airlock-bot 0.2.34 → 0.2.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -0
- package/dist/allowlist/engine.d.ts.map +1 -1
- package/dist/allowlist/engine.js +10 -3
- package/dist/allowlist/engine.js.map +1 -1
- package/dist/audit/api.d.ts +2 -0
- package/dist/audit/api.d.ts.map +1 -1
- package/dist/audit/api.js +3 -13
- package/dist/audit/api.js.map +1 -1
- package/dist/config/loader.d.ts.map +1 -1
- package/dist/config/loader.js +40 -0
- package/dist/config/loader.js.map +1 -1
- package/dist/config/mutator.d.ts +17 -0
- package/dist/config/mutator.d.ts.map +1 -0
- package/dist/config/mutator.js +66 -0
- package/dist/config/mutator.js.map +1 -0
- package/dist/config/schema.d.ts +168 -14
- package/dist/config/schema.d.ts.map +1 -1
- package/dist/config/schema.js +12 -0
- package/dist/config/schema.js.map +1 -1
- package/dist/configure-web/cli.d.ts +57 -3
- package/dist/configure-web/cli.d.ts.map +1 -1
- package/dist/configure-web/cli.js +1225 -37
- package/dist/configure-web/cli.js.map +1 -1
- package/dist/gateway.d.ts +8 -1
- package/dist/gateway.d.ts.map +1 -1
- package/dist/gateway.js +83 -24
- package/dist/gateway.js.map +1 -1
- package/dist/hitl/api.d.ts +2 -0
- package/dist/hitl/api.d.ts.map +1 -1
- package/dist/hitl/api.js +3 -13
- package/dist/hitl/api.js.map +1 -1
- package/dist/hitl/approval-dashboard.d.ts +19 -0
- package/dist/hitl/approval-dashboard.d.ts.map +1 -0
- package/dist/hitl/approval-dashboard.js +148 -0
- package/dist/hitl/approval-dashboard.js.map +1 -0
- package/dist/hitl/provider-factory.d.ts +3 -1
- package/dist/hitl/provider-factory.d.ts.map +1 -1
- package/dist/hitl/provider-factory.js +5 -5
- package/dist/hitl/provider-factory.js.map +1 -1
- package/dist/hitl/providers/dashboard.d.ts +5 -5
- package/dist/hitl/providers/dashboard.d.ts.map +1 -1
- package/dist/hitl/providers/dashboard.js +29 -416
- package/dist/hitl/providers/dashboard.js.map +1 -1
- package/dist/hook/api.d.ts +2 -0
- package/dist/hook/api.d.ts.map +1 -1
- package/dist/hook/api.js +3 -13
- package/dist/hook/api.js.map +1 -1
- package/dist/index.js +40 -4
- package/dist/index.js.map +1 -1
- package/dist/security/request.d.ts +14 -0
- package/dist/security/request.d.ts.map +1 -0
- package/dist/security/request.js +47 -0
- package/dist/security/request.js.map +1 -0
- package/dist/tools/api.d.ts +2 -0
- package/dist/tools/api.d.ts.map +1 -1
- package/dist/tools/api.js +3 -13
- package/dist/tools/api.js.map +1 -1
- package/dist/transport/http-server.d.ts +2 -0
- package/dist/transport/http-server.d.ts.map +1 -1
- package/dist/transport/http-server.js +9 -22
- package/dist/transport/http-server.js.map +1 -1
- package/dist/transport/sse-server.d.ts +2 -0
- package/dist/transport/sse-server.d.ts.map +1 -1
- package/dist/transport/sse-server.js +9 -26
- package/dist/transport/sse-server.js.map +1 -1
- package/examples/docker-compose.yaml +63 -0
- package/examples/docker-gateway.yaml +61 -0
- package/examples/gateway.yaml +7 -0
- package/package.json +1 -1
- package/schema.json +54 -0
package/dist/index.js
CHANGED
|
@@ -6,7 +6,7 @@ import { Gateway } from './gateway.js';
|
|
|
6
6
|
import { runStdioMode } from './stdio-mode.js';
|
|
7
7
|
import { runDiscover } from './discover/cli.js';
|
|
8
8
|
import { runConfigureAgent } from './configure-agent/cli.js';
|
|
9
|
-
import { runConfigureWeb } from './configure-web/cli.js';
|
|
9
|
+
