HHsiangNianiantest(cli): make config writer assertions portable
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
docs(cli): stop advertising the retired --non-interactive alias in init help | 1 个月前 | |
fix(extraction): extract modern GitHub blob from embedded React payload Modern github.com/<owner>/<repo>/blob/<ref>/<path> pages render file content client-side from a react-app.embeddedData JSON payload; the legacy .blob-code-content / .highlight selectors match only a ~500-char stub. Parse rawLines from payload["codeViewBlobLayoutRoute.StyledBlob"] and blob metadata (displayName/language/truncated) from payload.codeViewBlobLayoutRoute.blob into a fenced code block. Add extractGithubBlobWithRawFallback with an injected fetcher that transforms to raw.githubusercontent.com only when the payload is absent or truncated (large files) — a complete payload never double-fetches. Legacy selectors kept as the final fallback for old cached / enterprise pages. | 2 个月前 | |
feat(test-helpers): waitFor accepts async predicates | 5 个月前 | |
Merge remote-tracking branch 'upstream/main' into fix/opencode-mcp-156 # Conflicts: # README.md | 1 个月前 | |
chore: remove internal dev-process references from tracked files Strip development breadcrumbs (codename, slice/phase/wave/flaw and audit-item tags, internal design-doc pointers) from source comments, SQL migration headers, tests, CHANGELOG, and a benchmark baseline. Correct stale diff/watch tool-schema comments that described them as unimplemented stubs. Reword to preserve the real rationale; no code, control-flow, or test-assertion changes. | 2 个月前 | |
Merge remote-tracking branch 'upstream/main' into fix/opencode-mcp-156 # Conflicts: # README.md | 1 个月前 | |
harden(ssrf): wire the fetch-time resolved re-check into every fetch/serve seam Phase-0 (c7168ab) added guardResolvedHost and the http-client input hop. This wires the resolved re-check into the remaining seams so a public hostname whose DNS record points at cloud metadata / RFC-1918 / (in serve mode) loopback cannot slip past the literal-only guard anywhere: - http-client: thread allowPrivate from the call site's opts (was re-reading config directly) so the resolved policy tracks the literal one - router (defaultPdfProbe) + tls-tier redirect loops: resolved check at hop 0 and every redirect Location - escape-hatch: shared resolvedGuardOk helper at all 5 guardFetchUrl sites, each threading that site's own allowPrivate (sidecar true, target config); lookup injectable for tests - dispatch + firecrawl-compat serve seams: guardResolvedServeTarget with bindIsLoopback, so a name resolving to loopback is refused under a non-loopback bind (guardResolvedHost still allows loopback for plain fetch / local dev) - browser-pool: pre-goto check-only guard; comment notes it does NOT close DNS rebinding (Chromium re-resolves) — pinning tracked in #207 Also fixes a latent bug this surfaced: guardFetchUrl's docstring promised the IPv6 loopback (::1) exemption mirroring 127.0.0.0/8, but it was never implemented, so a dual-stack localhost (127.0.0.1 + ::1) was wrongly blocked once the resolved re-check feeds each IP back through guardFetchUrl. Added the narrow ::1 exemption; serve-mode ::1 refusal still applies via the serve guard. New tests (all via injected lookup): guardResolvedServeTarget matrix (metadata / RFC-1918 ±allowPrivate / loopback under serve non-loopback bind / loopback allowed under loopback bind / WIGOLO_SERVE_ALLOW_LOCAL_TARGETS / multi-record / non-resolving) plus the guardResolvedHost loopback-allowed case. | 1 个月前 | |
test: isolate the suite data dir to a per-worker temp path The full suite opened the developer's real ~/.wigolo/wigolo.db (a vitest worker held it). Set a per-pid temp WIGOLO_DATA_DIR (path contains .wigolo so config's default assertion holds), re-asserted per test so the tests that delete it don't fall back to the home dir. Invisible on CI (throwaway HOME), decisive locally. | 2 个月前 |