OmniRoute

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-17 20:32:25 +03:00

Files

diegosouzapw 7b322d410b fix(security): generate a random per-install CLI token salt (#13679 )

Both src/lib/machineToken.ts::getActiveSalt() and its mirror in
bin/cli/utils/cliToken.mjs derived the CLI/management bearer token as
HMAC-SHA256(raw machine-id, salt) with a checked-in literal default salt
("omniroute-cli-auth-v1"). Since /etc/machine-id is commonly world-readable,
any local user who never set OMNIROUTE_CLI_SALT could derive the same
bearer token as the server.

getActiveSalt() now generates a random 64-char-hex salt on first use and
persists it under <DATA_DIR>/cli-token-salt.json (falling back to the
literal only when neither the env override nor a persisted/writable salt
can be established). Both implementations use the same resolution order
and the same wx-flag create-race handling so the CLI and server keep
deriving the same token. OMNIROUTE_CLI_SALT stays the explicit operator
override, unchanged.

Regression test: tests/unit/machine-token-random-salt-13679.test.ts

2026-09-16 14:02:45 -03:00

AGENTROUTER_WAF.md

fix(resilience): recover idle-capacity limiter wedges early (#9041 )

2026-08-11 04:30:29 -03:00

BAN_DETECTION.md

fix(providers): retire common ChatGPT Web provider (#11754 )

2026-08-28 06:52:46 -03:00

CLI_TOKEN.md

fix(security): generate a random per-install CLI token salt (#13679 )

2026-09-16 14:02:45 -03:00

COMPLIANCE.md

chore(startup): remove server-init.ts, a module nothing imports (#10780 )