mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
59ae4d8ad2
Final in-sandbox completeness pass. Five focused pieces; the remaining items in PHASE_BC_LOCAL_TODO.md after this commit are all genuinely local-only (toolchain, network, native deps). Test coverage (the biggest gap from prior reviews) - Server/plugin/manifest_test.go — pluginNameRegexp accept/reject table, validateRelativePath table, oversized version, unknown permission. - Server/plugin/host_http_test.go — hostAllowed dot-boundary suffix, empty-entry rejection, case insensitivity, FQDN trailing dot. ipAllowed table over loopback, RFC1918, RFC4193 (ULA), RFC6598 (CGN), link-local, multicast, unspecified — both v4 and v6 — plus public-IP accept cases. - Server/plugin/loader_test.go — rejectSymlinksUnder catches direct and nested symlinks; scanPluginDirectory rejects a plugin whose entrypoint is a symlink. Skipped on Windows where symlink creation needs elevation. - Server/plugin/host_ui_test.go — AssetHandler serves declared files, rejects undeclared files (404), rejects path traversal, supports nested asset paths. - Server/ws/hub_seedseq_test.go — SeedSeq monotonic, never-backwards, concurrent CAS safety, integration with nextSeq. - Server/ws/extract_event_type_test.go — table covering happy paths, control char rejection, escaped quote rejection, length cap (64), empty/missing/non-JSON inputs. Plugin install endpoint (closes a real feature gap) - Server/plugin/registry.go — InstallFromZip extracts a plugin .zip into a staging directory under cfg.Directory, validates it zip-slip safe (cleaned-path Rel check), refuses non-regular entries, refuses symlinks, caps compressed at 16 MiB and uncompressed total at 64 MiB (each file gated by io.CopyN against the remaining budget). Manifest is parsed at the staged root, then atomically renamed into the canonical plugin directory and registered via the existing installFromDisk path. - Server/api/plugins_handler.go — POST /install accepts multipart with one "plugin" file part, http.MaxBytesReader caps the request body, io.LimitReader caps the in-memory buffer, calls Registry.InstallFromZip, returns 201 with the new plugin name. The endpoint inherits the Pass 2 admin auth + IP gate (mounted under r.Use(admin.RequireAdminAuth)). Protocol surface - Server/ws/serve.go — buildAuthOK now takes replaySource and includes it in the auth_ok payload as "replay_source": "none" | "buffer" | "db". Two call sites updated: reconnect path passes the existing local, fresh-connect path passes "none". Test export updated to pass "none". CI build-tag matrix - .github/workflows/ci.yml — three new steps inside server-build-test build the server with -tags otel, -tags wazero, and -tags otel,wazero. All three are continue-on-error: true until the upstream OTel and wazero modules land in go.mod (tracked in PHASE_BC_LOCAL_TODO.md). Once they do, dropping continue-on-error converts the steps into hard CI gates against tag-boundary drift. Documentation - CHANGELOG.md — new root-level file with curated entries for Phase B, Phase C, security, and behavioural changes operators must know about (notably event_persistence.enabled = true by default). - PHASE_BC_LOCAL_TODO.md — ticks off the install endpoint, the replay_source field, and the existing event_persistence defaultYAML entry. The remaining items are toolchain-bound. After this pass, the in-sandbox completeness ceiling is reached. Everything still pending requires Go 1.25 toolchain, npm install, real OTel SDK + wazero modules, sqlc, postgres backend impl, or tinygo. https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk