agent-zero/api
Alessandro ca4efe6e6a Fix Tailscale Remote Control CSRF origins
Normalize active Remote Control URLs to same-origin values before adding them to CSRF allowlists, so Tailscale Funnel URLs with paths or trailing slashes can bootstrap tokens correctly.

Allow WebSocket origin validation to trust only the currently active Remote Control origin, including Docker split-process tunnel service URLs, while preserving rejection for unrelated external origins.

Add focused regression coverage for active Tailscale-style origins, tunnel-service origin lookup, and negative cross-origin cases; keep run_ui decorator re-exports compatible with existing CSRF tests.
2026-06-04 14:54:39 +02:00
..
agent_profile_set.py Make agent profiles context scoped 2026-04-26 22:27:35 +02:00
AGENTS.md Add AGENTS.md DOX files and migrate docs 2026-06-01 13:55:07 +02:00
agents.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
api_files_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
api_log_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
api_message.py Persist API chat lifetime and add cleanup job 2026-05-11 08:49:06 +02:00
api_reset_chat.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
api_terminate_chat.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_create.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_get_defaults.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_inspect.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_preview_grouped.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_restore.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_restore_preview.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
backup_test.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
banners.py Refactor extensions to async/sync API 2026-03-06 11:32:08 +01:00
cache_reset.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
chat_create.py feat: Standalone preset storage, override permission hardening & bug fixes 2026-03-18 06:49:54 -07:00
chat_export.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
chat_files_path_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
chat_load.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
chat_remove.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
chat_reset.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
csrf_token.py Fix Tailscale Remote Control CSRF origins 2026-06-04 14:54:39 +02:00
ctx_window_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
delete_work_dir_file.py Add Time Travel workspace history 2026-04-27 01:27:20 +02:00
delete_work_dir_files.py Add file browser search and bulk actions 2026-05-02 19:44:13 +02:00
download_work_dir_file.py Add directory ZIP downloads to file browser 2026-05-02 19:30:42 +02:00
download_work_dir_files.py Refactor: use user locale for time displays 2026-05-21 15:26:00 +02:00
edit_work_dir_file.py Add Time Travel workspace history 2026-04-27 01:27:20 +02:00
file_info.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
get_work_dir_files.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
health.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
history_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
image_get.py fix(api): resolve image_get containment bypass (#1609) 2026-05-12 04:15:10 +02:00
load_webui_extensions.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
logout.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
mcp_server_get_detail.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
mcp_server_get_log.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
mcp_servers_apply.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
mcp_servers_status.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
message.py refactor(chat_branching): ID-based log ↔ history linking for precise branch trimming 2026-03-24 03:04:09 -07:00
message_async.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
message_queue_add.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
message_queue_remove.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
message_queue_send.py Fix message queue persistence after auto-send 2026-05-19 14:07:09 +00:00
notification_create.py Refactor: use user locale for time displays 2026-05-21 15:26:00 +02:00
notifications_clear.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
notifications_history.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
notifications_mark_read.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
nudge.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
pause.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
plugins.py Refactor: use user locale for time displays 2026-05-21 15:26:00 +02:00
plugins_list.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
poll.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
projects.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
rename_work_dir_file.py Add Time Travel workspace history 2026-04-27 01:27:20 +02:00
restart.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
rfc.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_task_create.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_task_delete.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_task_run.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_task_update.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_tasks_list.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
scheduler_tick.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
self_update_get.py Update system prototype 2026-03-24 13:49:12 +01:00
self_update_schedule.py Update system prototype 2026-03-24 13:49:12 +01:00
self_update_tags.py Replace hardcoded SUPPORTED_BRANCHES with dynamic branch discovery from remote repository 2026-03-26 11:30:17 +01:00
settings_get.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
settings_set.py Refactor: use user locale for time displays 2026-05-21 15:26:00 +02:00
settings_workdir_file_structure.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
skills.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
skills_import.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
skills_import_preview.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
subagents.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
tunnel.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
tunnel_proxy.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
upload.py BIG PYTHON REFACTOR 2026-03-05 17:28:11 +01:00
upload_work_dir_files.py Add Time Travel workspace history 2026-04-27 01:27:20 +02:00
ws_dev_test.py fix: WsDevTest non-standard error format and align doc examples 2026-03-27 23:34:52 -07:00
ws_hello.py refactor: Backend core rewrite - WsHandler + WsManager + handler migration 2026-03-26 00:58:01 -07:00
ws_webui.py refactor: Backend core rewrite - WsHandler + WsManager + handler migration 2026-03-26 00:58:01 -07:00