Skip to content

fix(security): remove internal infra hostnames from published package#8

Open
andrei-hasna wants to merge 1 commit into
mainfrom
fix/security-remove-internal-infra-hostnames
Open

fix(security): remove internal infra hostnames from published package#8
andrei-hasna wants to merge 1 commit into
mainfrom
fix/security-remove-internal-infra-hostnames

Conversation

@andrei-hasna

Copy link
Copy Markdown
Contributor

Summary

  • src/server/cloud/openapi.ts: the OpenAPI document's servers[0].url shipped a real internal hostname (https://logs.hasna.xyz). Replaced with the neutral, non-resolving placeholder https://your-deployment.example (plus a description telling operators to point it at their own deployment). Widened the local OpenApiDoc servers type to allow the (optional, spec-legal) description field.
  • src/lib/cloud-store.ts: neutralized the illustrative https://logs.hasna.xyz/v1/logs example in a doc comment. No functional change here — the actual default-hostname-guessing logic lives in the shared @hasna/contracts dependency (resolveStorageClient), which is fixed separately in fix(security): remove internal infra hostnames from published package contracts#18.
  • src/lib/cloud-store.test.ts: updated fixtures/expectations/test titles to the neutral placeholder domain.

Why

Public npm package shipped a real internal hostname in a checked-in OpenAPI spec and doc comments.

Note on test/typecheck execution in this environment

This repo declares @hasna/contracts, @hasna/mcp-harness, and @hasna/agent-registry as file:../<sibling> devDependencies pointing at sibling monorepo directories that don't exist in a standalone clone, so bun install can't fully resolve them here and bun run typecheck/bun test show pre-existing failures unrelated to this change. Verified this is 100% pre-existing by diffing typecheck error counts and full-suite pass/fail counts between this branch and unmodified mainidentical in both cases (35 typecheck errors; 324 pass / 41 fail / 3 errors in bun test). This PR introduces zero new failures.

Test plan

  • npx tsc --noEmit — 35 errors, identical count/content to unmodified main (all pre-existing missing-sibling-package errors); the one NEW error my change initially introduced (servers type mismatch from adding description) was fixed by widening the type, and is confirmed gone
  • bun test (full suite) — 324 pass / 41 fail / 3 errors, byte-for-byte identical to unmodified main
  • grep -rn "hasna\.xyz" across the repo — zero matches after this change

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant