Files

T

History

AthenaandCursor 1f6beed0d2 feat(security): SSRF guard on fetch_url + single-use tool-approval tokens

Two tool/agent-layer hardening changes:

* fetch_url now resolves the target host and refuses to connect if any
  resolved address is loopback, private (RFC1918/ULA), link-local (incl. the
  169.254.169.254 cloud-metadata endpoint), multicast, reserved, or
  unspecified. IPv4-mapped IPv6 is unwrapped first, and the guard re-runs on
  every redirect hop so a public URL cannot 302 its way to an internal target.

* /chat/approve now requires a single-use token minted when the stream pauses
  for approval and delivered only in that stream's tool_request event, compared
  in constant time. Previously the pending approval was keyed solely on a
  client-supplied conversation_id, so anyone who could enumerate a
  conversation_id could approve another client's pending action.

The frontend threads the token from the tool_request event into the approve
call.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-07 09:41:09 -05:00

public

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

src

feat(security): SSRF guard on fetch_url + single-use tool-approval tokens

2026-08-07 09:41:09 -05:00

.gitignore

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

.nvmrc

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

eslint.config.js

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

index.html

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

package-lock.json

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

package.json

fix(install): install Node 20 on Linux; Vite needs it

2026-07-23 16:18:35 -05:00

README.md

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

vite.config.js

feat: put ncp on PATH on both platforms; rename WSL reqs to Windows

2026-07-22 14:11:18 -05:00

README.md

React + Vite

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

Currently, two official plugins are available:

@vitejs/plugin-react uses Oxc
@vitejs/plugin-react-swc uses SWC

React Compiler

The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see this documentation.

Expanding the ESLint configuration

If you are developing a production application, we recommend using TypeScript with type-aware lint rules enabled. Check out the TS template for information on how to integrate TypeScript and typescript-eslint in your project.