecheck, 195 schema/settings/validation tests, build 556/556). Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * fix(default-executor): honor custom providerSpecificData.baseUrl for OpenAI-format providers (#4002) Integrated into release/v3.8.27 — honor custom providerSpecificData.baseUrl in DefaultExecutor (openai-format), tested. * feat(openai): honor custom base URL in model discovery + complete openai/codex pricing (#4005) Integrated into release/v3.8.27 — openai model-discovery honors custom base URL (SSRF-guarded) + pricing rows for new openai/codex models. Tested + baselines bumped. * fix(live-ws): bridge sidecar events to dashboard (#4004) Integrated into release/v3.8.27 — repair LiveWS sidecar (startup, same-origin /live-ws, main→sidecar compression.completed bridge, early-msg queue). Fixed the cookie-parse regex (\s) + added a focused unit test; baseline bumped for the non-blocking chatCore bridge. * docs(troubleshooting): note MITM proxy cannot intercept Windows-host apps under WSL (#4003) Integrated into release/v3.8.27 — MITM/WSL troubleshooting note. * fix(repo): untrack accidentally-committed root node_modules symlink + gitignore it A worktree node_modules symlink (-> the main checkout's node_modules) was staged by a `git add -A` during the #3988 merge and committed into05213ac6a. The symlink points at the repo's own node_modules path, so checking it out turns the main checkout's node_modules into a self-referential symlink (breaking tsx/all node ops). Untrack it and add a root-anchored /node_modules ignore so the symlink form can't be re-committed (the existing 'node_modules/' only matches directories). * fix(quality): allowlist socks dep (declared by #4004, never allowlisted) socks@^2.8.7 was added to package.json in #4004 (LiveWS sidecar,02302131f) as a phantom-dep cleanup but never added to dependency-allowlist.json, so check:deps has been red on the release tip ever since. socks is the standard SOCKS proxy client (dep of fetch-socks), legitimate and years old. * feat(sse): real LLMLingua-2 ONNX compression engine (stable) (#4014) Integrated into release/v3.8.27. Adjustments before merge: - Synced with the current release tip (was 11 commits behind). - Added the 3 LLMLingua-2 ONNX optional-runtime deps to dependency-allowlist.json (@atjsh/llmlingua-2, @tensorflow/tfjs, js-tiktoken) — the only gate that was red. - socks was allowlisted directly on release (separate fix d7db5c73d; it was declared by #4004 but never allowlisted, leaving check:deps red release-wide). Verified locally: check:deps OK, file-size OK, public-creds OK, provider-consistency 161/232/0, typecheck:core clean, 24/24 LLMLingua tests pass. The only remaining Fast-QG red is the pre-existing #3972 orphan test (request-logger-autorefresh-visibility-3972.test.tsx), which is release-wide and unrelated to this PR. * test(dashboard): rehome #3972 logs auto-refresh test so a runner collects it tests/unit/request-logger-autorefresh-visibility-3972.test.tsx (added by #3972 via #3997) sat at the top level of tests/unit/ as a .tsx vitest test, which NO runner collects: the node runner only globs *.test.ts, and test:vitest:ui only runs tests/unit/ui. So the #3972 regression guard never executed in CI and check:test-discovery was red release-wide. Move it under tests/unit/ui/ (the collected vitest:ui path) and fix the relative import depth. Verified: the test now runs and passes (2/2), and check:test-discovery is green. * feat(compression): capture per-engine analytics (#3960) + Lite schema fix (#3952) (#4018) Captures the net-new value from #3960 (per-engine breakdown analytics) and #3952 (Lite engine schema fix) onto release/v3.8.27. Fast QG green; 622/622 compression+analytics tests pass. * fix(sse): guard model-less registry entries in getUnsupportedParams (mimocode) (#4015) Real bugfix: guard model-less registry entries (mimocode) in getUnsupportedParams so handleChatCore no longer throws 'entry.models is not iterable' / reports 'All models failed' for unrelated requests. Includes a regression test. Fast QG green. * feat(ci): Quality Gate v2 — Onda 0 + Onda 1 (gate flips, TIA, SAST, DAST-smoke, mutation infra) (#4016) * docs(ops): add quality-gate assessment + replication playbook (Fase 9 foundation) * feat(ci): flip oasdiff breaking-change gate to blocking (ratchet) * docs(ops): deliver main branch-protection ruleset for owner to apply * fix(ci): run typecheck:core in PR->release fast-gates (close fast-gates hole, part 1) * perf(mutation): enable Stryker incremental mode + cache (scales the 60/80 rollout) * feat(ci): commit CodeQL advanced config (security-extended), replacing default-setup * feat(ci): version semgrep SAST workflow (owasp/secrets), advisory * feat(quality): TIA test-impact map builder (import-graph; map built at runtime, gitignored) * feat(quality): TIA impacted-test selector with run-all fail-safe * fix(ci): run TIA-impacted unit tests in PR->release fast-gates (build map at runtime, fail-safe full) * feat(ci): DAST-smoke per-PR (schemathesis subset + promptfoo injection-guard, blocking) * fix(ci): unbreak Fase 9 PR CI (MDX frontmatter, CodeQL conflict, dast-smoke advisory) - Add MDX frontmatter to docs/ops/{BRANCH_PROTECTION_MAIN,QUALITY_GATE_PLAYBOOK}.md. fumadocs rejects frontmatter-less docs -> 'npm run build' failed -> broke dast-smoke's build step (the release fast-gates never runs build, so this only surfaced on the PR). - codeql.yml: workflow_dispatch-only until the owner switches repo CodeQL Default->Advanced (advanced configs cannot be processed while default setup is enabled; documented inline). - dast-smoke.yml: job-level continue-on-error (advisory) so this brand-new gate matures before it blocks (repo convention: advisory -> blocking). * ci(quality): make TIA unit-test step advisory until release test-debt is cleared release/v3.8.27 carries ~17 pre-existing failing unit tests (budget #3537, apiKey #3552, several Zod schemas, Puter/Qwen executors, mimocode entry, etc.) unrelated to this PR — the new 'run tests on PR->release' gate surfaced them. Per the repo's advisory->blocking convention, this step enters advisory (it still runs + reports) so pre-existing debt doesn't block the gate program. typecheck:core stays blocking. Flip to blocking (remove continue-on-error) once the release suite is green. * fix(sse): preserve Kiro streaming finish_reason tool_calls (#3980) (#4025) * fix(guardrails): preserve original image when vision-bridge describe fails (#4012) (#4026) * feat(api): advertise combo capabilities on import surfaces (#3979) (#4027) * feat(sse): delegated Anthropic Context Editing for Claude (clear_tool_uses) (#4021) Opt-in Claude-only delegated compression: injects context_management.clear_tool_uses_20250919 at the Claude pre-serialization chokepoint (composes with clear_thinking, thinking first), threaded via ExecuteInput from handleChatCore. Pure edit-builder + 11 tests (7 unit + 4 e2e fetch-capture). Beta context-management-2025-06-27 already advertised; allowlist