mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-07 16:19:09 +00:00
Some checks are pending
CI / Lint (push) Waiting to run
CI / Format check (push) Waiting to run
CI / Unit tests (push) Waiting to run
CI / Playwright E2E (push) Waiting to run
CI / Docker build smoke (push) Waiting to run
CI / Triage ledger up to date (push) Waiting to run
CI / ui bun.lock in sync (push) Waiting to run
* feat: port plan-review & workflow-approval UX (#135)
Port six upstream commits onto dev:
- c03a6be7 (already ported): keep plan guidance high-level
- 546042a4: add workflow approval UI with diff preview, approval URLs,
web review links, and polling for approval status during active runs
- 216cf181: remove workflow token elevation; approved pushes pass
through directly without proxy token rewriting
- 3dbc0282: preserve plan redirects after login by accepting relative
same-origin redirect_to values and rejecting blocked paths
- bb104d93: submit plan comments with cmd+enter
- 90cb6caa: terse Slack replies, shared content via save_plan outside
plan mode (PLAN_STATUS_SHARED), reject shared-content mutations
Refs: #135
* fix: restore login page render and clear CI lint/format
The plan-review port removed the authRedirectUrl import from login.tsx
but left its call site, crashing the login page at runtime (blank page,
no 'Sign in to open-swe'). Pass the relative path straight to loginUrl,
matching the plan route and the backend relative-redirect handling.
Also drop an unused os import in the guard test and reformat
workflow_push_guard.py to satisfy ruff.
* fix: carry workflows:write on the standing proxy token
Complete the half-ported upstream 216cf181 cascade. The port dropped
_run_with_workflow_token from the guard but missed the paired github_app
change, so an approved .github/workflows push ran with the base token
(no workflows:write) and GitHub 403'd it.
Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the
now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the
github_app and proxy_auth tests to match. The HITL approval gate in
workflow_push_guard.py is unchanged — this only lets the standing token
push once a human approves.
* fix: restore transient workflow-token elevation (revert standing workflows:write)
The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is
ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push
guard the sole control over unapproved workflow pushes. The guard's git-push
parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT,
fully-qualified cross-branch refspecs); with a permanently workflows-scoped
token those gaps become live unapproved-workflow-push exploits (1 critical, 2
high — security review BLOCK on #159).
Restore dev's transient-elevation model:
- Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the
WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write).
- Re-introduce _run_with_workflow_token in the guard: it mints the
workflows-scoped token via refresh_proxy_token around the approved,
guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a
finally. Route the approval branch through it.
- Restore the dev token/elevation tests.
The standing token no longer carries workflows:write, so the three parser
bypasses hit GitHub 403 again; an approved push still succeeds because the
elevation grants workflows:write only around the normalized command. Keeps all
of #159's diff-preview / approval-URL / Slack-card guard additions.
* fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect)
sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can
resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes
same-origin, passing the origin check, but yields a path starting with `//`).
ClientRedirect / login.tsx feed that path to window.location.replace, so it
navigates cross-origin — an open redirect. Reject any resolved path that is not
a single-leading-slash path (`^/[^/]`), falling back to the default. Adds
coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`.
* fix: log SECURITY error when workflow-token downscope fails
The elevate->push->downscope finally block was silent on failure. If both
refresh_proxy_token calls fail, the sandbox retains workflows:write for the
rest of the run with no signal. Log a SECURITY error on the partial and full
downscope-failure paths so the retention is observable.
Addresses the GPT-4.1 cross-family review of the token-scope remediation.
