vikingowl
0728262a9e
BREAKING CHANGES: - owlen-core no longer depends on ratatui/crossterm - RemoteMcpClient constructors are now async - MCP path validation is stricter (security hardening) This commit resolves three critical issues identified in project analysis: ## P0-1: Extract TUI dependencies from owlen-core Create owlen-ui-common crate to hold UI-agnostic color and theme abstractions, removing architectural boundary violation. Changes: - Create new owlen-ui-common crate with abstract Color enum - Move theme.rs from owlen-core to owlen-ui-common - Define Color with Rgb and Named variants (no ratatui dependency) - Create color conversion layer in owlen-tui (color_convert.rs) - Update 35+ color usages with conversion wrappers - Remove ratatui/crossterm from owlen-core dependencies Benefits: - owlen-core usable in headless/CLI contexts - Enables future GUI frontends - Reduces binary size for core library consumers ## P0-2: Fix blocking WebSocket connections Convert RemoteMcpClient constructors to async, eliminating runtime blocking that froze TUI for 30+ seconds on slow connections. Changes: - Make new_with_runtime(), new_with_config(), new() async - Remove block_in_place wrappers for I/O operations - Add 30-second connection timeout with tokio::time::timeout - Update 15+ call sites across 10 files to await constructors - Convert 4 test functions to #[tokio::test] Benefits: - TUI remains responsive during WebSocket connections - Proper async I/O follows Rust best practices - No more indefinite hangs ## P1-1: Secure path traversal vulnerabilities Implement comprehensive path validation with 7 defense layers to prevent file access outside workspace boundaries. Changes: - Create validate_safe_path() with multi-layer security: * URL decoding (prevents %2E%2E bypasses) * Absolute path rejection * Null byte protection * Windows-specific checks (UNC/device paths) * Lexical path cleaning (removes .. components) * Symlink resolution via canonicalization * Boundary verification with starts_with check - Update 4 MCP resource functions (get/list/write/delete) - Add 11 comprehensive security tests Benefits: - Blocks URL-encoded, absolute, UNC path attacks - Prevents null byte injection - Stops symlink escape attempts - Cross-platform security (Windows/Linux/macOS) ## Test Results - owlen-core: 109/109 tests pass (100%) - owlen-tui: 52/53 tests pass (98%, 1 pre-existing failure) - owlen-providers: 2/2 tests pass (100%) - Build: cargo build --all succeeds ## Verification - ✓ cargo tree -p owlen-core shows no TUI dependencies - ✓ No block_in_place calls remain in MCP I/O code - ✓ All 11 security tests pass Fixes: #P0-1, #P0-2, #P1-1 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
53 lines
1.5 KiB
TOML
53 lines
1.5 KiB
TOML
[package]
|
|
name = "owlen-core"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
authors.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
homepage.workspace = true
|
|
description = "Core traits and types for OWLEN LLM client"
|
|
|
|
[dependencies]
|
|
owlen-ui-common = { path = "../owlen-ui-common" }
|
|
anyhow = { workspace = true }
|
|
log = { workspace = true }
|
|
regex = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
unicode-segmentation = "1.11"
|
|
unicode-width = "0.2"
|
|
uuid = { workspace = true }
|
|
textwrap = { workspace = true }
|
|
futures = { workspace = true }
|
|
futures-util = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
toml = { workspace = true }
|
|
shellexpand = { workspace = true }
|
|
dirs = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
jsonschema = { workspace = true }
|
|
which = { workspace = true }
|
|
nix = { workspace = true }
|
|
aes-gcm = { workspace = true }
|
|
ring = { workspace = true }
|
|
keyring = { workspace = true }
|
|
chrono = { workspace = true }
|
|
urlencoding = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
reqwest = { workspace = true, features = ["default"] }
|
|
path-clean = "1.0"
|
|
tokio-stream = { workspace = true }
|
|
tokio-tungstenite = "0.21"
|
|
tungstenite = "0.21"
|
|
ollama-rs = { version = "0.3", features = ["stream", "headers"] }
|
|
once_cell = { workspace = true }
|
|
base64 = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tokio-test = { workspace = true }
|
|
httpmock = "0.7"
|
|
wiremock = "0.6"
|