done. Telemetry/400-fallback/claude-web coverage deferred. * fix(opencode): map x-session-affinity to x-opencode-session for custom providers (#4022) (#4028) * fix(dashboard): Playground Compare tab loading + HTTP method guard (#4024) randomUUID non-HTTPS fallback + static CompareTab import; raw HTTP TRACE->405 method guard wired into dev + standalone servers. Integrated into release/v3.8.27. * refactor(dashboard): settings UI layout + API Keys naming (#4020) Presentation/relabel refactor of the Settings dashboard (API Manager -> API Keys), card relocations, Toggle adoption, present-but-disabled engine steps. Auth-file changes are string/comment-only (no behavior change). Integrated into release/v3.8.27. * fix: restore unit regressions dropped by lossy schema/registry modularizations (#4030) Restores schema fields (combo reasoningTokenBuffer, budget-0 #3537, openrouter preset, proxy family #3777, resilience degradation/providerCooldown), qwen-web v2 endpoint+catalog, mimocode models key — all dropped by #3988/#3993 — and aligns 3 tests to #3941/#3993. Verified: 8 failing regression tests on release tip -> 131/131 green on this branch. Integrated into release/v3.8.27. * fix(api): return 400 (not 500) for malformed JSON on /api/auth/login (#4031) Wrap request.json() so a malformed/non-JSON login body returns a structured 400 instead of falling through to the 500 catch. Fixes the schemathesis high-risk-endpoint DAST finding (verified: schemathesis step now passes). +TDD test. Integrated into release/v3.8.27. * feat(dashboard): real circuit-breaker state in the Combo Live cascade (U1b) (#4029) Overlays real provider circuit-breaker state (GET /api/monitoring/health) onto the Combo Live cascade as a 'CB: OPEN · 41s' badge. Pure enrichRunWithBreakers + fail-soft useProviderBreakerHealth poll; graceful when health is absent. +13 tests. Integrated into release/v3.8.27. * Fix promptfoo security assertion parsing (#4032) * chore(deps): dependabot security bumps + drop unused gray-matter (#4036) Integrated into release/v3.8.27 — dependabot security bumps (form-data/js-yaml/protobufjs/dompurify/hono) + drop unused gray-matter. Unblocks the npm audit:deps gate (Lint) branch-wide. * fix(ci): scope TIA to node:test unit files only (mirror test:unit glob) (#4035) Integrated into release/v3.8.27 — scopes the advisory TIA step to the test:unit node:test glob, fixing the 99 false failures. +4 TDD. * Refine compression settings, storage labels, and sidebar grouping (#4033) Integrated into release/v3.8.27 — relocate Token Saver into Compression Settings (controlled component), reorder Security/Authz tabs, storage labels + i18n relabel. Thanks @rdself! * [codex] add per-key local usage command (#4034) Integrated into release/v3.8.27 — per-key local @@om-usage command (cached quota, no upstream routing). Rebased onto modularized schemas/keys.ts + file-size rebaseline. Thanks @Witroch4! * chore(release): reconcile v3.8.27 CHANGELOG + i18n mirrors * ci(quality): unblock v3.8.27 release gates (zizmor pin + test-masking allowlist) - zizmor ratchet (151→139, no regression): SHA-pin every action ref ADDED this cycle — codeql/dast-smoke/semgrep (3 new workflows) + trivy-action (docker-publish) + actions/cache (nightly-mutation). Pre-existing tag refs keep the repo convention. - test-masking: add config/quality/test-masking-allowlist.json + allowlist support in check-test-masking.mjs (exempts ONLY the net-assert-reduction signal; tautology/skip/ deletion still fire). Allowlists 2 verified-legitimate reductions: appearance-widget-settings-schema (#4033 removed showTokenSaverOnEndpoint field) and dashboard-shell-tabs (#3973 tabs→redirect refactor, asserts replaced). +4 gate tests. * test(quality): reword test-masking self-test comments to avoid literal masking patterns The added allowlist-test comments contained the literal strings 'assert.ok(true)' and '.skip' which the masking detector's own regexes match as text — making the gate flag its own test file (net +1 tautology/skip/extended-tautology vs main). Reworded to plain prose ('a new tautology', 'a new skip marker'); test logic unchanged (24/24 pass). * fix(quality): unblock v3.8.27 release — align 3 stale tests + restore modularized settings-schema parity Release-PR full CI surfaced 3 deterministic test failures (no live product regression), all stale vs legitimate cycle changes: - settings-schema parity (#3988): the modularized updateSettingsSchema barrel (schemas/settings.ts) had diverged from the canonical settingsSchemas.ts (45 vs 85 fields — 40 dropped + 6 extra), a lossy-modularization dead-code copy. Re-export from the canonical source so the barrel can never diverge again (runtime already uses canonical). Parity test now passes. - api-manager permissions modal: #4034 added a 4th self-service switch (per-key usage allowance); a11y invariant (every switch type="button") still holds. Updated the static count 3 -> 4. - pack-artifact policy: dist/http-method-guard.cjs became a required runtime path; added it to the test's expected missing-paths list. Also documents the gate gap for Fase 9 (QUALITY_GATE_PLAYBOOK Parte 6): G1 run the deterministic unit layer + test-masking on PR->release (not just PR->main), G2 a modularization-parity gate (would have caught the #3988 drop at its PR), G3 flake quarantine. Env flakes (LiveWS startup timeout, integration server-startup cascade) are pre-existing/CI-env, triaged separately. --------- Co-authored-by: Randi <55005611+rdself@users.noreply.github.com> Co-authored-by: Veier04 <118300867+Veier04@users.noreply.github.com> Co-authored-by: Felipe Sartori <felipesartori.ti@gmail.com> Co-authored-by: WormAlien <164898390+WormAlien@users.noreply.github.com> Co-authored-by: thezukiru <121331256+thezukiru@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: NOXX - Commiter <artur1992123@mail.ru> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com> Co-authored-by: Demiurge The Single <megamen932@gmail.com> Co-authored-by: Witroch4 <witalo_rocha@hotmail.com>
This commit is contained in:
Diego Rodrigues de Sa e Souza
committed by
GitHub
GitHub
parent
c9b5b1a892
commit
fa367dd99e
@@ -125,6 +125,11 @@ const EXTRA_MODULE_ENTRIES = [
|
||||
src: ["scripts", "dev", "peer-stamp.mjs"],
|
||||
dest: ["peer-stamp.mjs"],
|
||||
},
|
||||
{
|
||||
label: "HTTP method guard (server-ws.mjs dependency)",
|
||||
src: ["scripts", "dev", "http-method-guard.cjs"],
|
||||
dest: ["http-method-guard.cjs"],
|
||||
},
|
||||
{
|
||||
label: "responses-ws-proxy (server-ws.mjs dependency)",
|
||||
src: ["scripts", "dev", "responses-ws-proxy.mjs"],
|
||||
|
||||
@@ -35,7 +35,11 @@ export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
|
||||
".env.example",
|
||||
"BUILD_SHA",
|
||||
"docs/reference/openapi.yaml",
|
||||
"http-method-guard.cjs",
|
||||
"open-sse/mcp-server/server.js",
|
||||
// LLMLingua ONNX worker — esbuild'd standalone .js spawned via worker_threads
|
||||
// (the Next.js bundler can't trace the computed Worker path). Kept like the MCP server.