---------
Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com>
Co-authored-by: Adam Moussa <adam@seahavenind.com>
132 lines
3.2 KiB
TypeScript
132 lines
3.2 KiB
TypeScript
/**
|
|
* Client for the plan-review API — plain HTTP, no realtime transport.
|
|
*
|
|
* The agent publishes the plan markdown; reviewers read it and leave
|
|
* whole-document comments. On approve/reject the server reads those comments and
|
|
* hands them to the agent as the instruction for the follow-up run.
|
|
*/
|
|
|
|
const API_BASE = (import.meta.env.VITE_DASHBOARD_API_BASE_URL ?? "").replace(
|
|
/\/$/,
|
|
""
|
|
)
|
|
|
|
function apiBase(): string {
|
|
if (API_BASE) return API_BASE
|
|
return typeof window !== "undefined" ? window.location.origin : ""
|
|
}
|
|
|
|
export interface PlanUser {
|
|
id: string
|
|
login: string
|
|
email: string | null
|
|
name: string
|
|
}
|
|
|
|
export type PlanStatus =
|
|
"planning" | "ready" | "shared" | "revising" | "approved" | "cancelled"
|
|
|
|
export interface PlanData {
|
|
threadId: string
|
|
status: PlanStatus
|
|
markdown: string
|
|
isOwner: boolean
|
|
user: PlanUser
|
|
}
|
|
|
|
export interface PlanComment {
|
|
id: string
|
|
author: string
|
|
author_login: string
|
|
body: string
|
|
created_at: string
|
|
}
|
|
|
|
export class PlanApiError extends Error {
|
|
constructor(
|
|
public readonly status: number,
|
|
message: string
|
|
) {
|
|
super(message)
|
|
this.name = "PlanApiError"
|
|
}
|
|
}
|
|
|
|
async function req<T>(path: string, init: RequestInit = {}): Promise<T> {
|
|
const res = await fetch(`${apiBase()}/dashboard/api${path}`, {
|
|
...init,
|
|
credentials: "include",
|
|
headers: { "Content-Type": "application/json", ...(init.headers ?? {}) },
|
|
})
|
|
if (!res.ok) {
|
|
let message = res.statusText
|
|
try {
|
|
const body = await res.json()
|
|
if (body?.detail)
|
|
message =
|
|
typeof body.detail === "string"
|
|
? body.detail
|
|
: JSON.stringify(body.detail)
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
throw new PlanApiError(res.status, message)
|
|
}
|
|
if (res.status === 204) return undefined as T
|
|
return (await res.json()) as T
|
|
}
|
|
|
|
export function getPlan(threadId: string): Promise<PlanData> {
|
|
return req<PlanData>(`/plan/${encodeURIComponent(threadId)}`)
|
|
}
|
|
|
|
export async function getPlanComments(
|
|
threadId: string
|
|
): Promise<Array<PlanComment>> {
|
|
const { comments } = await req<{ comments: Array<PlanComment> }>(
|
|
`/plan/${encodeURIComponent(threadId)}/comments`
|
|
)
|
|
return comments
|
|
}
|
|
|
|
export function addPlanComment(
|
|
threadId: string,
|
|
body: string
|
|
): Promise<PlanComment> {
|
|
return req(`/plan/${encodeURIComponent(threadId)}/comments`, {
|
|
method: "POST",
|
|
body: JSON.stringify({ body }),
|
|
})
|
|
}
|
|
|
|
export function deletePlanComment(
|
|
threadId: string,
|
|
commentId: string
|
|
): Promise<{ ok: boolean }> {
|
|
return req(
|
|
`/plan/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`,
|
|
{ method: "DELETE" }
|
|
)
|
|
}
|
|
|
|
export function updatePlan(
|
|
threadId: string,
|
|
markdown: string
|
|
): Promise<{ status: PlanStatus; markdown: string }> {
|
|
return req(`/plan/${encodeURIComponent(threadId)}`, {
|
|
method: "PUT",
|
|
body: JSON.stringify({ markdown }),
|
|
})
|
|
}
|
|
|
|
export function approvePlan(threadId: string): Promise<{ status: string }> {
|
|
return req(`/plan/${encodeURIComponent(threadId)}/approve`, {
|
|
method: "POST",
|
|
})
|
|
}
|
|
|
|
export function rejectPlan(threadId: string): Promise<{ status: string }> {
|
|
return req(`/plan/${encodeURIComponent(threadId)}/reject`, {
|
|
method: "POST",
|
|
})
|
|
}
|