diegosouzapw
|
0efaf1cca7
|
fix(security): post-review hardening batch — command injection, CSP, auth gaps, error sanitization, resilience
- plugin.mjs: replace execSync string-template with spawnSync arg-array (command injection)
- electron/main.js: gate unsafe-eval on !app.isPackaged instead of URL substring; merge duplicate connect-src
- budget/bulk, resilience/reset: add requireManagementAuth guard
- gemini-web, claude-web, copilot-web executors: route catch-block messages through sanitizeErrorMessage
- oauth route, agents/tasks routes: route catch-block errors through sanitizeErrorMessage
- codex.ts: return null (not error-object) from refreshCredentials on failure
- tokenRefresh.ts: safe unknown-error access in catch block
- combo.ts: reset exhaustedProviders per set-retry iteration so providers get a second chance
- circuitBreaker.ts: persist and restore lastFailureKind via options JSON column
|
2026-05-20 11:11:13 -03:00 |
|
diegosouzapw
|
b3e5ee3333
|
feat(cli): fase 9.4 — plugin system (omniroute-cmd-*)
Adds plugin discovery, loading, and management to the omniroute CLI.
- bin/cli/plugins.mjs: discoverPlugins / loadPlugins / buildPluginContext
- bin/cli/commands/plugin.mjs: list / install / remove / info / search / update / scaffold
- examples/omniroute-cmd-hello/: minimal working plugin example
- docs/dev/plugins.md: plugin API contract and authoring guide
- .env.example + ENVIRONMENT.md: document OMNIROUTE_PLUGIN_PATH
|
2026-05-15 05:11:18 -03:00 |
|