|
||||
"open-sse/services/compression/engines/llmlingua/onnxWorker.js",
|
||||
"package.json",
|
||||
"peer-stamp.mjs",
|
||||
"responses-ws-proxy.mjs",
|
||||
@@ -121,6 +125,7 @@ export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
|
||||
"dist/server-ws.mjs",
|
||||
"dist/responses-ws-proxy.mjs",
|
||||
"dist/peer-stamp.mjs",
|
||||
"dist/http-method-guard.cjs",
|
||||
"dist/webdav-handler.mjs",
|
||||
"bin/cli/program.mjs",
|
||||
"bin/mcp-server.mjs",
|
||||
|
||||
@@ -40,6 +40,7 @@ const ROOT = join(__dirname, "..", "..");
|
||||
const NPX_BIN = process.platform === "win32" ? "npx.cmd" : "npx";
|
||||
|
||||
const DIST_DIR = join(ROOT, "dist");
|
||||
const METHOD_GUARD_REQUIRE = 'require("./http-method-guard.cjs").installHttpMethodGuard();\n';
|
||||
|
||||
function walkFiles(dir: string, rootDir: string = dir, files: string[] = []): string[] {
|
||||
let entries: string[] = [];
|
||||
@@ -153,6 +154,20 @@ assembleStandalone({
|
||||
});
|
||||
console.log(" ✅ Standalone bundle assembled to dist/");
|
||||
|
||||
const distServer = join(DIST_DIR, "server.js");
|
||||
const methodGuardSrc = join(ROOT, "scripts", "dev", "http-method-guard.cjs");
|
||||
const methodGuardDest = join(DIST_DIR, "http-method-guard.cjs");
|
||||
if (existsSync(methodGuardSrc)) {
|
||||
cpSync(methodGuardSrc, methodGuardDest);
|
||||
}
|
||||
if (existsSync(distServer)) {
|
||||
const serverSource = readFileSync(distServer, "utf8");
|
||||
if (!serverSource.includes("installHttpMethodGuard")) {
|
||||
writeFileSync(distServer, METHOD_GUARD_REQUIRE + serverSource);
|
||||
console.log(" ✅ Patched dist/server.js with HTTP method guard.");
|
||||
}
|
||||
}
|
||||
|
||||
// ── Step 8: Compile + copy MITM cert utilities ─────────────
|
||||
const mitmSrc = join(ROOT, "src", "mitm");
|
||||
const mitmDest = join(DIST_DIR, "src", "mitm");
|
||||
@@ -239,6 +254,54 @@ if (existsSync(mcpSrcFile)) {
|
||||
}
|
||||
}
|
||||
|
||||
// ── Step 8.6: Bundle LLMLingua ONNX worker ────────────────────────────
|
||||
// The worker is spawned via worker_threads at a path the Next.js bundler cannot
|
||||
// statically trace, so it must ship as a standalone .js (mirrors the MCP-server
|
||||
// bundling above). Heavy deps (@atjsh/llmlingua-2 / @huggingface/transformers /
|
||||
// @tensorflow/tfjs / js-tiktoken) stay EXTERNAL — they are optionalDependencies,
|
||||
// dynamically imported at runtime, and the worker fail-opens if any is absent.
|
||||
const llmWorkerSrc = join(
|
||||
ROOT,
|
||||
"open-sse",
|
||||
"services",
|
||||
"compression",
|
||||
"engines",
|
||||
"llmlingua",
|
||||
"onnxWorker.ts"
|
||||
);
|
||||
const llmWorkerDestDir = join(
|
||||
DIST_DIR,
|
||||
"open-sse",
|
||||
"services",
|
||||
"compression",
|
||||
"engines",
|
||||
"llmlingua"
|
||||
);
|
||||
if (existsSync(llmWorkerSrc)) {
|
||||
console.log(" 🔨 Bundling LLMLingua ONNX worker (TypeScript → JavaScript)...");
|
||||
mkdirSync(llmWorkerDestDir, { recursive: true });
|
||||
try {
|
||||
execFileSync(
|
||||
NPX_BIN,
|
||||
[
|
||||
"esbuild",
|
||||
"open-sse/services/compression/engines/llmlingua/onnxWorker.ts",
|
||||
"--bundle",
|
||||
"--platform=node",
|
||||
"--packages=external",
|
||||
"--format=esm",
|
||||
"--outfile=dist/open-sse/services/compression/engines/llmlingua/onnxWorker.js",
|
||||
],
|
||||
{ cwd: ROOT, stdio: "inherit" }
|
||||
);
|
||||
console.log(
|
||||
" ✅ LLMLingua worker bundled to dist/open-sse/services/compression/engines/llmlingua/onnxWorker.js"
|
||||
);
|
||||
} catch (err: any) {
|
||||
console.warn(" ⚠️ LLMLingua worker bundle error:", err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// ── Step 8.7: Bundle CLI Entrypoint ──────────────────────────
|
||||
const cliSrcFile = join(ROOT, "bin", "omniroute.ts");
|
||||
const cliDestFile = join(ROOT, "bin", "omniroute.mjs");
|
||||
|
||||
@@ -19,19 +19,26 @@
|
||||
// (arquivo não existia no base, ou
|
||||
// clone shallow sem o ref base)
|
||||
//
|
||||
// Esta versão é ADVISORY (sai 0 SEMPRE, mesmo com N>0). Promove a bloqueante
|
||||
// depois (mesma trajetória de todo gate novo neste repo: report → ratchet → block).
|
||||
// Por default é ADVISORY (sai 0 SEMPRE, mesmo com N>0). Passe --ratchet para
|
||||
// tornar BLOQUEANTE: lê metrics.openapiBreaking.value de
|
||||
// config/quality/quality-baseline.json, compara a contagem MEDIDA e SAI 1 SE — E
|
||||
// SOMENTE SE — a medida for MAIOR que o baseline (regressão real, direction:down).
|
||||
// Qualquer SKIP gracioso (oasdiff ausente do PATH, spec base não resolvível em
|
||||
// clone shallow, JSON inválido) SAI 0 MESMO com --ratchet — uma falha de MEDIÇÃO
|
||||
// nunca bloqueia, só uma regressão MEDIDA bloqueia (mesma trajetória de todo gate
|
||||
// neste repo: report → ratchet → block).
|
||||
//
|
||||
// Base ref:
|
||||
// • CI passa BASE_REF=${{ github.base_ref }} (ex.: "release/v3.8.26").
|
||||
// • Local: default origin/release/v3.8.26.
|
||||
// • CI passa BASE_REF=${{ github.base_ref }} (ex.: "release/v3.8.27").
|
||||
// • Local: default origin/release/v3.8.27.
|
||||
// A spec base é extraída com `git show <BASE_REF>:docs/reference/openapi.yaml`.
|
||||
//
|
||||
// Uso:
|
||||
// node scripts/check/check-openapi-breaking.mjs
|
||||
// BASE_REF=origin/release/v3.8.26 node scripts/check/check-openapi-breaking.mjs
|
||||
// BASE_REF=origin/release/v3.8.27 node scripts/check/check-openapi-breaking.mjs
|
||||
// node scripts/check/check-openapi-breaking.mjs --json # imprime JSON bruto do oasdiff
|
||||
// node scripts/check/check-openapi-breaking.mjs --quiet # suprime logs de diagnóstico
|
||||
// node scripts/check/check-openapi-breaking.mjs --ratchet # falha (exit 1) numa regressão
|
||||
|
||||
import fs from "node:fs";
|
||||
import os from "node:os";
|
||||
@@ -42,10 +49,12 @@ import { pathToFileURL } from "node:url";
|
||||
const ROOT = process.cwd();
|
||||
const QUIET = process.argv.includes("--quiet");
|
||||
const PRINT_JSON = process.argv.includes("--json");
|
||||
const RATCHET = process.argv.includes("--ratchet");
|
||||
|
||||
const SPEC_REL = "docs/reference/openapi.yaml";
|
||||
const SPEC_PATH = path.join(ROOT, "docs", "reference", "openapi.yaml");
|
||||
const DEFAULT_BASE_REF = "origin/release/v3.8.26";
|
||||
const DEFAULT_BASE_REF = "origin/release/v3.8.27";
|
||||
const BASELINE_PATH = path.join(ROOT, "config/quality/quality-baseline.json");
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Pure parsing function (exported for tests)
|
||||
@@ -110,6 +119,52 @@ export function parseOasdiffBreaking(oasdiffJson) {
|
||||
return { count, byId, byPath, items };
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Ratchet (direction:down) — exported for tests
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
* Avalia a contagem MEDIDA de breaking changes contra o baseline.
|
||||
* Direction: down (a contagem só pode CAIR — mais breaking changes = regressão).
|
||||
*
|
||||
* Uma medição ausente (current null/undefined) OU um baseline ausente
|
||||
* (baseline null/undefined) → { regressed:false, skipped:true }: sem uma das
|
||||
* duas pontas não há ratchet possível, então o caller trata como SKIP gracioso
|
||||
* (exit 0 mesmo com --ratchet). Uma falha de MEDIÇÃO nunca bloqueia.
|
||||
*
|
||||
* @param {object} args
|
||||
* @param {number|null} args.current - Breaking changes medidos agora (null = sem medição).
|
||||
* @param {number|null} args.baseline - Contagem congelada em quality-baseline.json (null = sem baseline).
