Files
OmniRoute/tests/unit
Diego Rodrigues de Sa e Souza a47ce51d4c fix(api): classify /api/acp/agents as loopback-only (#7948) (#7966)
* fix(api): classify /api/acp/agents as loopback-only (#7948)

/api/acp/agents is spawn-capable (POST registers a client-chosen `binary`
via src/lib/acp/registry.ts; GET / POST {action:"refresh"} runs
detectInstalledAgents() -> execFileSync(probe.command, probe.args, { shell })
transitively) but was never added to LOCAL_ONLY_API_PREFIXES in
src/server/authz/routeGuard.ts, unlike every sibling spawn-capable route
(Hard Rules #15/#17). A leaked JWT via tunnel could reach the version-probe
execFileSync path.

Adds the prefix to the loopback gate plus a direct regression test
(tests/unit/route-guard-acp-agents-local-only.test.ts) and an assertion in
tests/unit/check-route-guard-membership.test.ts documenting why the existing
source-scan subcheck cannot catch this class of gap (the spawn call is
transitive via registry.ts, not in the route file itself).

* chore(quality): register route-guard-acp-agents-local-only test in stryker tap.testFiles
2026-07-21 09:03:31 -03:00
..
2026-07-02 10:47:13 -03:00
2026-06-30 06:54:29 -03:00
2026-06-17 19:26:32 -03:00
2026-07-13 09:12:40 -03:00
2026-06-09 22:57:12 -03:00
2026-06-30 06:54:29 -03:00
2026-07-02 10:47:13 -03:00
2026-06-29 08:40:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-25 13:17:40 -03:00
2026-06-29 16:51:03 -03:00
2026-07-13 09:12:40 -03:00
2026-05-23 01:46:59 -03:00
2026-06-28 06:58:29 -03:00
2026-06-27 09:07:12 -03:00
2026-07-07 13:14:06 -03:00
2026-05-29 12:44:29 -03:00
2026-06-12 23:49:22 -03:00
2026-06-11 04:01:24 -03:00
2026-06-23 17:06:18 -03:00
2026-06-13 17:27:40 -03:00
2026-07-13 09:12:40 -03:00
2026-06-19 06:49:01 -03:00
2026-07-13 09:12:40 -03:00
2026-07-04 13:00:30 -03:00
2026-07-02 10:47:13 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 16:51:03 -03:00
2026-05-29 12:44:29 -03:00
2026-06-27 09:07:12 -03:00
2026-07-13 09:12:40 -03:00
2026-05-24 18:05:58 -03:00
2026-06-17 19:26:32 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-06-22 03:17:02 -03:00
2026-06-29 08:40:06 -03:00
2026-07-13 09:12:40 -03:00
2026-06-13 17:27:40 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-29 08:40:06 -03:00
2026-06-21 08:56:51 -03:00
2026-05-26 23:51:47 -03:00
2026-06-21 08:56:51 -03:00
2026-06-23 03:08:29 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 08:40:06 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-10 00:55:06 -03:00
2026-07-13 09:12:40 -03:00
2026-05-26 23:51:47 -03:00
2026-06-13 17:27:40 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-06-27 09:07:12 -03:00
2026-06-29 16:51:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-07-07 13:14:06 -03:00
2026-06-23 17:06:18 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-05-26 23:51:47 -03:00
2026-04-30 14:08:50 -03:00
2026-06-29 16:51:03 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-06-17 02:43:21 -03:00
2026-05-26 23:51:47 -03:00
2026-07-06 02:25:17 -03:00
2026-06-15 03:32:11 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-20 14:55:24 -03:00
2026-06-22 03:17:02 -03:00
2026-07-13 09:12:40 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-04 13:00:30 -03:00
2026-06-27 09:07:12 -03:00
2026-06-19 06:49:01 -03:00
2026-06-20 07:09:43 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-04-30 01:27:03 -03:00
2026-06-22 03:17:02 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-19 06:49:01 -03:00
2026-06-29 08:40:06 -03:00
2026-06-12 23:49:22 -03:00
2026-06-12 23:49:22 -03:00
2026-07-13 09:12:40 -03:00
2026-06-11 18:52:29 -03:00
2026-06-29 08:40:06 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-04-30 01:27:03 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 16:51:03 -03:00
2026-07-04 13:00:30 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-05-23 01:46:59 -03:00
2026-05-23 01:46:59 -03:00
2026-06-09 15:56:24 -03:00
2026-06-10 13:49:08 -03:00
2026-05-29 19:54:00 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-17 19:26:32 -03:00
2026-06-13 17:27:40 -03:00
2026-06-17 02:43:21 -03:00
2026-07-07 13:14:06 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-05-24 18:05:58 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 08:40:06 -03:00
2026-04-28 20:46:25 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-05-29 12:44:29 -03:00
2026-06-19 06:49:01 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-06-23 03:08:29 -03:00
2026-05-26 23:51:47 -03:00
2026-06-30 06:54:29 -03:00
2026-06-12 23:49:22 -03:00
2026-07-04 13:00:30 -03:00
2026-07-02 10:47:13 -03:00
2026-05-26 23:51:47 -03:00
2026-06-16 01:00:40 -03:00
2026-05-26 23:51:47 -03:00
2026-06-29 08:40:06 -03:00
2026-06-04 20:05:38 -03:00
2026-06-29 08:40:06 -03:00
2026-06-12 23:49:22 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-05-29 12:44:29 -03:00
2026-07-07 13:14:06 -03:00
2026-06-20 07:09:43 -03:00
2026-06-19 06:49:01 -03:00
2026-06-07 07:20:02 -03:00
2026-06-11 04:01:24 -03:00
2026-06-29 08:40:06 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-06-12 23:49:22 -03:00
2026-06-16 01:00:40 -03:00
2026-06-12 23:49:22 -03:00
2026-06-27 09:07:12 -03:00
2026-07-07 13:14:06 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00