Commit Graph
3 Commits
Author SHA1 Message Date
Cursor Agentandnsrb b181bd3414 fix(sandbox): allow localhost in axios URL screening
Self-hosted automation targets often run on localhost or loopback
addresses, so keep blocking private/metadata hosts but stop blocking
localhost, 127.x.x.x, and .localhost names.

Co-authored-by: Nasyarobby Putra <nasyarobby@gmail.com>
2026-08-14 05:01:45 +00:00
Cursor Agentandnsrb 8c9673444f feat(sandbox): expose screened $axios in script context
Add $axios to the VM sandbox with a request interceptor that blocks
non-http(s) URLs and common SSRF targets (localhost, private IPs,
link-local, and cloud metadata hosts). require('axios') and import
axios resolve to the same screened instance so scripts cannot bypass
URL screening.

Co-authored-by: Nasyarobby Putra <nasyarobby@gmail.com>
2026-08-14 04:56:25 +00:00
nsrb 5dc992a517 Add initial project structure with database setup, logging, and workflow management 2026-08-14 11:36:54 +07:00