OmniRoute

pjandro/OmniRoute

Fork 0

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-06 07:12:12 +03:00

Commit Graph

Author	SHA1	Message	Date
diegosouzapw	592ca9b5c4	fix: remove hardcoded localhost default arg from GET /api/keys, unify coverage to single coverage/ dir, fix test to pass explicit Request - Remove `new Request('http://localhost/api/keys')` default arg from GET handler in src/app/api/keys/route.ts (line 26) - Fix api-key-reveal-route.test.mjs to pass explicit Request instead of calling GET() with no args - Add --output-dir coverage to all c8 scripts in package.json - Add coverage.reportsDirectory: 'coverage' to vitest.config.ts and vitest.mcp.config.ts - Fix CHANGELOG.md structure (# Changelog + [Unreleased] to top) - Remove 30+ stale coverage-* directories from project root - Coverage: Statements 78.76% \| Branches 72.75% \| Functions 80.93% \| Lines 78.76% (all thresholds passed)	2026-04-05 23:21:08 -03:00
diegosouzapw	d624ddde03	fix(electron): code review hardening — 16 fixes for security, performance, robustness ## Critical Fixes - #1: Server readiness — waitForServer() polls before loading window - #2: Restart timeout — 5s + SIGKILL prevents IPC handler from hanging - #3: changePort — now stops/restarts server on new port ## Important Fixes - #4: Tray cleanup — destroy old Tray before recreating - #5: IPC emission — server-status & port-changed events - #6: Disposer pattern — replaces removeAllListeners - #7: useSyncExternalStore — eliminates 5x re-renders ## Minor: #8-#16 (dead code, CSP, platform titlebar, types, errors, version) Tests: 76 / 15 suites (was 64/9)	2026-02-28 08:15:04 -03:00
diegosouzapw	d3ace8d611	fix: security hardening, tests, docs for Electron desktop & memory optimization ## Security Fixes - Sanitize OMNIROUTE_MEMORY_MB with parseInt + range validation (64-16384) to prevent command injection via spawn() args - Validate URL protocol in shell.openExternal (http/https only) to prevent RCE in Electron renderer compromise - Bump default memory from 256MB to 512MB ## Electron package-lock.json - Added to .gitignore (5278 lines removed from tracking) ## Test Suite (64 tests, 9 suites) - electron-main.test.mjs: URL validation, IPC channels, window handler - electron-preload.test.mjs: channel whitelist, API surface, open-external - cli-memory.test.mjs: injection prevention, boundary values, .env parsing ## Documentation - Desktop App section added to all 30 READMEs (9 fully translated) - USER_GUIDE.md updated with 512MB default - .env.example reflects new defaults	2026-02-28 07:59:38 -03:00

Author

SHA1

Message

Date

diegosouzapw

592ca9b5c4

fix: remove hardcoded localhost default arg from GET /api/keys, unify coverage to single coverage/ dir, fix test to pass explicit Request

- Remove `new Request('http://localhost/api/keys')` default arg from GET handler in src/app/api/keys/route.ts (line 26)
- Fix api-key-reveal-route.test.mjs to pass explicit Request instead of calling GET() with no args
- Add --output-dir coverage to all c8 scripts in package.json
- Add coverage.reportsDirectory: 'coverage' to vitest.config.ts and vitest.mcp.config.ts
- Fix CHANGELOG.md structure (# Changelog + [Unreleased] to top)
- Remove 30+ stale coverage-* directories from project root
- Coverage: Statements 78.76% | Branches 72.75% | Functions 80.93% | Lines 78.76% (all thresholds passed)

2026-04-05 23:21:08 -03:00

diegosouzapw

d624ddde03

fix(electron): code review hardening — 16 fixes for security, performance, robustness

## Critical Fixes
- #1: Server readiness — waitForServer() polls before loading window
- #2: Restart timeout — 5s + SIGKILL prevents IPC handler from hanging
- #3: changePort — now stops/restarts server on new port

## Important Fixes
- #4: Tray cleanup — destroy old Tray before recreating
- #5: IPC emission — server-status & port-changed events
- #6: Disposer pattern — replaces removeAllListeners
- #7: useSyncExternalStore — eliminates 5x re-renders

## Minor: #8-#16 (dead code, CSP, platform titlebar, types, errors, version)

Tests: 76 / 15 suites (was 64/9)

2026-02-28 08:15:04 -03:00

diegosouzapw

d3ace8d611

fix: security hardening, tests, docs for Electron desktop & memory optimization

## Security Fixes
- Sanitize OMNIROUTE_MEMORY_MB with parseInt + range validation (64-16384)
  to prevent command injection via spawn() args
- Validate URL protocol in shell.openExternal (http/https only)
  to prevent RCE in Electron renderer compromise
- Bump default memory from 256MB to 512MB

## Electron package-lock.json
- Added to .gitignore (5278 lines removed from tracking)

## Test Suite (64 tests, 9 suites)
- electron-main.test.mjs: URL validation, IPC channels, window handler
- electron-preload.test.mjs: channel whitelist, API surface, open-external
- cli-memory.test.mjs: injection prevention, boundary values, .env parsing

## Documentation
- Desktop App section added to all 30 READMEs (9 fully translated)
- USER_GUIDE.md updated with 512MB default
- .env.example reflects new defaults

2026-02-28 07:59:38 -03:00

3 Commits