mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
e42b1e5ec1
* docs(security): add network security reference for all listeners Catalogs every network-facing surface (web gateway, webhook server, orchestrator API, OAuth callback, sandbox proxy) with auth mechanisms, bind addresses, egress controls, known findings, and a review checklist for PRs that touch network-facing code. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(security): address three network security findings - Use constant-time comparison (ct_eq) for webhook secret validation, matching the pattern in web gateway and orchestrator auth - Add X-Content-Type-Options and X-Frame-Options security headers to the web gateway via SetResponseHeaderLayer - Warn at startup when HTTP webhook server binds to 0.0.0.0 - Update NETWORK_SECURITY.md to mark findings 1, 4, 5 as resolved Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(security): address PR #201 review findings - Reorder web gateway layers so security headers (X-Content-Type-Options, X-Frame-Options) are outermost and apply to all responses including DefaultBodyLimit 413 rejections - Move 0.0.0.0 warning to final bind address resolution so it fires for WASM-only webhook servers that fall back to the default address - Add webhook handler auth tests: correct secret -> 200, wrong secret -> 401, missing secret -> 401 - Rewrite NETWORK_SECURITY.md: replace brittle line-number references with function/struct name anchors, add threat model section, document graceful shutdown per listener, fill content gaps (health endpoint responses, content-type validation, CSRF analysis, WS auth flow, MCP trust boundary, orchestrator rate limiting), change findings F-4/F-5 from "Resolved" to "Mitigated" with caveats Co-Authored-By: Claude Opus 4.6 <[email protected]> * style: fix rustfmt and clippy warnings from main merge Fix formatting in llm/mod.rs and llm/rig_adapter.rs introduced by PR #132, and collapse nested if in rig_adapter.rs per clippy. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
209 lines
5.7 KiB
TOML
209 lines
5.7 KiB
TOML
[workspace]
|
|
members = [".", "benchmarks"]
|
|
exclude = [
|
|
"channels-src/telegram",
|
|
"channels-src/slack",
|
|
"channels-src/whatsapp",
|
|
"tools-src/gmail",
|
|
]
|
|
|
|
[package]
|
|
name = "ironclaw"
|
|
version = "0.6.0"
|
|
edition = "2024"
|
|
rust-version = "1.92"
|
|
description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
|
|
authors = ["NEAR AI <[email protected]>"]
|
|
license = "MIT OR Apache-2.0"
|
|
homepage = "https://github.com/nearai/ironclaw"
|
|
repository = "https://github.com/nearai/ironclaw"
|
|
|
|
[package.metadata.wix]
|
|
upgrade-guid = "D0156E61-BA37-451E-8AB9-1A2ECCCFA48F"
|
|
path-guid = "F90B6EA6-87F7-499B-BB19-CF55DE1EB339"
|
|
license = false
|
|
eula = false
|
|
|
|
[dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full"] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
futures = "0.3"
|
|
|
|
# HTTP client
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots", "stream"] }
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Database - PostgreSQL (default, feature-gated)
|
|
deadpool-postgres = { version = "0.14", optional = true }
|
|
tokio-postgres = { version = "0.7", features = ["with-uuid-1", "with-chrono-0_4", "with-serde_json-1"], optional = true }
|
|
postgres-types = { version = "0.2", features = ["with-serde_json-1"], optional = true }
|
|
refinery = { version = "0.8", features = ["tokio-postgres"], optional = true }
|
|
|
|
# Database - libSQL/Turso (optional embedded database)
|
|
libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication"] }
|
|
|
|
# Error handling
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
|
|
# Configuration
|
|
dotenvy = "0.15"
|
|
toml = "0.8"
|
|
|
|
# Core types
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
rust_decimal = { version = "1", features = ["serde", "serde-with-str", "maths"] }
|
|
rust_decimal_macros = "1"
|
|
|
|
# Async traits
|
|
async-trait = "0.1"
|
|
|
|
# CLI
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
|
|
# Terminal
|
