程序员阿江(Relakkes) a5cc7ff0c1 Tighten H5 policy trusted routes ...

The classifier should not treat every /sdk path as trusted by pathname, because LAN-exposed servers already have a narrower local SDK trust boundary.

Constraint: Desktop local chat, Tauri WebView, loopback adapters, and local SDK routes must remain tokenless.

Rejected: Path-only /sdk trust | a non-local caller could reach the SDK route through a LAN-bound server.

Confidence: high

Scope-risk: narrow

Directive: Keep remote /sdk and hostile-origin loopback requests in the H5/browser bucket unless a dedicated SDK auth layer is verified.

Tested: bun test src/server/__tests__/h5-access-policy.test.ts

2026-05-12 14:26:00 +08:00

..

e2e

fix: keep completed task lists from leaking into the next turn

2026-04-21 00:46:29 +08:00

fixtures

fix: wait for sdk socket before context inspection

2026-05-05 20:10:04 +08:00

adapters.test.ts

fix: clear DingTalk bot credentials through explicit unbind

2026-05-05 19:30:43 +08:00

computer-use-api.test.ts

feat: support custom Computer Use Python interpreters

2026-05-09 21:46:11 +08:00

computer-use-python.test.ts

feat: support custom Computer Use Python interpreters

2026-05-09 21:46:11 +08:00

computer-use-requirements.test.ts

fix: restore computer use setup for python 3.8

2026-04-22 14:28:36 +08:00

conversation-service.test.ts

feat: align desktop repository sessions with CLI worktrees

2026-05-08 16:46:51 +08:00

conversations.test.ts

fix(desktop): avoid duplicate worktree startup status

2026-05-10 12:16:15 +08:00

cron-scheduler-launcher.test.ts

Merge chat scroll recovery into main

2026-05-09 21:52:31 +08:00

cron-scheduler.test.ts

feat: complete server-side gaps — tool visibility, cron execution engine, team real-time push

2026-04-05 14:42:32 +08:00

desktop-cli-launcher.test.ts

Expose the bundled desktop CLI outside the app

2026-04-23 12:12:49 +08:00

diagnostics-service.test.ts

fix: keep startup failures visible in terminals

2026-05-07 16:50:20 +08:00

doctor-service.test.ts

fix: add safe Doctor rescue path for desktop upgrades

2026-05-07 00:04:06 +08:00

filesystem.test.ts

fix: preserve historical workspace changes on windows

2026-05-02 17:53:24 +08:00

h5-access-api.test.ts

Add a durable H5 access control surface for remote browser setup

2026-05-09 23:22:55 +08:00

h5-access-auth.test.ts

Keep H5 access open while token auth is paused

2026-05-11 17:59:03 +08:00

h5-access-policy.test.ts

Tighten H5 policy trusted routes

2026-05-12 14:26:00 +08:00

h5-access-service.test.ts

fix(desktop): refresh stale H5 LAN URLs

2026-05-10 20:48:03 +08:00

haha-oauth-api.test.ts

Keep desktop replies stable across turns and fix OAuth callback routing

2026-04-18 17:01:53 +08:00

haha-oauth-service.test.ts

fix: preserve historical workspace changes on windows

2026-05-02 17:53:24 +08:00

haha-openai-oauth-api.test.ts

fix: desktop and more test

2026-05-04 17:57:03 +08:00

haha-openai-oauth-service.test.ts

fix: desktop and more test

2026-05-04 17:57:03 +08:00

mcp.test.ts

feat: add a desktop setup terminal without blocking shell restarts

2026-04-22 18:06:29 +08:00

persistence-upgrade.test.ts

fix: prevent upgrade crashes from stale persistence

2026-05-06 23:20:21 +08:00

plugins.test.ts

Expose desktop plugin management through first-class APIs

2026-04-21 23:21:16 +08:00

provider-presets.test.ts

fix: raise featured Sonnet provider context windows

2026-05-05 17:28:28 +08:00

providers-real.test.ts

Stop bearer providers from inheriting local API keys

2026-05-08 15:20:45 +08:00

providers.test.ts

Stop bearer providers from inheriting local API keys

2026-05-08 15:20:45 +08:00

proxy-streaming.test.ts

Fix local proxy tool calls for real provider responses

2026-05-06 11:39:10 +08:00

proxy-transform.test.ts

Fix local proxy tool calls for real provider responses

2026-05-06 11:39:10 +08:00

real-llm-test.ts

feat(agents): update API types, store, i18n, and tests for new agent model

2026-04-09 16:45:51 +08:00

scheduled-tasks.test.ts

Support provider runtimes for scheduled tasks

2026-05-08 09:49:16 +08:00

sessions.test.ts

Make desktop session cleanup practical at list scale

2026-05-12 13:42:45 +08:00

settings.test.ts

feat: add desktop token usage activity view

2026-05-10 11:37:49 +08:00

skills.test.ts

Restore desktop project-skill discovery and align empty-session composer

2026-04-20 13:36:19 +08:00

tasks.test.ts

feat: add CLI subprocess chat, Agent Teams API, and real background tasks

2026-04-05 14:05:22 +08:00

team-watcher.test.ts

chore: update cluade model name

2026-04-18 20:34:56 +08:00

teams.test.ts

chore: update cluade model name

2026-04-18 20:34:56 +08:00

title-service.test.ts

fix: sanitize generated session titles

2026-05-09 22:34:27 +08:00

websocket-handler.test.ts

Prevent IM chats from reusing deleted desktop sessions

2026-05-08 09:58:24 +08:00

workspace-service.test.ts

fix: preserve historical workspace changes on windows

2026-05-02 17:53:24 +08:00