Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,706 Commits 1 Branch 1 Tag
main
Commit Graph
11 Commits
Author SHA1 Message Date
chengyongruandXubin Ren b3d3a3e6c3 fix(image): delegate DNS to explicit proxy 2026-07-27 10:06:19 +08:00
Xubin Ren cc3dbbe804 fix(security): block IPv6 unspecified SSRF targets 2026-07-27 10:06:19 +08:00
Xubin RenandGitHub fe0717b385 feat(webui): add guided setup flows 
* feat(channels): add guided setup flows

* test(channels): preserve setup config values

* fix(channels): reflect saved setup state

* refactor(channels): simplify setup state metadata

* fix(channels): harden setup lifecycle

* refactor(channels): centralize setup contracts

* fix(channels): route setup actions through webui shim

* fix(channels): adapt settings for compact screens

* fix(models): preserve default preset display

* feat(models): add curated Codex catalog

* fix(webui): stop attached gateway on interrupt

* fix(webui): simplify apps catalog

* docs(webui): clarify apps and runtime features

* feat(settings): add guided capability setup

* fix(webui): harden setup and managed services

* test: keep managed runtime checks portable

* test: scope POSIX runtime coverage

* fix(webui): simplify file settings

* feat(files): bundle document reading

* fix(webui): harden setup request boundaries

* fix(webui): prevent channel setup status squeeze

* fix(settings): group provider compatibility aliases

* refactor(settings): remove redundant setup surfaces

* fix(webui): harden guided setup lifecycle

* fix(webui): preserve channel setup compatibility
 2026-07-13 13:11:46 +08:00
chengyongruandXubin Ren c5e053f83b fix: pin validated DNS for SSRF-safe fetches 
maintainer edit: keep MCP HTTP SSRF checks strict, pin validated DNS for direct web_fetch and HTTP/SSE MCP requests, preserve explicit and environment proxy compatibility, and cover the proxy/redirect/rebinding cases with tests.
 2026-07-07 15:40:53 +08:00
hamb1yandXubin Ren 73bf299a59 fix: pin validated dns for ssrf checks 2026-07-07 15:40:53 +08:00
chengyongruandXubin Ren 64901be67f test: harden webui and gateway checks 2026-06-27 11:04:11 +08:00
chengyongruandXubin Ren 288146315e fix(security): normalize IPv6-mapped IPv4 in loopback check, add tests 
- Apply _normalize_addr in _is_allowed_loopback_target so
  ::ffff:127.0.0.1 is correctly identified as loopback
- Add test for contains_internal_url with IPv6-mapped addresses
- Add test for whitelist + IPv6-mapped CGNAT interaction
 2026-05-30 15:34:49 +08:00
yorkhellenandXubin Ren 13dec9d2c2 fix(security): normalize IPv6-mapped IPv4 addresses in SSRF checks 
::ffff:127.0.0.1 and ::ffff:169.254.169.254 are IPv6Address objects
that match neither the IPv4 blocklists (127.0.0.0/8, 169.254.0.0/16)
nor the IPv6 ones (::1/128), allowing SSRF bypass via DNS responses
that return IPv6-mapped IPv4 addresses.

Add _normalize_addr() to convert ipv4_mapped IPv6 addresses to their
IPv4 form before blocklist/allowlist matching.
 2026-05-30 15:34:49 +08:00
Xubin RenandGitHub 3a420136bb feat(webui): add project workspaces and access controls (#4007) 
* feat(webui): add project workspaces and access controls

* feat(webui): add project workspaces and access controls

* refactor(tools): centralize workspace access resolution

* refactor(webui): remove unused workspace host state

* fix(webui): hide estimated file edit label

* fix(webui): clarify file edit deletion feedback

* fix(webui): label deleted file activity

* fix(webui): flatten file edit activity rows

* fix(core): remove path-only patch deletion

* fix(core): keep apply patch non-destructive

* refactor(webui): trim workspace host plumbing

* fix(tools): register exec with tools config
 2026-05-29 03:42:53 +08:00
04cbandXubin Ren 5f08d61d8f fix(security): add ssrfWhitelist config to unblock Tailscale/CGNAT (#2669) 2026-04-04 19:43:18 +08:00
chengyongruandXubin Ren 72acba5d27 refactor(tests): optimize unit test structure 2026-03-24 15:12:22 +08:00