|
crossterm = "0.28"
|
|
rustyline = { version = "17", features = ["derive", "with-file-history"] }
|
|
termimad = "0.34"
|
|
|
|
# Channel integrations
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["trace", "cors", "set-header"] }
|
|
|
|
# Cron scheduling for routines
|
|
cron = "0.13"
|
|
|
|
# Safety/sanitization
|
|
regex = "1"
|
|
aho-corasick = "1"
|
|
|
|
# YAML parsing for SKILL.md frontmatter
|
|
serde_yml = "0.0.12"
|
|
|
|
# Filesystem paths
|
|
dirs = "6"
|
|
fs4 = "0.6"
|
|
|
|
# Secrecy for sensitive values
|
|
secrecy = { version = "0.10", features = ["serde"] }
|
|
|
|
# URL parsing and encoding
|
|
url = "2"
|
|
urlencoding = "2"
|
|
|
|
# Open URLs in browser
|
|
open = "5"
|
|
|
|
# Vector embeddings for semantic search
|
|
# The postgres feature provides ToSql/FromSql for postgres-types (shared by tokio-postgres)
|
|
pgvector = { version = "0.4", features = ["postgres"], optional = true }
|
|
|
|
# WASM sandbox for untrusted tool execution
|
|
wasmtime = { version = "28", features = ["component-model"] }
|
|
wasmtime-wasi = "28" # WASI support for component model
|
|
wasmparser = "0.220" # WASM binary parsing for validation
|
|
|
|
# Cryptography for secrets management
|
|
aes-gcm = "0.10"
|
|
hkdf = "0.12"
|
|
sha2 = "0.10"
|
|
blake3 = "1"
|
|
rand = "0.8"
|
|
subtle = "2" # Constant-time comparisons for token validation
|
|
|
|
# Multi-provider LLM support
|
|
rig-core = "0.30"
|
|
|
|
# Docker sandbox
|
|
bollard = "0.18"
|
|
|
|
# HTTP proxy for sandboxed network access
|
|
hyper = { version = "1.5", features = ["server", "http1", "http2"] }
|
|
hyper-util = { version = "0.1", features = ["server", "tokio", "http1", "http2"] }
|
|
http-body-util = "0.1"
|
|
bytes = "1"
|
|
base64 = "0.22.1"
|
|
mime_guess = "2.0.5"
|
|
|
|
# macOS keychain
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
security-framework = "3"
|
|
|
|
# Linux secret-service (GNOME Keyring, KWallet)
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
secret-service = { version = "4", features = ["rt-tokio-crypto-rust"] }
|
|
zbus = "4"
|
|
|
|
[dev-dependencies]
|
|
tokio-test = "0.4"
|
|
tokio-tungstenite = "0.26"
|
|
testcontainers-modules = { version = "0.11", features = ["postgres"] }
|
|
pretty_assertions = "1"
|
|
tempfile = "3"
|
|
|
|
[features]
|
|
default = ["postgres", "libsql"]
|
|
postgres = [
|
|
"dep:deadpool-postgres",
|
|
"dep:tokio-postgres",
|
|
"dep:postgres-types",
|
|
"dep:refinery",
|
|
"dep:pgvector",
|
|
"rust_decimal/db-tokio-postgres",
|
|
]
|
|
libsql = ["dep:libsql"]
|
|
integration = []
|
|
|
|
# The profile that 'cargo dist' will build with
|
|
[profile.dist]
|
|
inherits = "release"
|
|
lto = "thin"
|
|
|
|
# Config for 'dist'
|
|
[workspace.metadata.dist]
|
|
# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
|
|
cargo-dist-version = "0.30.3"
|
|
# CI backends to support
|
|
ci = "github"
|
|
# The installers to generate for each app
|
|
installers = ["shell", "powershell", "npm", "msi"]
|
|
# Publish jobs to run in CI
|
|
publish-jobs = []
|
|
# Target platforms to build apps for (Rust target-triple syntax)
|
|
targets = [
|
|
"aarch64-apple-darwin",
|
|
"aarch64-unknown-linux-gnu",
|
|
"x86_64-apple-darwin",
|
|
"x86_64-unknown-linux-gnu",
|
|
"x86_64-pc-windows-msvc",
|
|
]
|
|
# The archive format to use for windows builds (defaults .zip)
|
|
windows-archive = ".tar.gz"
|
|
# The archive format to use for non-windows builds (defaults .tar.xz)
|
|
unix-archive = ".tar.gz"
|
|
# Which actions to run on pull requests
|
|
pr-run-mode = "skip"
|
|
# Path that installers should place binaries in
|
|
install-path = "CARGO_HOME"
|
|
# Whether to install an updater program
|
|
install-updater = true
|
|
# Cache intermediate build artifacts to speed up the release pipelines
|
|
cache-builds = true
|
|
|
|
[workspace.metadata.dist.github-custom-runners]
|
|
aarch64-unknown-linux-gnu = "ubuntu-24.04-arm"
|
|
x86_64-unknown-linux-gnu = "ubuntu-22.04"
|
|
x86_64-pc-windows-msvc = "windows-2022"
|
|
x86_64-apple-darwin = "macos-15-intel"
|
|
aarch64-apple-darwin = "macos-14"
|