|
||||
* @returns {{ regressed: boolean, skipped: boolean }}
|
||||
*/
|
||||
export function evaluateOpenapiRatchet({ current, baseline }) {
|
||||
if (current === null || current === undefined || baseline === null || baseline === undefined) {
|
||||
return { regressed: false, skipped: true };
|
||||
}
|
||||
return { regressed: current > baseline, skipped: false };
|
||||
}
|
||||
|
||||
/**
|
||||
* Lê metrics.openapiBreaking.value do quality-baseline.json.
|
||||
* Retorna null se o arquivo ou a métrica estiverem ausentes/inválidos (sem
|
||||
* baseline não há ratchet possível — o caller trata como SKIP gracioso, exit 0).
|
||||
*
|
||||
* @param {string} baselinePath
|
||||
* @returns {number|null}
|
||||
*/
|
||||
export function readBaselineOpenapiValue(baselinePath = BASELINE_PATH) {
|
||||
if (!fs.existsSync(baselinePath)) return null;
|
||||
let baselineJson;
|
||||
try {
|
||||
baselineJson = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
const metric = baselineJson?.metrics?.openapiBreaking;
|
||||
if (!metric || typeof metric.value !== "number") return null;
|
||||
return metric.value;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Binary detection
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -331,10 +386,18 @@ function main() {
|
||||
.map(([p, n]) => `${p}(${n})`)
|
||||
.join(", ");
|
||||
process.stderr.write(`[openapi-breaking] affected paths: ${topPaths}\n`);
|
||||
process.stderr.write(
|
||||
"[openapi-breaking] ADVISORY — promove a BLOQUEANTE depois. Se a quebra é\n" +
|
||||
"[openapi-breaking] intencional (major bump), documente no PR; senão, ajuste a spec.\n"
|
||||
);
|
||||
if (RATCHET) {
|
||||
process.stderr.write(
|
||||
"[openapi-breaking] Se a quebra é intencional (major bump), documente no PR e\n" +
|
||||
"[openapi-breaking] re-baseline metrics.openapiBreaking em config/quality/quality-baseline.json\n" +
|
||||
"[openapi-breaking] com justificativa + issue de tracking; senão, ajuste a spec.\n"
|
||||
);
|
||||
} else {
|
||||
process.stderr.write(
|
||||
"[openapi-breaking] ADVISORY — passe --ratchet para BLOQUEAR uma regressão. Se a quebra é\n" +
|
||||
"[openapi-breaking] intencional (major bump), documente no PR; senão, ajuste a spec.\n"
|
||||
);
|
||||
}
|
||||
} else {
|
||||
process.stderr.write(
|
||||
`[openapi-breaking] OK — nenhuma breaking change na spec vs '${baseRef}'.\n`
|
||||
@@ -342,8 +405,8 @@ function main() {
|
||||
}
|
||||
}
|
||||
|
||||
// ADVISORY — sai 0 SEMPRE nesta versão, mesmo com count > 0.
|
||||
process.exitCode = 0;
|
||||
// Medição bem-sucedida → aplica o ratchet (bloqueante só com --ratchet).
|
||||
applyRatchet(count);
|
||||
} finally {
|
||||
// Limpa o arquivo temp da spec base.
|
||||
try {
|
||||
@@ -354,4 +417,52 @@ function main() {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Aplica o ratchet (direction:down) sobre a contagem medida vs o baseline.
|
||||
* Sem --ratchet: advisory (exit 0). Com --ratchet: exit 1 numa regressão real
|
||||
* (medida > baseline). Baseline ausente → SKIP gracioso (exit 0).
|
||||
*
|
||||
* @param {number} count - Contagem MEDIDA de breaking changes (medição bem-sucedida).
|
||||
*/
|
||||
function applyRatchet(count) {
|
||||
if (!RATCHET) {
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
const baselineValue = readBaselineOpenapiValue(BASELINE_PATH);
|
||||
const { regressed, skipped } = evaluateOpenapiRatchet({
|
||||
current: count,
|
||||
baseline: baselineValue,
|
||||
});
|
||||
|
||||
if (skipped) {
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
"[openapi-breaking] baseline ausente (metrics.openapiBreaking) — SKIP gracioso, sai 0.\n"
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
if (regressed) {
|
||||
process.stderr.write(
|
||||
`[openapi-breaking] REGRESSÃO — ${count} breaking change(s) > baseline ${baselineValue}\n` +
|
||||
" → Ajuste a spec para não quebrar clientes existentes. Se a quebra é intencional\n" +
|
||||
" (major bump), re-baseline metrics.openapiBreaking em\n" +
|
||||
" config/quality/quality-baseline.json com justificativa + issue de tracking.\n"
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
`[openapi-breaking] OK — sem regressão (${count} breaking change(s), baseline ${baselineValue}).\n`
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
}
|
||||
|
||||
if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();
|
||||
|
||||
@@ -66,7 +66,9 @@ export function evaluateDeletedFiles(deletedPaths) {
|
||||
const flags = [];
|
||||
for (const f of deletedPaths) {
|
||||
if (TEST_RE.test(f)) {
|
||||
flags.push(`${f}: arquivo de teste deletado — revisão humana obrigatória (mascaramento alto-sinal)`);
|
||||
flags.push(
|
||||
`${f}: arquivo de teste deletado — revisão humana obrigatória (mascaramento alto-sinal)`
|
||||
);
|
||||
}
|
||||
}
|
||||
return flags;
|
||||
@@ -83,7 +85,7 @@ export function evaluateDeletedFiles(deletedPaths) {
|
||||
* Os campos de skip e extTaut são opcionais (default 0) para compatibilidade
|
||||
* com chamadas legadas que só passam baseAsserts/headAsserts/baseTaut/headTaut.
|
||||
*/
|
||||
export function evaluateMasking(perFile) {
|
||||
export function evaluateMasking(perFile, assertReductionAllowlist = new Set()) {
|
||||
const flags = [];
|
||||
for (const f of perFile) {
|
||||
const baseSkips = f.baseSkips ?? 0;
|
||||
@@ -91,14 +93,23 @@ export function evaluateMasking(perFile) {
|
||||
const baseExtTaut = f.baseExtTaut ?? 0;
|
||||
const headExtTaut = f.headExtTaut ?? 0;
|
||||
|
||||
if (f.headAsserts < f.baseAsserts)
|
||||
flags.push(`${f.file}: asserts ${f.baseAsserts} → ${f.headAsserts} (REMOÇÃO de ${f.baseAsserts - f.headAsserts} — enfraquecimento?)`);
|
||||
// The net-assert-REDUCTION signal can be allowlisted per file when the reduction is a
|
||||
// verified-legitimate refactor/field-removal (config/quality/test-masking-allowlist.json).
|
||||
// The tautology / skip / deletion signals below are NEVER allowlisted.
|
||||
if (f.headAsserts < f.baseAsserts && !assertReductionAllowlist.has(f.file))
|
||||
flags.push(
|
||||
`${f.file}: asserts ${f.baseAsserts} → ${f.headAsserts} (REMOÇÃO de ${f.baseAsserts - f.headAsserts} — enfraquecimento?)`
|
||||
);
|
||||
if (f.headTaut > f.baseTaut)
|
||||
flags.push(`${f.file}: nova(s) ${f.headTaut - f.baseTaut} tautologia(s) assert.ok(true)`);
|
||||
if (headSkips > baseSkips)
|
||||
flags.push(`${f.file}: ${headSkips - baseSkips} novo(s) .skip/.todo/.only (asserts silenciados sem remoção)`);
|
||||
flags.push(
|
||||
`${f.file}: ${headSkips - baseSkips} novo(s) .skip/.todo/.only (asserts silenciados sem remoção)`
|
||||
);
|
||||
if (headExtTaut > baseExtTaut)
|
||||
flags.push(`${f.file}: nova(s) ${headExtTaut - baseExtTaut} tautologia(s) estendida(s) (expect(true).toBe(true) / assert.equal(1,1))`);
|
||||
flags.push(
|
||||
`${f.file}: nova(s) ${headExtTaut - baseExtTaut} tautologia(s) estendida(s) (expect(true).toBe(true) / assert.equal(1,1))`
|
||||
);
|
||||
}
|
||||
return flags;
|
||||
}
|
||||
@@ -125,10 +136,7 @@ function main() {
|
||||
}
|
||||
|
||||
// (6A.10 subcheck 1) Arquivos de teste deletados/renomeados via MDR filter
|
||||
const deletedAndRenamed = git([
|
||||
"diff", "--name-only", "--diff-filter=DR", "-M",
|
||||
`${base}...HEAD`,
|
||||
])
|
||||
const deletedAndRenamed = git(["diff", "--name-only", "--diff-filter=DR", "-M", `${base}...HEAD`])
|
||||
.split("\n")
|
||||
.map((s) => s.trim())
|
||||
.filter(Boolean);
|
||||
@@ -158,7 +166,17 @@ function main() {
|
||||
});
|
||||
}
|
||||
|
||||
const maskingFlags = evaluateMasking(perFile);
|
||||
// Per-file allowlist for verified-legitimate net-assert reductions (refactor/field-removal).