import { runCommandCenter, runConfigureWeb, runDashboard } from './configure-web/cli.js';
|
|
10
10
|
import { runConfigureCli } from './configure-cli/cli.js';
|
|
11
11
|
import { runSetupOpenclaw } from './setup-openclaw/cli.js';
|
|
12
12
|
import { logger } from './util/logger.js';
|
|
@@ -30,6 +30,24 @@ else if (subcommand === 'configure-web') {
|
|
|
30
30
|
process.exit(1);
|
|
31
31
|
});
|
|
32
32
|
}
|
|
33
|
+
else if (subcommand === 'run') {
|
|
34
|
+
runCommandCenter(process.argv.slice(3)).catch((err) => {
|
|
35
|
+
console.error(err instanceof Error ? err.message : String(err));
|
|
36
|
+
process.exit(1);
|
|
37
|
+
});
|
|
38
|
+
}
|
|
39
|
+
else if (subcommand === 'dashboard') {
|
|
40
|
+
runDashboard(process.argv.slice(3)).catch((err) => {
|
|
41
|
+
console.error(err instanceof Error ? err.message : String(err));
|
|
42
|
+
process.exit(1);
|
|
43
|
+
});
|
|
44
|
+
}
|
|
45
|
+
else if (subcommand === 'gateway') {
|
|
46
|
+
runGateway(process.argv.slice(3), { runtimeOnly: true });
|
|
47
|
+
}
|
|
48
|
+
else if (subcommand === 'serve') {
|
|
49
|
+
runGateway(process.argv.slice(3));
|
|
50
|
+
}
|
|
33
51
|
else if (subcommand === 'configure-cli') {
|
|
34
52
|
runConfigureCli(process.argv.slice(3)).catch((err) => {
|
|
35
53
|
console.error(err instanceof Error ? err.message : String(err));
|
|
@@ -46,10 +64,11 @@ else if (subcommand === 'setup' && process.argv[3] === 'openclaw') {
|
|
|
46
64
|
}
|
|
47
65
|
}
|
|
48
66
|
else {
|
|
49
|
-
runGateway();
|
|
67
|
+
runGateway(process.argv.slice(2));
|
|
50
68
|
}
|
|
51
|
-
function runGateway() {
|
|
69
|
+
function runGateway(argv, options = {}) {
|
|
52
70
|
const { values } = parseArgs({
|
|
71
|
+
args: argv,
|
|
53
72
|
options: {
|
|
54
73
|
config: { type: 'string', short: 'c', default: './airlock.yaml' },
|
|
55
74
|
agent: { type: 'string', short: 'a' },
|
|
@@ -64,7 +83,11 @@ airlock — permissions-aware MCP gateway
|
|
|
64
83
|
|
|
65
84
|
Usage:
|
|
66
85
|
airlock [options]
|
|
86
|
+
airlock gateway [options]
|
|
87
|
+
airlock dashboard [options]
|
|
88
|
+
airlock serve [options]
|
|
67
89
|
airlock discover <cli|api> [options]
|
|
90
|
+
airlock run [options]
|
|
68
91
|
airlock configure-cli <tool> [options]
|
|
69
92
|
airlock configure-agent [options]
|
|
70
93
|
airlock configure-web [options]
|
|
@@ -77,6 +100,10 @@ Options:
|
|
|
77
100
|
-h, --help Show this help message
|
|
78
101
|
|
|
79
102
|
Subcommands:
|
|
103
|
+
run Browser command center for provider health and permissions
|
|
104
|
+
gateway MCP/runtime gateway only; disables in-process dashboard provider
|
|
105
|
+
dashboard Standalone admin dashboard for a remote gateway
|
|
106
|
+
serve Combined gateway mode (same behavior as airlock [options])
|
|
80
107
|
discover cli <tool> Auto-discover CLI commands from --help or Fig specs
|
|
81
108
|
discover api <spec> Auto-discover API endpoints from an OpenAPI spec
|
|
82
109
|
configure-cli <tool> Interactive TUI to select and configure CLI commands
|
|
@@ -88,12 +115,21 @@ Examples:
|
|
|
88
115
|
# Start full gateway server
|
|
89
116
|
airlock --config /etc/airlock/gateway.yaml
|
|
90
117
|
|
|
118
|
+
# Start runtime-only gateway for split deployments
|
|
119
|
+
airlock gateway --config /etc/airlock/gateway.yaml
|
|
120
|
+
|
|
121
|
+
# Start standalone admin dashboard for split deployments
|
|
122
|
+
airlock dashboard --config /etc/airlock/gateway.yaml --gateway-url http://gateway:4111
