mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-06 15:22:12 +03:00
b9d18dd8c4
* fix(skills): gate skill-collector CLI detection behind management auth + loopback PR #6294 fork-main bundled genuinely new skill-collector CLI-detection routes (GET /api/skills/collect/detect, POST /api/skills/collect/install) on top of content already shipped via #6186. This reconstructs the PR against the current release tip, keeping only the new detect/install routes and their SKILL.md, and drops the 3 already-merged commits so two post-merge quality fixes on /api/github-skills (Zod validation + sanitizeErrorMessage) are not reverted. - GET /api/skills/collect/detect spawned a child process per CLI_TOOL_IDS entry via getCliRuntimeStatus(), unauthenticated and reachable over any tunnel. All 3 routes (github-skills GET/POST, skills/collect/detect, skills/collect/install) now require requireManagementAuth(), matching every sibling /api/skills/* route. - Classified /api/skills/collect/ in LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES (routeGuard.ts / spawnCapablePrefixes.ts) and added src/app/api/skills/collect to SPAWN_CAPABLE_ROUTE_ROOTS in check-route-guard-membership.ts so the automated gate actually scans it (Hard Rules #15 + #17). - omniroute_github_skills_install MCP tool now reports the honest action: "planned" instead of "installed", matching the REST route. - Dropped docker-compose.drive-d.yml, start.sh, and the unrelated @types/node/settings.ts changes (personal dev-machine / out-of-scope). - Added route-level tests for all 3 routes + the 3 MCP tools (auth-required and no-stack-trace-leak assertions) and a route-guard regression test. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(quality): register new routeGuard covering test in stryker.conf.json check:mutation-test-coverage --strict (Fast Quality Gates) flagged tests/unit/authz/route-guard-skills-collect.test.ts as a covering unit test for src/server/authz/routeGuard.ts that was missing from tap.testFiles, so its mutant kills would silently not count toward the mutation-test baseline. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore: resync CHANGELOG after merging release/v3.8.47 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Moseyuh333 <Moseyuh333@users.noreply.github.com>
37 lines
2.6 KiB
TypeScript
37 lines
2.6 KiB
TypeScript
/**
|
|
* Compile-time deny-list: route prefixes whose handlers can spawn arbitrary local
|
|
* subprocesses (npm install, node, MITM server, python CLIs) on behalf of the
|
|
* caller. These MUST NEVER appear in the manage-scope bypass list — regardless of
|
|
* DB state — because reaching them from non-loopback would re-introduce the
|
|
* GHSA-fhh6-4qxv-rpqj surface that the LOCAL_ONLY tier exists to close.
|
|
*
|
|
* Enforced at two layers:
|
|
* 1. zod schema (`settingsSchemas.ts`): rejects `PATCH /api/settings` with error
|
|
* code `BYPASS_PREFIX_NOT_ALLOWED` if any entry in
|
|
* `localOnlyManageScopeBypassPrefixes` falls inside this set.
|
|
* 2. runtime (`isLocalOnlyBypassableByManageScope` in `routeGuard.ts`): even if a
|
|
* malformed DB row claims a spawn-capable path is bypassable, the policy refuses.
|
|
*
|
|
* 🔒 This constant lives in `@/shared/constants` — a server-free leaf module — and
|
|
* NOT in `@/server/authz/routeGuard`, on purpose. `settingsSchemas.ts` is reachable
|
|
* from client components (dashboard onboarding wizard → validation barrel), and
|
|
* importing it from `routeGuard.ts` dragged routeGuard's server runtime
|
|
* (runtimeSettings → localDb → apiKeys → rateLimiter → ioredis) into the browser
|
|
* bundle, breaking the Next CLI/client webpack build with
|
|
* `Module not found: Can't resolve 'dns'/'net'`. Keeping the value here lets both the
|
|
* client-safe schema and the server routeGuard import it with no server coupling.
|
|
* Regression guard: `tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts`.
|
|
* Hard Rules #15 + #17.
|
|
*/
|
|
export const SPAWN_CAPABLE_PREFIXES: ReadonlyArray<string> = [
|
|
"/api/cli-tools/runtime/",
|
|
"/api/services/", // T-10: can run npm install + spawn node processes
|
|
"/api/tools/agent-bridge/", // start/stop MITM server + DNS edits (Hard Rules #15 + #17)
|
|
"/api/tools/traffic-inspector/", // http-proxy listener + system proxy (Hard Rules #15 + #17)
|
|
"/api/plugins/", // plugins: load/execute via worker_threads + child_process (Hard Rules #15 + #17)
|
|
"/api/local/", // T-12: 1-click local service launchers (Redis today) — must never be whitelistable via manage-scope bypass (Hard Rules #15 + #17)
|
|
"/api/skills/collect/", // Skill Collector CLI detection: GET .../detect spawns a child process per CLI_TOOL_IDS entry — must never be whitelistable via manage-scope bypass (Hard Rules #15 + #17, PR #6294 review)
|
|
"/api/headroom/start", // spawns headroom-ai python CLI — must never be bypassable (Hard Rules #15 + #17)
|
|
"/api/headroom/stop", // kills tracked PID — must never be bypassable (Hard Rules #15 + #17)
|
|
];
|