|
||||
// Only exempts the reduction signal; tautology/skip/deletion signals still fire.
|
||||
let assertReductionAllowlist = new Set();
|
||||
try {
|
||||
const raw = JSON.parse(fs.readFileSync("config/quality/test-masking-allowlist.json", "utf8"));
|
||||
assertReductionAllowlist = new Set(Object.keys(raw).filter((k) => !k.startsWith("_")));
|
||||
} catch {
|
||||
// no allowlist file — treat as empty
|
||||
}
|
||||
|
||||
const maskingFlags = evaluateMasking(perFile, assertReductionAllowlist);
|
||||
const allFlags = [...deletedFlags, ...maskingFlags];
|
||||
|
||||
if (allFlags.length) {
|
||||
@@ -171,7 +189,7 @@ function main() {
|
||||
}
|
||||
console.log(
|
||||
`[test-masking] OK — ${changed.length} arquivo(s) de teste modificado(s), ` +
|
||||
`${deletedAndRenamed.length > 0 ? deletedAndRenamed.length + " deletado(s)/renomeado(s) OK" : "nenhum deletado"} — sem enfraquecimento`
|
||||
`${deletedAndRenamed.length > 0 ? deletedAndRenamed.length + " deletado(s)/renomeado(s) OK" : "nenhum deletado"} — sem enfraquecimento`
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -6,14 +6,28 @@
|
||||
// vulnCount=N — total de vulnerabilidades encontradas (todos os severities)
|
||||
// vulnCount=SKIP reason=binary-absent — osv-scanner não está no PATH
|
||||
//
|
||||
// Esta versão é ADVISORY (sai 0 sempre). O ratchet (direction:down) é gerenciado
|
||||
// pelo motor quality-baseline.json no CI (Task 7.2 INT).
|
||||
// Por default é ADVISORY (sai 0 sempre). Passe --ratchet para tornar BLOQUEANTE:
|
||||
// lê metrics.vulnCount.value de config/quality/quality-baseline.json, compara a
|
||||
// contagem MEDIDA e SAI 1 SE — E SOMENTE SE — a medida for MAIOR que o baseline
|
||||
// (regressão real, direction:down). Qualquer SKIP gracioso (binário ausente,
|
||||
// osv.dev/rede inacessível, erro de parse) SAI 0 mesmo com --ratchet — uma falha
|
||||
// de MEDIÇÃO nunca bloqueia, só uma regressão medida bloqueia.
|
||||
//
|
||||
// NB (variância de CVE): osv mede contra um banco de CVEs que cresce de forma
|
||||
// contínua. Um PR que NÃO toca dependências pode subitamente medir vulnCount >
|
||||
// baseline porque um novo CVE foi divulgado nas deps existentes — isso é o
|
||||
// comportamento ESPERADO de um gate de CVE bloqueante, não uma regressão de
|
||||
// produto. O remédio é (a) bumpar a dep afetada (preferível) ou, se não houver
|
||||
// fix, (b) re-baseline metrics.vulnCount com justificativa + issue de tracking.
|
||||
// Ver docs/security/SUPPLY_CHAIN.md → "Variância de CVE".
|
||||
//
|
||||
// Uso:
|
||||
// node scripts/check/check-vuln-ratchet.mjs
|
||||
// node scripts/check/check-vuln-ratchet.mjs --json # imprime JSON bruto do osv-scanner
|
||||
// node scripts/check/check-vuln-ratchet.mjs --quiet # suprime logs de diagnóstico
|
||||
// node scripts/check/check-vuln-ratchet.mjs --json # imprime JSON bruto do osv-scanner
|
||||
// node scripts/check/check-vuln-ratchet.mjs --quiet # suprime logs de diagnóstico
|
||||
// node scripts/check/check-vuln-ratchet.mjs --ratchet # falha (exit 1) numa regressão
|
||||
|
||||
import fs from "node:fs";
|
||||
import { execFileSync, spawnSync } from "node:child_process";
|
||||
import path from "node:path";
|
||||
import { pathToFileURL } from "node:url";
|
||||
@@ -21,6 +35,8 @@ import { pathToFileURL } from "node:url";
|
||||
const ROOT = process.cwd();
|
||||
const QUIET = process.argv.includes("--quiet");
|
||||
const PRINT_JSON = process.argv.includes("--json");
|
||||
const RATCHET = process.argv.includes("--ratchet");
|
||||
const BASELINE_PATH = path.join(ROOT, "config/quality/quality-baseline.json");
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Pure parsing function (exported for tests)
|
||||
@@ -113,6 +129,46 @@ export function extractSeverity(vuln) {
|
||||
return "UNKNOWN";
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Ratchet (direction:down) — exported for tests
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
* Avalia a contagem MEDIDA de vulnerabilidades contra o baseline.
|
||||
* Direction: down (a contagem só pode CAIR — mais vulns = regressão).
|
||||
*
|
||||
* @param {number} current - Contagem de vulnerabilidades medida agora.
|
||||
* @param {number} baseline - Contagem congelada em quality-baseline.json.
|
||||
* @returns {{ regressed: boolean, improved: boolean }}
|
||||
*/
|
||||
export function evaluateVulnRatchet(current, baseline) {
|
||||
return {
|
||||
regressed: current > baseline,
|
||||
improved: current < baseline,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Lê metrics.vulnCount.value do quality-baseline.json.
|
||||
* Retorna null se o arquivo ou a métrica estiverem ausentes (sem baseline não há
|
||||
* ratchet possível — o caller trata como SKIP gracioso, exit 0).
|
||||
*
|
||||
* @param {string} baselinePath
|
||||
* @returns {number|null}
|
||||
*/
|
||||
export function readBaselineVulnValue(baselinePath = BASELINE_PATH) {
|
||||
if (!fs.existsSync(baselinePath)) return null;
|
||||
let baselineJson;
|
||||
try {
|
||||
baselineJson = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
const metric = baselineJson?.metrics?.vulnCount;
|
||||
if (!metric || typeof metric.value !== "number") return null;
|
||||
return metric.value;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Binary detection
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -159,8 +215,13 @@ export function findOsvScanner() {
|
||||
* Executa o osv-scanner sobre o lockfile/diretório.
|
||||
* Usa execFileSync sem shell interpolation (Hard Rule #13).
|
||||
*
|
||||
* Em uma falha de MEDIÇÃO (osv-scanner não produziu JSON — rede/osv.dev
|
||||
* inacessível, timeout, JSON inválido) retorna { skip: true, reason } em vez de
|
||||
* abortar o processo: o caller traduz isso num SKIP gracioso (exit 0 mesmo com
|
||||
* --ratchet). Uma falha de medição NUNCA bloqueia; só uma regressão MEDIDA bloqueia.