|
|
123
|
+
|
|
91
124
|
# Connect as a specific agent via stdio (for Claude Code, Cursor, etc.)
|
|
92
125
|
airlock --agent helena
|
|
93
126
|
|
|
94
127
|
# Install the OpenClaw bridge plugin (one command)
|
|
95
128
|
airlock setup openclaw
|
|
96
129
|
|
|
130
|
+
# Open the local Airlock command center
|
|
131
|
+
airlock run --config ./airlock.yaml
|
|
132
|
+
|
|
97
133
|
# Discover CLI tool commands
|
|
98
134
|
airlock discover cli git --output git-commands.yaml
|
|
99
135
|
|
|
@@ -119,7 +155,7 @@ Examples:
|
|
|
119
155
|
return;
|
|
120
156
|
}
|
|
121
157
|
// Full gateway mode
|
|
122
|
-
const gateway = new Gateway(config);
|
|
158
|
+
const gateway = new Gateway(config, configPath, { runtimeOnly: options.runtimeOnly });
|
|
123
159
|
const watcher = new ConfigWatcher(configPath);
|
|
124
160
|
watcher.on('reload', (newConfig) => {
|
|
125
161
|
gateway.reload(newConfig).catch((err) => {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,sCAAsC;AACtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;IAC5C,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACrD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;IAChC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACpD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;IACtC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAChD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IACpC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;KAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAClC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;KAAM,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,UAAU,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;IACpE,IAAI,CAAC;QACH,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;KAAM,CAAC;IACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,UAAqC,EAAE;IACzE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE;YACjE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;QACD,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Df,CAAC,CAAC;QACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtF,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YACjC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YACxC,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;YACpD,6DAA6D;YAC7D,gEAAgE;YAChE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC3B,wDAAwD;YACxD,sDAAsD;YACtD,0DAA0D;YAC1D,+CAA+C;YAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;YACvC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import type { FastifyReply, FastifyRequest } from 'fastify';
|
|
2
|
+
export interface RequestSecurityOptions {
|
|
3
|
+
secret?: string;
|
|
4
|
+
authRequired?: boolean;
|
|
5
|
+
allowedOrigins?: string[];
|
|
6
|
+
}
|
|
7
|
+
export declare function isOriginAllowed(origin: string | undefined, allowedOrigins?: string[]): boolean;
|
|
8
|
+
export declare function checkOrigin(request: FastifyRequest, reply: FastifyReply, allowedOrigins?: string[]): boolean;
|
|
9
|
+
export declare function checkBearerAuth(request: FastifyRequest, reply: FastifyReply, opts: {
|
|
10
|
+
secret?: string;
|
|
11
|
+
authRequired?: boolean;
|
|
12
|
+
}): boolean;
|
|
13
|
+
export declare function checkRequestSecurity(request: FastifyRequest, reply: FastifyReply, opts: RequestSecurityOptions): boolean;
|
|
14
|
+
//# sourceMappingURL=request.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,GAAE,MAAM,EAAO,GAAG,OAAO,CAIlG;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,cAAc,GAAE,MAAM,EAAO,GAC5B,OAAO,CAMT;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAaT;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAGT"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
import { timingSafeEqual } from 'crypto';
|
|
2
|
+
function constantTimeEqual(a, b) {
|
|
3
|
+
const bufA = Buffer.from(a);
|
|
4
|
+
const bufB = Buffer.from(b);
|
|
5
|
+
if (bufA.length !== bufB.length)
|
|
6
|
+
return false;
|
|
7
|
+
return timingSafeEqual(bufA, bufB);
