mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-24 16:12:23 +03:00

Files

Markus Hartung 0f4a92718c fix(security): harden codex app-server transport (#11205 post-merge review)

Two findings from the automated push security review on #11205:

1. HIGH (Agent/Subprocess Permission Bypass): approvalPolicy "never" +
   sandbox "danger-full-access" defaults, plus blanket auto-APPROVE of every
   server->client approval prompt, meant codex-decided host commands ran with
   no gate at all. Now: sandbox defaults to "workspace-write" (override via
   providerSpecificData.codexAppServerSandbox / OMNIROUTE_CODEX_APPSERVER_SANDBOX),
   and approval prompts — which gate codex's OWN command/file/permission
   execution, NOT the harness tool passthrough (item/tool/call) — are
   auto-DENIED unless the operator opts in via
   providerSpecificData.codexAppServerAutoApprove /
   OMNIROUTE_CODEX_APPSERVER_AUTO_APPROVE.

2. MEDIUM (SSRF / credential exfiltration): the /readyz health probe sent the
   bearer token to whatever URL a connection's providerSpecificData supplied
   and followed redirects. Now: env-sourced tokens only pair with env-sourced
   URLs or operator-local hosts (loopback/RFC1918/link-local/ULA/localhost/
   single-label LAN names/*.local/*.ts.net/*.internal — literal match, no DNS),
   enforced inside resolveAppServerConfig so executor, gating and health probe
   all inherit it; and the probe uses redirect:"manual".

TDD: 4 failing-then-passing tests (deny-by-default, workspace-write default,
env-token→remote-psd-URL refusal incl. no-network assertion, redirect pinning)
plus 6 new passing cases (local-host matrix, psd-token pairing, env/env
pairing, opt-in approve). 30/30 in tests/unit/codex-app-server.test.ts.
Also rebaselines two file-size entries that drifted on the release tip during
the 2026-08-23 merge wave (annotated; verified pristine-tip).

2026-08-23 16:02:31 -03:00

features

feat(models): surface learned reasoning_effort sets in catalog, variants, and dispatch (#11252 )

2026-08-23 14:38:57 -03:00

fixes

fix(security): harden codex app-server transport (#11205 post-merge review)

2026-08-23 16:02:31 -03:00

maintenance

feat(lint): add no-unused-vars ratchet scoped to src+open-sse+tests (#11247 )

2026-08-23 14:26:43 -03:00

README.md

feat(release): changelog.d/ fragments — eliminate the CHANGELOG merge-storm cascade (#6783 )

2026-07-10 07:22:49 -03:00

README.md

changelog.d/ — changelog fragments

A PR never edits CHANGELOG.md directly during the cycle. Instead it adds ONE new file here — its changelog entry as a fragment. Two PRs never touch the same file, so changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full CI re-run after every sibling merge) are structurally impossible.

Convention

Directory	Aggregates under
`features/`	`### ✨ New Features`
`fixes/`	`### 🐛 Bug Fixes`
`maintenance/`	`### 📝 Maintenance`

Filename: <PR-number>-<short-slug>.md (e.g. fixes/6700-dockerfile-better-sqlite3.md). The PR number prefix keeps aggregation order deterministic.
Content: the exact bullet line(s) that should land in CHANGELOG.md, starting with - . Multi-line (continuation) bullets are fine. Keep the repo's credit format: (#PR — thanks @user).
One fragment per PR (rarely more, e.g. a PR that both fixes and adds).

Example

changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md:

- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen

Aggregation

The release captain (or /generate-release) folds all fragments into CHANGELOG.md and deletes them:

node scripts/release/aggregate-changelog.mjs            # write + delete fragments
node scripts/release/aggregate-changelog.mjs --dry-run  # preview only

Fragment well-formedness is enforced by npm run check:changelog-integrity (the same gate that guards against CHANGELOG-eat for legacy direct edits).