mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
436066415b
* feat: embedded registry catalog and WASM bundle install pipeline Embed registry manifests at compile time so the extension catalog is available without network access. Add tar.gz bundle support for WASM extension downloads (tools and channels), a /api/extensions/registry endpoint, CI job to build and publish WASM bundles on release, and ephemeral in-memory secrets fallback so the extension manager works even without a persistent secrets store. Key changes: - build.rs: collect registry/*.json into embedded_catalog.json at compile time - src/registry/embedded.rs + catalog.rs: load embedded or on-disk catalog - src/extensions/manager.rs: download_and_install_wasm handles tar.gz bundles, bare .wasm files, and separate capabilities downloads; wasm channel install - src/channels/web/server.rs: /api/extensions/registry endpoint + no-cache headers - src/app.rs: ephemeral InMemorySecretsStore fallback for extension manager - registry/*.json: populate artifact download URLs for release bundles - .github/workflows/release.yml: build-wasm-extensions CI job - Simplified setup wizard and CLI registry commands Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review — archive hardening, decompression bomb guard, test fix - Add 100 MB decompressed entry size cap to tar.gz extraction in both manager.rs and installer.rs to prevent decompression bombs - Add archive.set_preserve_permissions(false) and set_unpack_xattrs(false) for defense-in-depth against malicious archives - Fix test assertion logic in catalog.rs (|| → || with correct negation) - Replace silent tar fallback in CI with explicit if/else for capabilities - Add warning when installing without SHA256 verification Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: resolve clippy warning in settings.rs and enforce zero-warnings policy Use struct initializer with ..Default::default() instead of field reassignment. Update CLAUDE.md to codify zero clippy warnings policy — all warnings must be fixed before committing, including pre-existing ones. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review round 2 — build reliability, caps validation, naming - build.rs: emit per-file rerun-if-changed for reliable content tracking; fix bundles fallback to match BundlesFile shape ({"bundles":{}}) - embedded.rs: parse catalog once via OnceLock instead of double-parsing - manager.rs + installer.rs: add 1 MB size cap on capabilities_url downloads with proper error surfacing - secrets/store.rs: rename misleading `pub mod testing` to `pub mod in_memory` - server.rs: track installed extensions by (name, kind) tuple to avoid false positives across different extension kinds Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
223 lines
6.0 KiB
TOML
223 lines
6.0 KiB
TOML
[workspace]
|
|
members = ["."]
|
|
exclude = [
|
|
"channels-src/discord",
|
|
"channels-src/telegram",
|
|
"channels-src/slack",
|
|
"channels-src/whatsapp",
|
|
"tools-src/github",
|
|
"tools-src/gmail",
|
|
"tools-src/google-calendar",
|
|
"tools-src/google-docs",
|
|
"tools-src/google-drive",
|
|
"tools-src/google-sheets",
|
|
"tools-src/google-slides",
|
|
"tools-src/okta",
|
|
"tools-src/slack",
|
|
"tools-src/telegram",
|
|
]
|
|
|
|
[package]
|
|
name = "ironclaw"
|
|
version = "0.9.0"
|
|
edition = "2024"
|
|
rust-version = "1.92"
|
|
description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
|
|
authors = ["NEAR AI <[email protected]>"]
|
|
license = "MIT OR Apache-2.0"
|
|
homepage = "https://github.com/nearai/ironclaw"
|
|
repository = "https://github.com/nearai/ironclaw"
|
|
|
|
[package.metadata.wix]
|
|
upgrade-guid = "D0156E61-BA37-451E-8AB9-1A2ECCCFA48F"
|
|
path-guid = "F90B6EA6-87F7-499B-BB19-CF55DE1EB339"
|
|
license = false
|
|
eula = false
|
|
|
|
[dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full"] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
futures = "0.3"
|
|
|
|
# HTTP client
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots", "stream"] }
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Database - PostgreSQL (default, feature-gated)
|
|
deadpool-postgres = { version = "0.14", optional = true }
|
|
tokio-postgres = { version = "0.7", features = ["with-uuid-1", "with-chrono-0_4", "with-serde_json-1"], optional = true }
|
|
postgres-types = { version = "0.2", features = ["with-serde_json-1"], optional = true }
|
|
refinery = { version = "0.8", features = ["tokio-postgres"], optional = true }
|
|
|
|
# Database - libSQL/Turso (optional embedded database)
|
|
libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication"] }
|
|
|
|
# Error handling
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
|
|
# Configuration
|
|
dotenvy = "0.15"
|
|
toml = "0.8"
|
|
|
|
# Core types
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
rust_decimal = { version = "1", features = ["serde", "serde-with-str", "maths"] }
|
|
rust_decimal_macros = "1"
|
|
|
|
# Async traits
|
|
async-trait = "0.1"
|
|
|
|
# CLI
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
|
|
# Terminal
|
|
crossterm = "0.28"
|
|
rustyline = { version = "17", features = ["custom-bindings", "derive", "with-file-history"] }
|
|
termimad = "0.34"
|
|
|
|
# Channel integrations
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["trace", "cors", "set-header"] }
|
|
|
|
# Cron scheduling for routines
|
|
cron = "0.13"
|
|
|
|
# Safety/sanitization
|
|
regex = "1"
|
|
aho-corasick = "1"
|
|
|
|
# YAML parsing for SKILL.md frontmatter
|
|
serde_yml = "0.0.12"
|
|
|
|
# Filesystem paths
|
|
dirs = "6"
|
|
fs4 = "0.6"
|
|
|
|
# Secrecy for sensitive values
|
|
secrecy = { version = "0.10", features = ["serde"] }
|
|
|
|
# URL parsing and encoding
|
|
url = "2"
|
|
urlencoding = "2"
|
|
|
|
# Open URLs in browser
|
|
open = "5"
|
|
|
|
# Vector embeddings for semantic search
|
|
# The postgres feature provides ToSql/FromSql for postgres-types (shared by tokio-postgres)
|
|
pgvector = { version = "0.4", features = ["postgres"], optional = true }
|
|
|
|
# WASM sandbox for untrusted tool execution
|
|
wasmtime = { version = "28", features = ["component-model"] }
|
|
wasmtime-wasi = "28" # WASI support for component model
|
|
wasmparser = "0.220" # WASM binary parsing for validation
|
|
|
|
# Cryptography for secrets management
|
|
aes-gcm = "0.10"
|
|
hkdf = "0.12"
|
|
sha2 = "0.10"
|
|
blake3 = "1"
|
|
rand = "0.8"
|
|
subtle = "2" # Constant-time comparisons for token validation
|
|
|
|
# Multi-provider LLM support
|
|
rig-core = "0.30"
|
|
|
|
# Docker sandbox
|
|
bollard = "0.18"
|
|
|
|
# Archive extraction for WASM extension bundles
|
|
flate2 = "1"
|
|
tar = "0.4"
|
|
|
|
# HTTP proxy for sandboxed network access
|
|
hyper = { version = "1.5", features = ["server", "http1", "http2"] }
|
|
hyper-util = { version = "0.1", features = ["server", "tokio", "http1", "http2"] }
|
|
http-body-util = "0.1"
|
|
bytes = "1"
|
|
base64 = "0.22.1"
|
|
mime_guess = "2.0.5"
|
|
|
|
# macOS keychain
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
security-framework = "3"
|
|
|
|
# Linux secret-service (GNOME Keyring, KWallet)
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
secret-service = { version = "4", features = ["rt-tokio-crypto-rust"] }
|
|
zbus = "4"
|
|
|
|
[dev-dependencies]
|
|
tokio-test = "0.4"
|
|
tokio-tungstenite = "0.26"
|
|
testcontainers-modules = { version = "0.11", features = ["postgres"] }
|
|
pretty_assertions = "1"
|
|
tempfile = "3"
|
|
|
|
[features]
|
|
default = ["postgres", "libsql"]
|
|
postgres = [
|
|
"dep:deadpool-postgres",
|
|
"dep:tokio-postgres",
|
|
"dep:postgres-types",
|
|
"dep:refinery",
|
|
"dep:pgvector",
|
|
"rust_decimal/db-tokio-postgres",
|
|
]
|
|
libsql = ["dep:libsql"]
|
|
integration = []
|
|
|
|
# The profile that 'cargo dist' will build with
|
|
[profile.dist]
|
|
inherits = "release"
|
|
lto = "thin"
|
|
|
|
# Config for 'dist'
|
|
[workspace.metadata.dist]
|
|
# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
|
|
cargo-dist-version = "0.30.3"
|
|
# CI backends to support
|
|
ci = "github"
|
|
# The installers to generate for each app
|
|
installers = ["shell", "powershell", "npm", "msi"]
|
|
# Publish jobs to run in CI
|
|
publish-jobs = []
|
|
# Target platforms to build apps for (Rust target-triple syntax)
|
|
targets = [
|
|
"aarch64-apple-darwin",
|
|
"aarch64-unknown-linux-gnu",
|
|
"x86_64-apple-darwin",
|
|
"x86_64-unknown-linux-gnu",
|
|
"x86_64-pc-windows-msvc",
|
|
]
|
|
# The archive format to use for windows builds (defaults .zip)
|
|
windows-archive = ".tar.gz"
|
|
# The archive format to use for non-windows builds (defaults .tar.xz)
|
|
unix-archive = ".tar.gz"
|
|
# Which actions to run on pull requests
|
|
pr-run-mode = "skip"
|
|
# Path that installers should place binaries in
|
|
install-path = "CARGO_HOME"
|
|
# Whether to install an updater program
|
|
install-updater = true
|
|
# Cache intermediate build artifacts to speed up the release pipelines
|
|
cache-builds = true
|
|
|
|
[workspace.metadata.dist.github-custom-runners]
|
|
aarch64-unknown-linux-gnu = "ubuntu-24.04-arm"
|
|
x86_64-unknown-linux-gnu = "ubuntu-22.04"
|
|
x86_64-pc-windows-msvc = "windows-2022"
|
|
x86_64-apple-darwin = "macos-15-intel"
|
|
aarch64-apple-darwin = "macos-14"
|