|
|
8
|
+
}
|
|
9
|
+
function getHeader(value) {
|
|
10
|
+
return Array.isArray(value) ? (value[0] ?? '') : (value ?? '');
|
|
11
|
+
}
|
|
12
|
+
function normalizeOrigin(origin) {
|
|
13
|
+
return origin.endsWith('/') ? origin.slice(0, -1) : origin;
|
|
14
|
+
}
|
|
15
|
+
export function isOriginAllowed(origin, allowedOrigins = []) {
|
|
16
|
+
if (!origin)
|
|
17
|
+
return true;
|
|
18
|
+
const normalized = normalizeOrigin(origin);
|
|
19
|
+
return allowedOrigins.map(normalizeOrigin).includes(normalized);
|
|
20
|
+
}
|
|
21
|
+
export function checkOrigin(request, reply, allowedOrigins = []) {
|
|
22
|
+
const origin = getHeader(request.headers.origin);
|
|
23
|
+
if (isOriginAllowed(origin, allowedOrigins))
|
|
24
|
+
return true;
|
|
25
|
+
reply.status(403).send({ error: 'Origin not allowed' });
|
|
26
|
+
return false;
|
|
27
|
+
}
|
|
28
|
+
export function checkBearerAuth(request, reply, opts) {
|
|
29
|
+
if (!opts.secret) {
|
|
30
|
+
if (!opts.authRequired)
|
|
31
|
+
return true;
|
|
32
|
+
reply.status(401).send({ error: 'Unauthorized' });
|
|
33
|
+
return false;
|
|
34
|
+
}
|
|
35
|
+
const auth = getHeader(request.headers.authorization);
|
|
36
|
+
if (!constantTimeEqual(auth, `Bearer ${opts.secret}`)) {
|
|
37
|
+
reply.status(401).send({ error: 'Unauthorized' });
|
|
38
|
+
return false;
|
|
39
|
+
}
|
|
40
|
+
return true;
|
|
41
|
+
}
|
|
42
|
+
export function checkRequestSecurity(request, reply, opts) {
|
|
43
|
+
if (!checkOrigin(request, reply, opts.allowedOrigins))
|
|
44
|
+
return false;
|
|
45
|
+
return checkBearerAuth(request, reply, opts);
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=request.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AASzC,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,KAAoC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAA0B,EAAE,iBAA2B,EAAE;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAuB,EACvB,KAAmB,EACnB,iBAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAuB,EACvB,KAAmB,EACnB,IAAiD;IAEjD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAuB,EACvB,KAAmB,EACnB,IAA4B;IAE5B,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC"}
|
package/dist/tools/api.d.ts
CHANGED
|
@@ -3,6 +3,8 @@ import type { AgentServerDeps } from '../transport/agent-server.js';
|
|
|
3
3
|
export interface ToolsApiOpts {
|
|
4
4
|
getDeps: (agentId: string) => AgentServerDeps | undefined;
|
|
5
5
|
secret?: string;
|
|
6
|
+
authRequired?: boolean;
|
|
7
|
+
allowedOrigins?: string[];
|
|
6
8
|
}
|
|
7
9
|
export declare function toolsApiPlugin(app: FastifyInstance, opts: ToolsApiOpts): Promise<void>;
|
|
8
10
|
//# sourceMappingURL=api.d.ts.map
|
package/dist/tools/api.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/tools/api.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/tools/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AASpE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAGD,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG5F"}
|
package/dist/tools/api.js
CHANGED
|
@@ -1,24 +1,14 @@
|
|
|
1
|
-
import { timingSafeEqual } from 'crypto';
|
|
2
1
|
import { buildMiddlewareChain } from '../middleware/chain-builder.js';
|
|
3
2
|
import { generateId } from '../util/id.js';
|
|
4
3
|
import { childLogger } from '../util/logger.js';
|
|
4
|
+
import { checkRequestSecurity } from '../security/request.js';
|
|
5
5
|
const log = childLogger('tools-api');
|
|
6
|
-
function constantTimeEqual(a, b) {
|
|
7
|
-
const bufA = Buffer.from(a);
|
|
8
|
-
const bufB = Buffer.from(b);
|
|
9
|
-
if (bufA.length !== bufB.length)
|
|
10
|
-
return false;
|
|
11
|
-
return timingSafeEqual(bufA, bufB);
|
|
12
|
-
}
|
|
13
6
|
// eslint-disable-next-line @typescript-eslint/require-await
|
|
14
7
|
export async function toolsApiPlugin(app, opts) {
|
|
15
|
-
const { getDeps
|
|
8
|
+
const { getDeps } = opts;
|
|
16
9
|
app.addHook('preHandler', async (request, reply) => {
|
|
17
|
-
if (!
