mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 04:31:39 +00:00
8592b87c39
* fix(node-pairing): require operator.admin to approve fs.listDir nodes (#105936) * fix(gateway): align node command authorization --------- Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
33 lines
1.2 KiB
TypeScript
33 lines
1.2 KiB
TypeScript
// Node tool command names shared by routing, auth, and approval surfaces.
|
|
export const NODE_SYSTEM_RUN_COMMANDS = [
|
|
"system.run.prepare",
|
|
"system.run",
|
|
"system.which",
|
|
] as const;
|
|
|
|
export const NODE_SYSTEM_NOTIFY_COMMAND = "system.notify";
|
|
export const NODE_FS_LIST_DIR_COMMAND = "fs.listDir";
|
|
export const NODE_BROWSER_PROXY_COMMAND = "browser.proxy";
|
|
export const NODE_MCP_TOOLS_CALL_COMMAND = "mcp.tools.call.v1";
|
|
export const NODE_AGENT_CLI_CLAUDE_RUN_COMMAND = "agent.cli.claude.run.v1";
|
|
export const NODE_EXEC_APPROVALS_COMMANDS = [
|
|
"system.execApprovals.get",
|
|
"system.execApprovals.set",
|
|
] as const;
|
|
|
|
// Direct node.invoke and pairing approval share this admin-only subset.
|
|
export const NODE_ADMIN_ONLY_INVOKE_COMMANDS = [
|
|
NODE_BROWSER_PROXY_COMMAND,
|
|
NODE_FS_LIST_DIR_COMMAND,
|
|
] as const;
|
|
|
|
// Pairing also protects commands whose execution uses a separate gated path.
|
|
export const NODE_ADMIN_PAIR_APPROVAL_COMMANDS = [
|
|
...NODE_SYSTEM_RUN_COMMANDS,
|
|
...NODE_ADMIN_ONLY_INVOKE_COMMANDS,
|
|
...NODE_EXEC_APPROVALS_COMMANDS,
|
|
] as const;
|
|
|
|
export const NODE_MCP_TOOL_CALL_TIMEOUT_MS = 120_000;
|
|
export const NODE_MCP_TOOL_CALL_GATEWAY_TIMEOUT_MS = NODE_MCP_TOOL_CALL_TIMEOUT_MS + 5_000;
|