OmniRoute

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-24 08:02:14 +03:00

Files

Xiangzhe ac206e9375 feat(cli): boot exposure warning for unauthenticated LAN bind (GHSA-wmgv-ph3p-rv57)

The shipped default (bind 0.0.0.0 + no API-key requirement) is a deliberate,
documented local-first posture — but an operator on an untrusted network
should learn that at startup, not after a surprise quota bill. serve now
prints a loud warning naming both escape hatches (REQUIRE_API_KEY=true or
OMNIROUTE_SERVER_HOST=127.0.0.1) whenever the resolved bind is non-loopback
and no key is required. Silent on loopback binds and when REQUIRE_API_KEY is
enabled. The default posture itself is unchanged (operator decision).

2026-08-23 12:50:42 -03:00

clipboard.mjs

feat(cli): fase 8.1/8.6/8.14 — spinner, open, clipboard e environment helpers

2026-05-15 03:00:52 -03:00

cliToken.mjs

fix(cli): restore packaged machine-token authentication (#10468 )

2026-08-20 15:07:19 -03:00

config-home-guard.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057 )

2026-08-16 00:42:14 -03:00

ensureAndroidCacheDir.mjs

fix(cli): scoping android instrumentation-hook diagnosis to real platform signal (#10028 ) (#11068 )