|
|
10
|
+
if (!checkRequestSecurity(request, reply, opts)) {
|
|
18
11
|
return;
|
|
19
|
-
const auth = request.headers.authorization ?? '';
|
|
20
|
-
if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
|
|
21
|
-
return reply.status(401).send({ error: 'Unauthorized' });
|
|
22
12
|
}
|
|
23
13
|
});
|
|
24
14
|
app.get('/agents/:agentId/tools', async (request, reply) => {
|
package/dist/tools/api.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/tools/api.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/tools/api.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;AASrC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB,EAAE,IAAkB;IAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEzB,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAA6B,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAA6B,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAqE,CAAC;QAE3F,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;QAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,SAAS,EAAE,CAAC;QAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;SAChF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAoB;YAC3B,MAAM,EAAE,UAAU,EAAE;YACpB,OAAO;YACP,WAAW;YACX,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,IAAI,EAAE,EAAE;YACR,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;aAChF;YACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YAE/C,6EAA6E;YAC7E,kFAAkF;YAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;YACtE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,IAAI,CAAC;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,kBAAkB;oBAC1C,QAAQ,EAAE,EAAE,WAAW,EAAE;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,QAAQ,EAAE,EAAE,WAAW,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -3,5 +3,7 @@ import type { AgentServerDeps } from './agent-server.js';
|
|
|
3
3
|
export declare function httpServerPlugin(app: FastifyInstance, opts: {
|
|
4
4
|
getDeps: (agentId: string) => AgentServerDeps | undefined;
|
|
5
5
|
secret?: string;
|
|
6
|
+
authRequired?: boolean;
|
|
7
|
+
allowedOrigins?: string[];
|
|
6
8
|
}): Promise<void>;
|
|
7
9
|
//# sourceMappingURL=http-server.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/transport/http-server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/transport/http-server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAOzD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IACJ,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GACA,OAAO,CAAC,IAAI,CAAC,CA0Ff"}
|
|
@@ -1,15 +1,9 @@
|
|
|
1
|
-
import { randomUUID
|
|
1
|
+
import { randomUUID } from 'crypto';
|
|
2
2
|
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
|
|
3
3
|
import { createAgentServer, connectAgentServer } from './agent-server.js';
|
|
4
4
|
import { childLogger } from '../util/logger.js';
|
|
5
|
+
import { checkBearerAuth, checkOrigin } from '../security/request.js';
|
|
5
6
|
const log = childLogger('http-server');
|
|
6
|
-
function constantTimeEqual(a, b) {
|
|
7
|
-
const bufA = Buffer.from(a);
|
|
8
|
-
const bufB = Buffer.from(b);
|
|
9
|
-
if (bufA.length !== bufB.length)
|
|
10
|
-
return false;
|
|
11
|
-
return timingSafeEqual(bufA, bufB);
|
|
12
|
-
}
|
|
13
7
|
// eslint-disable-next-line @typescript-eslint/require-await
|
|
14
8
|
export async function httpServerPlugin(app, opts) {
|
|
15
9
|
const { secret } = opts;
|
|
@@ -20,23 +14,16 @@ export async function httpServerPlugin(app, opts) {
|
|
|
20
14
|
done(null);
|
|
21
15
|
});
|
|
22
16
|
function checkAgentAuth(request, reply, deps) {
|
|
17
|
+
if (!checkOrigin(request, reply, opts.allowedOrigins))
|
|
18
|
+
return false;
|
|
23
19
|
const token = deps.agentConfig.token;
|
|
24
20
|
if (token) {
|
|
25
|
-
|
|
26
|
-
if (!constantTimeEqual(auth, `Bearer ${token}`)) {
|
|
27
|
-
reply.status(401).send({ error: 'Unauthorized' });
|
|
28
|
-
return false;
|
|
29
|
-
}
|
|
30
|
-
return true;
|
|
31
|
-
}
|
|
32
|
-
if (secret) {
|
|
33
|
-
const auth = request.headers.authorization ?? '';
|
|
34
|
-
if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
|
|
35
|
-
reply.status(401).send({ error: 'Unauthorized' });
|
|
36
|
-
return false;
|
|
37
|
-
}
|
|
21
|
+
return checkBearerAuth(request, reply, { secret: token, authRequired: true });
|
|
38
22
|
}
|
|
39
|
-
return
|
|
23
|
+
return checkBearerAuth(request, reply, {
|
|
24
|
+
secret,
|
|
25
|
+
authRequired: opts.authRequired,
|
|
26
|
+
});
|
|
40
27
|
}
|
|
41
28
|
async function handleMcpRequest(request, reply) {
|
|
42
29
|
const { profileId } = request.params;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/transport/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,
