Nicolas Cantu
255acbaf97
Initial state: - claw-harness-proxy accepted absolute-form / scheme-relative request targets, allowing proxying to arbitrary hosts. - claw-harness-proxy forwarded client Authorization headers upstream. - @4nk/smart-ide-http-utils did not provide helpers for Node http.request-based proxies. - docs/repo/ia-dev-smart-ide-integration.md still documented the old IA_DEV_ROOT default resolution order. Motivation: - Ensure safe proxy behavior for every HTTP relay in the monorepo. - Keep the IA_DEV_ROOT contract consistent across code and docs. Resolution: - Extend @4nk/smart-ide-http-utils with copyOutgoingHeadersForProxy() for http.request. - Harden claw-harness-proxy: reject absolute URLs and '//' targets, validate safe proxy paths, avoid forwarding Authorization, and avoid leaking internal error details. - Align ia-dev-smart-ide-integration doc default order to ./services/ia_dev then ./ia_dev. Root cause: - Proxy implementation treated req.url as a URL to be resolved and allowed absolute inputs. - Cross-proxy utilities were only implemented for fetch-based proxies. Impacted features: - claw-harness-proxy HTTP forwarding. - shared HTTP utility package. - IA_DEV_ROOT documentation. Code modified: - packages/smart-ide-http-utils/src/* + dist/* - services/claw-harness-api/proxy/src/server.ts Documentation modified: - docs/repo/ia-dev-smart-ide-integration.md - CHANGELOG.md Configurations modified: - services/claw-harness-api/proxy/package.json Files in deploy modified: - None Files in logs impacted: - None Databases and other sources modified: - None Off-project modifications: - None Files in .smartIde modified: - None Files in .secrets modified: - None New patch version in VERSION: - 0.0.7 CHANGELOG.md updated: - yes
71 lines
2.0 KiB
JSON
71 lines
2.0 KiB
JSON
{
|
|
"name": "@4nk/claw-harness-proxy",
|
|
"version": "0.1.0",
|
|
"lockfileVersion": 3,
|
|
"requires": true,
|
|
"packages": {
|
|
"": {
|
|
"name": "@4nk/claw-harness-proxy",
|
|
"version": "0.1.0",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@4nk/smart-ide-http-utils": "file:../../../packages/smart-ide-http-utils"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20.11.0",
|
|
"typescript": "^5.3.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=20"
|
|
}
|
|
},
|
|
"../../../packages/smart-ide-http-utils": {
|
|
"name": "@4nk/smart-ide-http-utils",
|
|
"version": "0.1.0",
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"@types/node": "^20.11.0",
|
|
"typescript": "^5.3.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=20"
|
|
}
|
|
},
|
|
"node_modules/@4nk/smart-ide-http-utils": {
|
|
"resolved": "../../../packages/smart-ide-http-utils",
|
|
"link": true
|
|
},
|
|
"node_modules/@types/node": {
|
|
"version": "20.19.39",
|
|
"resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.39.tgz",
|
|
"integrity": "sha512-orrrD74MBUyK8jOAD/r0+lfa1I2MO6I+vAkmAWzMYbCcgrN4lCrmK52gRFQq/JRxfYPfonkr4b0jcY7Olqdqbw==",
|
|
"dev": true,
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"undici-types": "~6.21.0"
|
|
}
|
|
},
|
|
"node_modules/typescript": {
|
|
"version": "5.9.3",
|
|
"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
|
|
"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
|
|
"dev": true,
|
|
"license": "Apache-2.0",
|
|
"bin": {
|
|
"tsc": "bin/tsc",
|
|
"tsserver": "bin/tsserver"
|
|
},
|
|
"engines": {
|
|
"node": ">=14.17"
|
|
}
|
|
},
|
|
"node_modules/undici-types": {
|
|
"version": "6.21.0",
|
|
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
|
|
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
|
|
"dev": true,
|
|
"license": "MIT"
|
|
}
|
|
}
|
|
}
|