cfd5ca07ec
Repo-side hardening and tooling from the intensive test round (none of this ships in the app installer). - gateway: registry.json (holds bearer tokens) now gets a best-effort owner-only NTFS ACL on Windows via `icacls /inheritance:r /grant:r <user>:F` (the chmod 0600 is a no-op on NTFS); verified the file ends up <user>:(F) only. - gateway: connect_server now reads the app version from the real get_system_info shape (data.app.version / data.agent.version), so "connected to vX.Y.Z" works. - gateway: read_log tool description documents grep as a case-insensitive substring filter with "|" alternation (not a regex), matching the agent-side change. - gateway: standalone verification harnesses moved to gateway/verify/ (so `node --test` only sweeps real unit tests) and exposed via `npm run verify`: e2e-verify, integration-mcp (live gateway-MCP <-> agent, all 14 tools), and adversarial-probe (redaction fuzz + ReDoS + lockout). `npm test` runs the units. - eslint: gateway/** now lints as ESM (sourceType module) via a dedicated block; global ignores fixed so `eslint .` is clean across the whole project (0 errors). - docs/remote-diagnostics-setup.md: made the transport story honest — the agent speaks plaintext ws:// over enforced loopback; the SSH/WireGuard tunnel is the ONLY confidentiality layer (wss/TLS + cert-pin is a documented future mode, not active). Removed the stale "bind to a LAN/VPN IP" guidance (loopback is enforced). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
104 lines
2.9 KiB
JavaScript
104 lines
2.9 KiB
JavaScript
import security from 'eslint-plugin-security';
|
|
|
|
const sharedRules = {
|
|
// Security rules
|
|
// detect-object-injection disabled: 78 false positives from config lookups like obj[hosterName]
|
|
'security/detect-object-injection': 'off',
|
|
'security/detect-non-literal-regexp': 'warn',
|
|
'security/detect-unsafe-regex': 'warn',
|
|
'security/detect-buffer-noassert': 'warn',
|
|
'security/detect-eval-with-expression': 'error',
|
|
'security/detect-no-csrf-before-method-override': 'warn',
|
|
'security/detect-possible-timing-attacks': 'warn',
|
|
'security/detect-pseudoRandomBytes': 'warn',
|
|
// Code quality
|
|
'no-unused-vars': ['warn', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
|
|
'no-undef': 'error',
|
|
'no-constant-condition': 'warn',
|
|
'no-debugger': 'error',
|
|
'no-duplicate-case': 'error',
|
|
'no-empty': ['warn', { allowEmptyCatch: true }],
|
|
'no-ex-assign': 'error',
|
|
'no-extra-boolean-cast': 'warn',
|
|
'no-func-assign': 'error',
|
|
'no-inner-declarations': 'error',
|
|
'no-irregular-whitespace': 'error',
|
|
'no-unreachable': 'error',
|
|
'use-isnan': 'error',
|
|
'valid-typeof': 'error',
|
|
'eqeqeq': ['warn', 'always'],
|
|
'no-caller': 'error',
|
|
'no-eval': 'error',
|
|
'no-implied-eval': 'error',
|
|
'no-new-func': 'error',
|
|
'no-throw-literal': 'warn',
|
|
'no-self-assign': 'error',
|
|
'no-self-compare': 'error',
|
|
'no-loss-of-precision': 'error',
|
|
'no-dupe-keys': 'error',
|
|
'no-unsafe-finally': 'error',
|
|
'no-unmodified-loop-condition': 'warn',
|
|
'no-template-curly-in-string': 'warn',
|
|
};
|
|
|
|
const nodeGlobals = {
|
|
process: 'readonly',
|
|
console: 'readonly',
|
|
setTimeout: 'readonly',
|
|
clearTimeout: 'readonly',
|
|
setInterval: 'readonly',
|
|
clearInterval: 'readonly',
|
|
setImmediate: 'readonly',
|
|
Buffer: 'readonly',
|
|
URL: 'readonly',
|
|
URLSearchParams: 'readonly',
|
|
fetch: 'readonly',
|
|
crypto: 'readonly',
|
|
};
|
|
|
|
export default [
|
|
{ ignores: ['**/node_modules/**', 'release/**', 'tests/**'] },
|
|
{
|
|
files: ['**/*.js'],
|
|
ignores: ['gateway/**'],
|
|
plugins: { security },
|
|
languageOptions: {
|
|
ecmaVersion: 2022,
|
|
sourceType: 'commonjs',
|
|
globals: {
|
|
require: 'readonly',
|
|
module: 'readonly',
|
|
exports: 'readonly',
|
|
__dirname: 'readonly',
|
|
__filename: 'readonly',
|
|
...nodeGlobals,
|
|
AbortController: 'readonly',
|
|
AbortSignal: 'readonly',
|
|
navigator: 'readonly',
|
|
document: 'readonly',
|
|
window: 'readonly',
|
|
localStorage: 'readonly',
|
|
HTMLElement: 'readonly',
|
|
alert: 'readonly',
|
|
confirm: 'readonly',
|
|
requestAnimationFrame: 'readonly',
|
|
queueMicrotask: 'readonly',
|
|
Intl: 'readonly',
|
|
EventSource: 'readonly',
|
|
}
|
|
},
|
|
rules: sharedRules
|
|
},
|
|
{
|
|
files: ['gateway/**/*.js', 'gateway/**/*.mjs'],
|
|
ignores: ['gateway/node_modules/**'],
|
|
plugins: { security },
|
|
languageOptions: {
|
|
ecmaVersion: 2022,
|
|
sourceType: 'module',
|
|
globals: nodeGlobals
|
|
},
|
|
rules: sharedRules
|
|
}
|
|
];
|