|
||||
*
|
||||
* @param {string} osvBin - Caminho para o binário osv-scanner
|
||||
* @returns {object} JSON parseado do output
|
||||
* @returns {{ json: object } | { skip: true, reason: string }}
|
||||
*/
|
||||
function runOsvScanner(osvBin) {
|
||||
const args = [
|
||||
@@ -186,16 +247,16 @@ function runOsvScanner(osvBin) {
|
||||
stdout = err.stdout ? String(err.stdout) : "";
|
||||
if (!stdout.trim()) {
|
||||
process.stderr.write(`[vuln-ratchet] ERRO ao executar osv-scanner: ${err.message}\n`);
|
||||
process.exit(2);
|
||||
return { skip: true, reason: "osv-error" };
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
return JSON.parse(stdout);
|
||||
return { json: JSON.parse(stdout) };
|
||||
} catch (parseErr) {
|
||||
process.stderr.write(`[vuln-ratchet] ERRO ao parsear JSON do osv-scanner: ${parseErr.message}\n`);
|
||||
process.stderr.write(`[vuln-ratchet] stdout (primeiros 500 chars): ${stdout.slice(0, 500)}\n`);
|
||||
process.exit(2);
|
||||
return { skip: true, reason: "parse-error" };
|
||||
}
|
||||
}
|
||||
|
||||
@@ -208,19 +269,36 @@ function main() {
|
||||
|
||||
if (!osvBin) {
|
||||
// Skip gracioso: binário ausente — esperado em ambientes sem osv-scanner instalado.
|
||||
// SKIP sai 0 MESMO com --ratchet (binário ausente nunca bloqueia).
|
||||
console.log("vulnCount=SKIP reason=binary-absent");
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
"[vuln-ratchet] SKIP — osv-scanner não encontrado no PATH.\n" +
|
||||
"[vuln-ratchet] Instale via: https://google.github.io/osv-scanner/\n" +
|
||||
"[vuln-ratchet] ADVISORY — este gate sai 0 (ratchet entra no CI da Fase 7 INT).\n"
|
||||
"[vuln-ratchet] SKIP gracioso — sai 0 mesmo com --ratchet (binário ausente nunca bloqueia).\n"
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
const osvJson = runOsvScanner(osvBin);
|
||||
const osvResult = runOsvScanner(osvBin);
|
||||
|
||||
// Falha de MEDIÇÃO (rede/osv.dev inacessível, timeout, JSON inválido) → SKIP
|
||||
// gracioso, sai 0 mesmo com --ratchet (uma falha de medição nunca bloqueia).
|
||||
if (osvResult.skip) {
|
||||
console.log(`vulnCount=SKIP reason=${osvResult.reason}`);
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
`[vuln-ratchet] SKIP — osv-scanner não produziu uma medição (${osvResult.reason}).\n` +
|
||||
"[vuln-ratchet] SKIP gracioso — sai 0 mesmo com --ratchet (falha de medição nunca bloqueia).\n"
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
const osvJson = osvResult.json;
|
||||
|
||||
if (PRINT_JSON) {
|
||||
process.stdout.write(JSON.stringify(osvJson, null, 2) + "\n");
|
||||
@@ -239,12 +317,58 @@ function main() {
|
||||
process.stderr.write(
|
||||
`[vuln-ratchet] Total de vulnerabilidades: ${vulnCount} (${severitySummary})\n`
|
||||
);
|
||||
process.stderr.write(
|
||||
"[vuln-ratchet] ADVISORY — esta versão não falha pela contagem (ratchet entra no CI).\n"
|
||||
);
|
||||
}
|
||||
|
||||
// Sai 0 sempre nesta versão (advisory)
|
||||
// Medição bem-sucedida → aplica o ratchet (bloqueante só com --ratchet).
|
||||
applyRatchet(vulnCount);
|
||||
}
|
||||
|
||||
/**
|
||||
* Aplica o ratchet (direction:down) sobre a contagem medida vs o baseline.
|
||||
* Sem --ratchet: advisory (exit 0). Com --ratchet: exit 1 numa regressão real
|
||||
* (medida > baseline). Baseline ausente → SKIP gracioso (exit 0).
|
||||
*
|
||||
* @param {number} vulnCount - Contagem MEDIDA (medição bem-sucedida).
|
||||
*/
|
||||
function applyRatchet(vulnCount) {
|
||||
if (!RATCHET) {
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
"[vuln-ratchet] ADVISORY — não falha pela contagem (passe --ratchet para bloquear regressão).\n"
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
const baselineValue = readBaselineVulnValue(BASELINE_PATH);
|
||||
if (baselineValue === null) {
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
"[vuln-ratchet] baseline ausente (metrics.vulnCount) — SKIP gracioso, sai 0.\n"
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
const { regressed } = evaluateVulnRatchet(vulnCount, baselineValue);
|
||||
if (regressed) {
|
||||
process.stderr.write(
|
||||
`[vuln-ratchet] REGRESSÃO — ${vulnCount} vulnerabilidades > baseline ${baselineValue}\n` +
|
||||
" → Bumpe a(s) dep(s) afetada(s) (preferível). Se não houver fix, re-baseline\n" +
|
||||
" metrics.vulnCount em config/quality/quality-baseline.json com justificativa\n" +
|
||||
" + issue de tracking. Ver docs/security/SUPPLY_CHAIN.md → 'Variância de CVE'.\n"
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
if (!QUIET) {
|
||||
process.stderr.write(
|
||||
`[vuln-ratchet] OK — sem regressão (${vulnCount} vulns, baseline ${baselineValue}).\n`
|
||||
);
|
||||
}
|
||||
process.exitCode = 0;
|
||||
}
|
||||
|
||||
|
||||
82
scripts/dev/http-method-guard.cjs
Normal file
82
scripts/dev/http-method-guard.cjs
Normal file
@@ -0,0 +1,82 @@
|
||||
"use strict";
|
||||
|
||||
const http = require("node:http");
|
||||
|
||||
const HIGH_RISK_METHOD_RULES = [
|
||||
[/^\/api\/auth\/login\/?$/, ["POST"]],
|
||||
[/^\/api\/auth\/logout\/?$/, ["POST"]],
|
||||
[/^\/api\/keys\/?$/, ["GET", "POST"]],
|
||||
[/^\/api\/keys\/[^/]+\/?$/, ["GET", "PATCH", "DELETE"]],
|
||||
];
|
||||
|
||||
let installed = false;
|
||||
|
||||
function getPathname(req) {
|
||||
const rawUrl = typeof req?.url === "string" && req.url ? req.url : "/";
|
||||
try {
|
||||
return new URL(rawUrl, "http://localhost").pathname;
|
||||
} catch {
|
||||
return rawUrl.split("?")[0] || "/";
|
||||
}
|
||||
}
|
||||
|
||||
function getAllowedMethods(pathname) {
|
||||
for (const [pattern, methods] of HIGH_RISK_METHOD_RULES) {
|
||||
if (pattern.test(pathname)) return methods;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function getAllowHeader(pathname) {
|
||||
const methods = getAllowedMethods(pathname);
|
||||
return methods ? methods.join(", ") : null;
|
||||
}
|
||||
|
||||
function maybeHandleDisallowedMethod(req, res) {
|
||||
const method = typeof req?.method === "string" ? req.method.toUpperCase() : "";
|
||||
const pathname = getPathname(req);
|
||||
const methods = getAllowedMethods(pathname);
|
||||
if (!methods || method === "OPTIONS" || methods.includes(method)) return false;
|
||||
|
||||
res.statusCode = 405;
|
||||
res.setHeader("Allow", methods.join(", "));
|
||||
res.setHeader("Cache-Control", "no-store");
|
||||
res.setHeader("Content-Type", "application/json; charset=utf-8");
|
||||
res.end(
|
||||
JSON.stringify({
|
||||
error: {
|
||||
code: "METHOD_NOT_ALLOWED",
|
||||
message: `${method || "Method"} is not allowed`,
|
||||
},
|
||||
})
|
||||
);
|
||||
return true;
|
||||
}
|
||||
|
||||
function wrapRequestListenerWithMethodGuard(listener) {
|
||||
return function methodGuardRequestHandler(req, res) {
|
||||
if (maybeHandleDisallowedMethod(req, res)) return;
|
||||
return listener.call(this, req, res);
|
||||
};
|
||||
}
|
||||
|
||||
function installHttpMethodGuard() {
|
||||
if (installed) return;
|
||||
installed = true;
|
||||
|
||||
const originalCreateServer = http.createServer.bind(http);
|
||||
http.createServer = function createServerWithMethodGuard(...args) {
|
||||
const lastFnIdx = args.map((arg) => typeof arg === "function").lastIndexOf(true);
|
||||
if (lastFnIdx >= 0) {
|
||||
args[lastFnIdx] = wrapRequestListenerWithMethodGuard(args[lastFnIdx]);
|
||||
}
|
||||
return originalCreateServer(...args);
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
getAllowHeader,
|
||||
maybeHandleDisallowedMethod,
|
||||
wrapRequestListenerWithMethodGuard,
|
||||
installHttpMethodGuard,
|
||||
};
|
||||
@@ -9,9 +9,12 @@ import { resolveRuntimePorts, withRuntimePortEnv } from "../build/runtime-env.mj
|
||||
import { createOmnirouteWsBridge } from "./v1-ws-bridge.mjs";
|
||||
import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
|
||||
import { ensurePeerStampToken, stampPeerIp } from "./peer-stamp.mjs";
|
||||
import methodGuard from "./http-method-guard.cjs";
|
||||
import { ensureNativeSqlite } from "./ensure-native-sqlite.mjs";
|
||||
import { randomUUID } from "node:crypto";
|
||||
|
||||
const { maybeHandleDisallowedMethod } = methodGuard;
|
||||
|
||||
// Pre-read DATA_DIR from local .env before bootstrap resolves paths
|
||||
if (!process.env.DATA_DIR) {
|
||||
try {
|
||||
@@ -83,6 +86,7 @@ async function start() {
|
||||
});
|
||||
|
||||
const server = http.createServer((req, res) => {
|
||||
if (maybeHandleDisallowedMethod(req, res)) return;
|
||||
// Stamp the real TCP peer IP before Next sees the request, so the authz
|
||||
// middleware can decide LOCAL_ONLY locality without trusting the Host header.
