libre-webui 0.37.1 → 0.38.0

package/backend/dist/utils/corsOriginPolicy.js

@@ -0,0 +1,70 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { isIPv4 } from 'node:net';
+/** Match the existing Docker/development network policy against literal hosts. */
+function isNetworkHostname(hostname) {
+    if (hostname === 'localhost')
+        return true;
+    if (!isIPv4(hostname))
+        return false;
+    const [first, second] = hostname.split('.').map(Number);
+    return (first === 127 ||
+        first === 10 ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168) ||
+        (first === 100 && second >= 64 && second <= 127));
+}
+/**
+ * Build the application's CORS policy without importing its stateful server.
+ * Origin headers are serialized origins, not arbitrary URLs or origin lists.
+ */
+export function createCorsOriginPolicy({ allowedOrigins, allowNetworkOrigins, }) {
+    const configured = new Set(allowedOrigins);
+    return (origin) => {
+        // Native clients may omit Origin; an empty or malformed header is different.
+        if (origin === undefined)
+            return true;
+        if (typeof origin !== 'string')
+            return false;
+        // Opaque origins remain an explicit operator choice, never a LAN exception.
+        if (origin === 'null')
+            return configured.has('*') || configured.has(origin);
+        let parsed;
+        try {
+            parsed = new URL(origin);
+        }
+        catch {
+            return false;
+        }
+        // Node treats extension schemes as opaque; their explicitly configured
+        // browser origins still have a scheme and authority. They never gain the
+        // automatic HTTP(S) network exception below.
+        const serializedOrigin = parsed.origin === 'null'
+            ? `${parsed.protocol}//${parsed.host}`
+            : parsed.origin;
+        // Reject credentials, paths, query/fragment components, multiple origins,
+        // and alternate IP spellings instead of normalizing them into trusted hosts.
+        if (!parsed.host || serializedOrigin !== origin)
+            return false;
+        if (configured.has('*') || configured.has(origin))
+            return true;
+        return (allowNetworkOrigins &&
+            (parsed.protocol === 'http:' || parsed.protocol === 'https:') &&
+            isNetworkHostname(parsed.hostname));
+    };
+}
+//# sourceMappingURL=corsOriginPolicy.js.map

package/backend/dist/utils/corsOriginPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corsOriginPolicy.js","sourceRoot":"","sources":["../../src/utils/corsOriginPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAOlC,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CACL,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE;QACZ,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;QAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,cAAc,EACd,mBAAmB,GACK;IACxB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3C,OAAO,CAAC,MAAe,EAAW,EAAE;QAClC,6EAA6E;QAC7E,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC7C,4EAA4E;QAC5E,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE5E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,KAAK,MAAM;YACtB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE;YACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,CACL,mBAAmB;YACnB,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC7D,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/backend/dist/utils/pluginDefinitionTrust.js

@@ -21,7 +21,7 @@ import { createHash } from 'crypto';
  */
 export const BUNDLED_PLUGIN_DEFINITION_FINGERPRINTS = Object.freeze({
     anthropic: '4ba7c2344e8404ed78f6d6f622f24307fcc8f5451047d45ee427bb0ab4d1aecf',
-    'codex-oauth': '7337c3dcfb5bc29d6dbd9f4ab2da2fc9a72b859d690ccd207ee0ebeb1e8f38cb',
+    'codex-oauth': '733d9992eb9209deaec037230cae31178e6000c009d971fef6c26a7666a6f46f',
     comfyui: 'eaefe81897b58bffdf92bae8f0d0b675a062af276d5379e43147d6a0adaf0f47',
     deepseek: '32cc8662939e304869f9e02ef3b7c8ced6ffe14c333bea9230bfabe2f2350181',
     elevenlabs: 'de6afcbd123600f484a078227618b5c9687bc56f6e2637b57514349fbcea63d6',

package/backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libre-webui-backend",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "Backend API for Libre WebUI",
@@ -23,40 +23,10 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1131.0",
     "@aws-sdk/lib-storage": "^3.1131.0",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/cordis-plugin-group": "^1.0.2",
-    "@deepseek-ai/cordis-plugin-include": "^1.0.7",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/cordis-plugin-timer": "^1.1.4",
-    "@deepseek-ai/dsh-agent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent-loop": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-authorization": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-credentials": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-deepseek-llm-api-extensions": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-sandbox": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-home-paths": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-invariants": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-ptc-runtime": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-scope": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-fs": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-user-approval": "^0.1.6-alpha.2",
     "@kubernetes/client-node": "^2.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@strands-agents/harness": "^0.1.1",
+    "@strands-agents/sdk": "^1.19.0",
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^13.0.2",
     "express": "^5.2.1",

package/frontend/dist/artifact-runtime/.build-fingerprint

@@ -1 +1 @@
-36d590c9492fe9e06f491f56c4d95bf3f44d7f1acfa308c7c552128c61bff70c
+7231c456b9bea217974d2c8afaad05d5cf83485236f913c27efc02b4675e5ec8