mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-12 18:50:46 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
110 lines
3.4 KiB
JavaScript
110 lines
3.4 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* SEC-24: verify npm pack file list before publish.
|
|
* Usage: node scripts/pack-check.mjs
|
|
*/
|
|
import { execSync } from 'node:child_process'
|
|
import { readFileSync, existsSync } from 'node:fs'
|
|
import { join, dirname } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { createHash } from 'node:crypto'
|
|
|
|
const root = join(dirname(fileURLToPath(import.meta.url)), '..')
|
|
const forbidden = [
|
|
/(?:^|\/)node_modules\//,
|
|
/(?:^|\/)__pycache__\//,
|
|
/\.pyc$/,
|
|
/(?:^|\/)skill-credentials\.json$/,
|
|
/(?:^|\/)session-bridge\.json$/,
|
|
/(?:^|\/)session-owners\.json/,
|
|
/(?:^|\/)user-workspaces\.json$/,
|
|
/(?:^|\/)roles\.json$/,
|
|
/(?:^|\/)config\.runtime\.json$/,
|
|
/\.uds-auth-secret-key$/,
|
|
/\.tgz$/,
|
|
]
|
|
|
|
const required = [
|
|
'package.json',
|
|
'LICENSE',
|
|
'lib/index.js',
|
|
'lib/qrcode-bundled.cjs',
|
|
'scripts/seal-local-admin.mjs',
|
|
'skills/uds-skill-auth/scripts/uds_skill_auth.py',
|
|
'skill-helpers/python/uds_skill_auth.py',
|
|
'README.md',
|
|
'README.zh.md',
|
|
'docs/sbom.cdx.json',
|
|
'docs/THIRD-PARTY-NOTICES.txt',
|
|
'docs/upgrade-0.3.10.zh.md',
|
|
'docs/upgrade-0.3.11.zh.md',
|
|
'lib/desktop-bootstrap.js',
|
|
]
|
|
|
|
function listPackFiles() {
|
|
// --ignore-scripts avoids prepack (bun bundle) polluting stdout / requiring bun.
|
|
const raw = execSync('npm pack --dry-run --json --ignore-scripts', {
|
|
cwd: root,
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
env: { ...process.env, npm_config_loglevel: 'error' },
|
|
})
|
|
|
|
const start = raw.indexOf('[')
|
|
const end = raw.lastIndexOf(']')
|
|
if (start < 0 || end <= start) {
|
|
throw new Error('npm pack --json produced no array')
|
|
}
|
|
const parsed = JSON.parse(raw.slice(start, end + 1))
|
|
const entry = Array.isArray(parsed) ? parsed[0] : parsed
|
|
return (entry?.files || []).map((f) => String(f.path || f).replace(/\\/g, '/'))
|
|
}
|
|
|
|
const files = listPackFiles()
|
|
let failed = false
|
|
|
|
if (!files.length) {
|
|
console.error('[pack-check] empty pack file list')
|
|
process.exit(1)
|
|
}
|
|
|
|
for (const f of files) {
|
|
for (const re of forbidden) {
|
|
if (re.test(f)) {
|
|
console.error('[pack-check] FORBIDDEN in package:', f)
|
|
failed = true
|
|
}
|
|
}
|
|
}
|
|
for (const need of required) {
|
|
const norm = need.replace(/\\/g, '/')
|
|
const ok = files.some((f) => f === norm || f.endsWith('/' + norm))
|
|
if (!ok && !existsSync(join(root, need))) {
|
|
console.error('[pack-check] MISSING required path on disk:', need)
|
|
failed = true
|
|
} else if (!ok) {
|
|
console.error('[pack-check] MISSING from pack list:', need)
|
|
failed = true
|
|
}
|
|
}
|
|
|
|
const a = readFileSync(join(root, 'skills/uds-skill-auth/scripts/uds_skill_auth.py'), 'utf8')
|
|
const b = readFileSync(join(root, 'skill-helpers/python/uds_skill_auth.py'), 'utf8')
|
|
if (a !== b) {
|
|
console.error('[pack-check] Python helpers diverged')
|
|
failed = true
|
|
}
|
|
|
|
const sbom = JSON.parse(readFileSync(join(root, 'docs/sbom.cdx.json'), 'utf8'))
|
|
const metadata = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
|
|
const bundleHash = createHash('sha256').update(readFileSync(join(root, 'lib/qrcode-bundled.cjs'))).digest('hex')
|
|
if (sbom.metadata?.component?.version !== metadata.version
|
|
|| !sbom.metadata?.properties?.some(p => p.name === 'uds-auth:bundle-sha256' && p.value === bundleHash)) {
|
|
console.error('[pack-check] SBOM version/bundle hash differs; rebuild bundle and SBOM')
|
|
failed = true
|
|
}
|
|
|
|
if (failed) {
|
|
process.exit(1)
|
|
}
|
|
console.log('[pack-check] OK —', files.length, 'files')
|