|
||||
stampPeerIp(req);
|
||||
|
||||
@@ -3,9 +3,11 @@ import { randomUUID } from "node:crypto";
|
||||
import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
|
||||
import { ensurePeerStampToken, wrapRequestListenerWithPeerStamp } from "./peer-stamp.mjs";
|
||||
import { maybeHandleWebdav } from "./webdav-handler.mjs";
|
||||
import methodGuard from "./http-method-guard.cjs";
|
||||
|
||||
const originalCreateServer = http.createServer.bind(http);
|
||||
const proxiesByPort = new Map();
|
||||
const { wrapRequestListenerWithMethodGuard } = methodGuard;
|
||||
|
||||
process.env.OMNIROUTE_WS_BRIDGE_SECRET ||= randomUUID();
|
||||
// Per-process secret proving the trusted peer-IP stamp came from this server.
|
||||
@@ -71,9 +73,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
|
||||
// createServer; wrap it so the real TCP peer IP is stamped before Next runs.
|
||||
const lastFnIdx = args.map((a) => typeof a === "function").lastIndexOf(true);
|
||||
if (lastFnIdx >= 0) {
|
||||
// WebDAV intercept wraps outermost (first to run), then peer-stamp, then Next.
|
||||
args[lastFnIdx] = wrapRequestListenerWithWebdav(
|
||||
wrapRequestListenerWithPeerStamp(args[lastFnIdx])
|
||||
// Method guard runs before Next because Next 16 rejects TRACE while constructing requests.
|
||||
args[lastFnIdx] = wrapRequestListenerWithMethodGuard(
|
||||
wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(args[lastFnIdx]))
|
||||
);
|
||||
}
|
||||
|
||||
@@ -89,7 +91,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
|
||||
if (eventName === "request" && typeof listener === "function") {
|
||||
return originalOn(
|
||||
eventName,
|
||||
wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
|
||||
wrapRequestListenerWithMethodGuard(
|
||||
wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
|
||||
)
|
||||
);
|
||||
}
|
||||
return originalOn(eventName, listener);
|
||||
@@ -102,7 +106,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
|
||||
if (eventName === "request" && typeof listener === "function") {
|
||||
return originalAddListener(
|
||||
eventName,
|
||||
wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
|
||||
wrapRequestListenerWithMethodGuard(
|
||||
wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
|
||||
)
|
||||
);
|
||||
}
|
||||
return originalAddListener(eventName, listener);
|
||||
|
||||
79
scripts/quality/build-test-impact-map.mjs
Normal file
79
scripts/quality/build-test-impact-map.mjs
Normal file
@@ -0,0 +1,79 @@
|
||||
import fs from "node:fs";
|
||||
import path from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { globSync } from "tinyglobby";
|
||||
|
||||
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
||||
const SRC_ROOTS = ["src", "open-sse"];
|
||||
const IMPORT_RE =
|
||||
/(?:import|export)[^'"]*from\s*['"]([^'"]+)['"]|require\(\s*['"]([^'"]+)['"]\s*\)|import\(\s*['"]([^'"]+)['"]\s*\)/g;
|
||||
const EXTS = [".ts", ".tsx", ".mts", ".js", ".mjs"];
|
||||
|
||||
function resolveImport(spec, fromFile) {
|
||||
let base;
|
||||
if (spec.startsWith("@/")) base = path.join(ROOT, "src", spec.slice(2));
|
||||
else if (spec.startsWith("@omniroute/open-sse"))
|
||||
base = path.join(ROOT, "open-sse", spec.replace(/^@omniroute\/open-sse\/?/, ""));
|
||||
else if (spec.startsWith(".")) base = path.resolve(path.dirname(fromFile), spec);
|
||||
else return null;
|
||||
for (const e of EXTS) {
|
||||
if (fs.existsSync(base + e)) return base + e;
|
||||
}
|
||||
for (const e of EXTS) {
|
||||
const idx = path.join(base, "index" + e);
|
||||
if (fs.existsSync(idx)) return idx;
|
||||
}
|
||||
return fs.existsSync(base) && fs.statSync(base).isFile() ? base : null;
|
||||
}
|
||||
|
||||
function sourceDepsOf(entry) {
|
||||
const seen = new Set();
|
||||
const stack = [entry];
|
||||
const sources = new Set();
|
||||
while (stack.length) {
|
||||
const f = stack.pop();
|
||||
if (seen.has(f)) continue;
|
||||
seen.add(f);
|
||||
let code;
|
||||
try {
|
||||
code = fs.readFileSync(f, "utf8");
|
||||
} catch {
|
||||
continue;
|
||||
}
|
||||
for (const m of code.matchAll(IMPORT_RE)) {
|
||||
const spec = m[1] || m[2] || m[3];
|
||||
if (!spec) continue;
|
||||
const r = resolveImport(spec, f);
|
||||
if (!r) continue;
|
||||
const rel = path.relative(ROOT, r);
|
||||
if (SRC_ROOTS.some((s) => rel.startsWith(s + path.sep))) sources.add(rel);
|
||||
stack.push(r);
|
||||
}
|
||||
}
|
||||
return sources;
|
||||
}
|
||||
|
||||
// Mirror EXACTLY the `npm run test:unit` glob — the curated set of node:test files.
|
||||
// The TIA step runs the selected subset via `node --test`, so it must NOT include
|
||||
// vitest files (`.test.tsx`, `open-sse/**/__tests__`, `tests/unit/autoCombo`), nor
|
||||
// e2e/integration tests, which can't run under node:test (they 99-false-failed before).