|
|
1
|
+
{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/transport/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEtE,MAAM,GAAG,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;AAEvC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,IAKC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IAEJ,mEAAmE;IACnE,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAClC,GAAG,CAAC,oBAAoB,CACtB,GAAG,EACH,CAAC,IAAoB,EAAE,QAAiB,EAAE,IAAyB,EAAE,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC,CACF,CAAC;IAEF,SAAS,cAAc,CACrB,OAAuB,EACvB,KAAmB,EACnB,IAAqB;QAErB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE;YACrC,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA+B,CAAC;QAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,SAAS,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAElD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAE1E,IAAI,SAAwC,CAAC;QAE7C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,+EAA+E;YAC/E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBACrE,CAAC;gBACD,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE;oBACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACpB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAChE,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACjE,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE5C,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;AACzD,CAAC"}
|
|
@@ -3,5 +3,7 @@ import type { AgentServerDeps } from './agent-server.js';
|
|
|
3
3
|
export declare function sseServerPlugin(app: FastifyInstance, opts: {
|
|
4
4
|
getDeps: (agentId: string) => AgentServerDeps | undefined;
|
|
5
5
|
secret?: string;
|
|
6
|
+
authRequired?: boolean;
|
|
7
|
+
allowedOrigins?: string[];
|
|
6
8
|
}): Promise<void>;
|
|
7
9
|
//# sourceMappingURL=sse-server.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sse-server.d.ts","sourceRoot":"","sources":["../../src/transport/sse-server.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"sse-server.d.ts","sourceRoot":"","sources":["../../src/transport/sse-server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAUzD,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IACJ,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GACA,OAAO,CAAC,IAAI,CAAC,CAmHf"}
|
|
@@ -1,17 +1,10 @@
|
|
|
1
|
-
import { timingSafeEqual } from 'crypto';
|
|
2
1
|
import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
|
|
3
2
|
import { createAgentServer, connectAgentServer } from './agent-server.js';
|
|
4
3
|
import { childLogger } from '../util/logger.js';
|
|
4
|
+
import { checkBearerAuth, checkOrigin, checkRequestSecurity } from '../security/request.js';
|
|
5
5
|
const log = childLogger('sse-server');
|
|
6
6
|
/** Interval between SSE keep-alive pings (ms). Keeps connections alive through NAT/firewalls. */
|
|
7
7
|
const PING_INTERVAL_MS = 30_000;
|
|
8
|
-
function constantTimeEqual(a, b) {
|
|
9
|
-
const bufA = Buffer.from(a);
|
|
10
|
-
const bufB = Buffer.from(b);
|
|
11
|
-
if (bufA.length !== bufB.length)
|
|
12
|
-
return false;
|
|
13
|
-
return timingSafeEqual(bufA, bufB);
|
|
14
|
-
}
|
|
15
8
|
// eslint-disable-next-line @typescript-eslint/require-await
|
|
16
9
|
export async function sseServerPlugin(app, opts) {
|
|
17
10
|
const { secret } = opts;
|
|
@@ -23,24 +16,17 @@ export async function sseServerPlugin(app, opts) {
|
|
|
23
16
|
done(null);
|
|
24
17
|
});
|
|
25
18
|
function checkAgentAuth(request, reply, deps) {
|
|
19
|
+
if (!checkOrigin(request, reply, opts.allowedOrigins))
|
|
20
|
+
return false;
|
|
26
21
|
const token = deps.agentConfig.token;
|
|
27
22
|
if (token) {
|
|
28
|
-
|
|
29
|
-
if (!constantTimeEqual(auth, `Bearer ${token}`)) {
|
|
30
|
-
reply.status(401).send({ error: 'Unauthorized' });
|
|
31
|
-
return false;
|
|
32
|
-
}
|
|
33
|
-
return true;
|
|
23
|
+
return checkBearerAuth(request, reply, { secret: token, authRequired: true });
|
|
34
24
|
}
|
|
35
25
|
// No per-agent token — fall back to global api_secret
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
return false;
|
|
41
|
-
}
|
|
42
|
-
}
|
|
43
|
-
return true;
|
|
26
|
+
return checkBearerAuth(request, reply, {
|
|
27
|
+
secret,
|
|
28
|
+
authRequired: opts.authRequired,
|
|
29
|
+
});
|
|
44
30
|
}
|
|
45
31
|
// Auth for non-agent endpoints (management API)
|
|
46
32
|
app.addHook('preHandler', async (request, reply) => {
|
|
@@ -48,11 +34,8 @@ export async function sseServerPlugin(app, opts) {
|
|
|
48
34
|
// Agent endpoints handle their own auth
|
|
49
35
|
if (url.startsWith('/agents/'))
|
|
50
36
|
return;
|
|
51
|
-
if (!