|
||||
const testFiles = globSync(
|
||||
[
|
||||
"tests/unit/*.test.ts",
|
||||
"tests/unit/{api,auth,authz,build,cli,cli-helper,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
|
||||
],
|
||||
{ cwd: ROOT, absolute: true }
|
||||
);
|
||||
const map = {};
|
||||
for (const tf of testFiles) {
|
||||
const relTest = path.relative(ROOT, tf);
|
||||
for (const src of sourceDepsOf(tf)) {
|
||||
(map[src] ||= []).push(relTest);
|
||||
}
|
||||
}
|
||||
for (const k of Object.keys(map)) map[k].sort();
|
||||
const out = path.join(ROOT, "config/quality/test-impact-map.json");
|
||||
fs.writeFileSync(out, JSON.stringify({ generatedFrom: "import-graph", sources: map }, null, 2) + "\n");
|
||||
console.log(
|
||||
`test-impact-map: ${Object.keys(map).length} source files mapped from ${testFiles.length} test files`
|
||||
);
|
||||
62
scripts/quality/select-impacted-tests.mjs
Normal file
62
scripts/quality/select-impacted-tests.mjs
Normal file
@@ -0,0 +1,62 @@
|
||||
import fs from "node:fs";
|
||||
import path from "node:path";
|
||||
import { execFileSync } from "node:child_process";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
||||
const HUB_RE = /(setupPolyfill|tsconfig|package\.json|package-lock\.json|\.env|vitest\.config|stryker\.conf)/;
|
||||
// A changed file counts as a "run-it" test ONLY if it is a node:test unit file the TIA
|
||||
// step can actually run via `node --test` — i.e. it mirrors the `npm run test:unit` glob.
|
||||
// This EXCLUDES vitest files (`.test.tsx`, `tests/unit/autoCombo/**`), e2e and integration
|
||||
// tests, and `src/**/__tests__`/`open-sse/**/__tests__`, which can't run under node:test.
|
||||
const UNIT_SUBDIRS =
|
||||
"api|auth|authz|build|cli|cli-helper|compression|correctness|cors|dashboard|db|db-adapters|docs|gamification|guardrails|lib|mcp|runtime|security|services|settings|shared|ui";
|
||||
const TEST_RE = new RegExp(`^tests/unit/([^/]+\\.test\\.ts$|(${UNIT_SUBDIRS})/.*\\.test\\.ts$)`);
|
||||
|
||||
export function selectImpacted({ changed, map }) {
|
||||
const out = new Set();
|
||||
for (const f of changed) {
|
||||
if (HUB_RE.test(f)) return ["__RUN_ALL__"];
|
||||
if (TEST_RE.test(f)) {
|
||||
out.add(f);
|
||||
continue;
|
||||
}
|
||||
const isSource =
|
||||
f.startsWith("src/") ||
|
||||
f.startsWith("open-sse/") ||
|
||||
f.startsWith("electron/") ||
|
||||
f.startsWith("bin/");
|
||||
if (!isSource) continue;
|
||||
const hits = map.sources[f];
|
||||
if (!hits) return ["__RUN_ALL__"];
|
||||
hits.forEach((t) => out.add(t));
|
||||
}
|
||||
return [...out].sort();
|
||||
}
|
||||
|
||||
function changedFiles() {
|
||||
const baseRef = process.env.GITHUB_BASE_REF;
|
||||
const baseTarget = process.env.GITHUB_BASE_SHA || (baseRef ? `origin/${baseRef}` : "HEAD~1");
|
||||
const stdout = execFileSync(
|
||||
"git",
|
||||
["diff", "--name-only", "--diff-filter=ACMR", `${baseTarget}...HEAD`],
|
||||
{ cwd: ROOT, encoding: "utf8" }
|
||||
);
|
||||
return stdout
|
||||
.split("\n")
|
||||
.map((s) => s.trim())
|
||||
.filter(Boolean);
|
||||
}
|
||||
|
||||
if (import.meta.url === `file://${process.argv[1]}`) {
|
||||
const mapPath = path.join(ROOT, "config/quality/test-impact-map.json");
|
||||
let map;
|
||||
try {
|
||||
map = JSON.parse(fs.readFileSync(mapPath, "utf8"));
|
||||
} catch {
|
||||
console.log("__RUN_ALL__");
|
||||
process.exit(0);
|
||||
}
|
||||
const sel = selectImpacted({ changed: changedFiles(), map });
|
||||
process.stdout.write(sel.join("\n") + "\n");
|
||||
}
|
||||
@@ -4,15 +4,17 @@
|
||||
* This script starts the live dashboard WebSocket server as a separate
|
||||
* process alongside the Next.js app. Run it with:
|
||||
*
|
||||
* node scripts/start-ws-server.js
|
||||
*
|
||||
* Or use the built-in auto-start in src/server/ws/liveServer.ts.
|
||||
* node scripts/start-ws-server.mjs
|
||||
*
|
||||
* Environment variables:
|
||||
* LIVE_WS_PORT — WebSocket server port (default: 20129)
|
||||
* LIVE_WS_HOST — WebSocket server host (default: 127.0.0.1)
|
||||
* OMNIROUTE_DISABLE_LIVE_WS — Set to "1" or "true" to disable
|
||||
*/
|
||||
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
if (
|
||||
process.env.OMNIROUTE_DISABLE_LIVE_WS === "1" ||
|
||||
process.env.OMNIROUTE_DISABLE_LIVE_WS === "true"
|
||||
@@ -21,23 +23,39 @@ if (
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
// Register tsx to handle TypeScript imports
|
||||
import { register } from "node:module";
|
||||
import { pathToFileURL } from "node:url";
|
||||
const BOOTSTRAPPED_ENV = "OMNIROUTE_LIVE_WS_BOOTSTRAPPED";
|
||||
|
||||
register("tsx", pathToFileURL("./"));
|
||||
if (process.env[BOOTSTRAPPED_ENV] !== "1") {
|
||||
const result = spawnSync(process.execPath, ["--import", "tsx", fileURLToPath(import.meta.url)], {
|
||||
stdio: "inherit",
|
||||
env: {
|
||||
...process.env,
|
||||
[BOOTSTRAPPED_ENV]: "1",
|
||||
// Prevent liveServer.ts from auto-starting on import; this script owns
|
||||
// process startup so errors propagate to the supervisor/CLI caller.
|
||||
OMNIROUTE_ENABLE_LIVE_WS: "0",
|
||||
},
|
||||
});
|
||||
|
||||
const { startLiveDashboardServer } = await import("../src/server/ws/liveServer");
|
||||
if (result.signal) {
|
||||
process.kill(process.pid, result.signal);
|
||||
}
|
||||
|
||||
process.exit(result.status ?? 1);
|
||||
}
|
||||
|
||||
const { startLiveDashboardServer } = await import("../src/server/ws/liveServer.ts");
|
||||
|
||||
const port = parseInt(process.env.LIVE_WS_PORT || "20129", 10);
|
||||
const host = process.env.LIVE_WS_HOST || "127.0.0.1";
|
||||
|
||||
console.log(`[LiveWS] Starting dashboard WebSocket server on port ${port}...`);
|
||||
console.log(`[LiveWS] Starting dashboard WebSocket server on ${host}:${port}...`);
|
||||
|
||||
startLiveDashboardServer(port)
|
||||
.then((server) => {
|
||||
console.log(`[LiveWS] Dashboard WebSocket server listening on ws://0.0.0.0:${port}`);
|
||||
console.log(`[LiveWS] Connect via: ws://localhost:${port}?token=<api-key>`);
|
||||
console.log(`[LiveWS] Channels: requests, combo, credentials`);
|
||||
startLiveDashboardServer(port, host)
|
||||
.then(() => {
|
||||
console.log(`[LiveWS] Dashboard WebSocket server listening on ws://${host}:${port}`);
|
||||
console.log("[LiveWS] Connect via: ws://localhost:%d?token=<api-key>", port);
|
||||
console.log("[LiveWS] Channels: requests, combo, credentials");
|
||||
})
|
||||
.catch((err) => {
|
||||
console.error("[LiveWS] Failed to start:", err);
|
||||
|
||||
Reference in New Issue
Block a user