|
|
37
|
+
if (!checkRequestSecurity(request, reply, opts)) {
|
|
52
38
|
return;
|
|
53
|
-
const auth = request.headers.authorization ?? '';
|
|
54
|
-
if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
|
|
55
|
-
return reply.status(401).send({ error: 'Unauthorized' });
|
|
56
39
|
}
|
|
57
40
|
});
|
|
58
41
|
app.get('/agents/:profileId/sse', async (request, reply) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sse-server.js","sourceRoot":"","sources":["../../src/transport/sse-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"sse-server.js","sourceRoot":"","sources":["../../src/transport/sse-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;AAEtC,iGAAiG;AACjG,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,IAKC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgE,CAAC;IAEzF,sEAAsE;IACtE,8EAA8E;IAC9E,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAClC,GAAG,CAAC,oBAAoB,CACtB,GAAG,EACH,CAAC,IAAoB,EAAE,QAAiB,EAAE,IAAyB,EAAE,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC,CACF,CAAC;IAEF,SAAS,cAAc,CACrB,OAAuB,EACvB,KAAmB,EACnB,IAAqB;QAErB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sDAAsD;QACtD,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE;YACrC,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,wCAAwC;QACxC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvF,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA+B,CAAC;QAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,SAAS,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAElD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAE9C,0EAA0E;QAC1E,kEAAkE;QAClE,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1F,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5D,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE5C,kEAAkE;QAClE,8EAA8E;QAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,EAAE,CAAC;QAElB,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACzB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7F,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA+B,CAAC;QAC9D,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,KAA+B,CAAC;QAE9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAE3D,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
services:
|
|
2
|
+
airlock-gateway:
|
|
3
|
+
build:
|
|
4
|
+
context: ..
|
|
5
|
+
dockerfile: Dockerfile
|
|
6
|
+
image: airlock-bot:local
|
|
7
|
+
command: gateway --config /config/airlock.yaml
|
|
8
|
+
restart: unless-stopped
|
|
9
|
+
env_file:
|
|
10
|
+
- .env
|
|
11
|
+
environment:
|
|
12
|
+
AIRLOCK_CONFIG: /config/airlock.yaml
|
|
13
|
+
AIRLOCK_HEALTH_PORT: '4111'
|
|
14
|
+
volumes:
|
|
15
|
+
# Runtime gateway can hot-reload this file but cannot modify policy.
|
|
16
|
+
- ./airlock-config:/config:ro
|
|
17
|
+
- airlock-data:/data
|
|
18
|
+
# Keep npx-installed MCP servers cached across restarts.
|
|
19
|
+
- airlock-npm-cache:/home/airlock/.npm
|
|
20
|
+
ports:
|
|
21
|
+
# Bind to loopback by default. Put your TLS/auth proxy on the same host,
|
|
22
|
+
# or change these bindings only for a trusted private network.
|
|
23
|
+
- 127.0.0.1:4111:4111
|
|
24
|
+
read_only: true
|
|
25
|
+
tmpfs:
|
|
26
|
+
- /tmp:rw,nosuid,nodev,size=256m
|
|
27
|
+
cap_drop:
|
|
28
|
+
- ALL
|
|
29
|
+
security_opt:
|
|
30
|
+
- no-new-privileges:true
|
|
31
|
+
# Add reverse-proxy labels or service discovery metadata here if your
|
|
32
|
+
# platform uses container labels.
|
|
33
|
+
|
|
34
|
+
airlock-dashboard:
|
|
35
|
+
image: airlock-bot:local
|
|
36
|
+
command: dashboard --config /config/airlock.yaml --host 0.0.0.0 --port 4112 --gateway-url http://airlock-gateway:4111
|
|
37
|
+
restart: unless-stopped
|
|
38
|
+
env_file:
|
|
39
|
+
- .env
|
|
40
|
+
environment:
|
|
41
|
+
AIRLOCK_CONFIG: /config/airlock.yaml
|
|
42
|
+
AIRLOCK_GATEWAY_SECRET: ${AIRLOCK_API_SECRET}
|
|
43
|
+
AIRLOCK_HEALTH_PORT: '4112'
|
|
44
|
+
volumes:
|
|
45
|
+
# Dashboard owns config mutation and writes /config/airlock.bak.
|
|
46
|
+
- ./airlock-config:/config
|
|
47
|
+
ports:
|
|
48
|
+
- 127.0.0.1:4112:4112
|
|
49
|
+
read_only: true
|
|
50
|
+
tmpfs:
|
|
51
|
+
- /tmp:rw,nosuid,nodev,size=128m
|
|
52
|
+
cap_drop:
|
|
53
|
+
- ALL
|
|
54
|
+
security_opt:
|
|
55
|
+
- no-new-privileges:true
|
|
56
|
+
depends_on:
|
|
57
|
+
- airlock-gateway
|
|
58
|
+
# Add dashboard-specific reverse-proxy labels here. Protect this route with
|
|
59
|
+
# human authentication.
|
|
60
|
+
|
|
61
|
+
volumes:
|
|
62
|
+
airlock-data:
|
|
63
|
+
airlock-npm-cache:
|
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
# yaml-language-server: $schema=../schema.json
|
|
2
|
+
# Minimal Docker/VPS-oriented config. Copy this file next to
|
|
3
|
+
# examples/docker-compose.yaml, create an .env file with the referenced secrets,
|
|
4
|
+
# and edit providers/agents for your deployment.
|
|
5
|
+
|
|
6
|
+
server:
|
|
7
|
+
port: 4111
|
|
8
|
+
host: 0.0.0.0
|
|
9
|
+
api_secret: ${AIRLOCK_API_SECRET}
|
|
10
|
+
auth_required: true
|
|
11
|
+
require_agent_tokens: true
|
|
12
|
+
allowed_origins:
|
|
13
|
+
- https://airlock.example.com
|
|
14
|
+
expose_management_api: true
|
|
15
|
+
expose_tools_api: false
|
|
16
|
+
expose_hook_api: false
|
|
17
|
+
|
|
18
|
+
providers:
|
|
19
|
+
http: builtin
|
|
20
|
+
# Add stdio/SSE/HTTP MCP providers here. If a provider uses npx, the compose
|
|
21
|
+
# example persists /home/airlock/.npm so packages are cached across restarts.
|
|
22
|
+
|
|
23
|
+
agents:
|
|
24
|
+
example-agent:
|
|
25
|
+
token: ${EXAMPLE_AGENT_AIRLOCK_TOKEN}
|
|
26
|
+
allow:
|
|
27
|
+
- http/get
|
|
28
|
+
ask:
|
|
29
|
+
- http/post
|
|
30
|
+
http:
|
|
31
|
+
domain_allowlist:
|
|
32
|
+
- api.github.com
|
|
33
|
+
|
|
34
|
+
approvals:
|
|
35
|
+
provider:
|
|
36
|
+
type: dashboard
|
|
37
|
+
host: 0.0.0.0
|
|
38
|
+
port: 4112
|
|
39
|
+
timeout_ms: 300000
|
|
40
|
+
|
|
41
|
+
security:
|
|
42
|
+
blocked_hosts:
|
|
43
|
+
- localhost
|
|
44
|
+
- 127.0.0.1
|
|
45
|
+
- '::1'
|
|
46
|
+
- '*.local'
|
|
47
|
+
- '10.*'
|
|
48
|
+
- '172.16.*'
|
|
49
|
+
- '192.168.*'
|
|
50
|
+
- '169.254.*'
|
|
51
|
+
allowed_local: []
|
|
52
|
+
|
|
53
|
+
audit:
|
|
54
|
+
db_path: /data/airlock-audit.db
|
|
55
|
+
retention_days: 90
|
|
56
|
+
redact_fields:
|
|
57
|
+
- password
|
|
58
|
+
- token
|
|
59
|
+
- secret
|
|
60
|
+
- key
|
|
61
|
+
- authorization
|
package/examples/gateway.yaml
CHANGED
|
@@ -6,6 +6,13 @@ server:
|
|
|
6
6
|
port: 4111
|
|
7
7
|
host: 127.0.0.1
|
|
8
8
|
# api_secret: ${AIRLOCK_API_SECRET}
|
|
9
|
+
# auth_required: true
|
|
10
|
+
# require_agent_tokens: true
|
|
11
|
+
# allowed_origins:
|
|
12
|
+
# - https://airlock.example.com
|
|
13
|
+
# expose_management_api: false
|
|
14
|
+
# expose_tools_api: false
|
|
15
|
+
# expose_hook_api: false
|
|
9
16
|
|
|
10
17
|
# Tool providers — MCP servers and builtins
|
|
11
18
|
providers:
|