mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
b1c5f36076
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.
- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
github advisory, agent-vfc title); reviewer = "pending" means title, a
named reviewer means reviewed, reviewed without a reviewer is rejected;
per_tier metrics in the payload; select_tier and GATING_TIERS for the
improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
row and training manifest row; title rows enter catalog.toml; the
catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
75 lines
2.5 KiB
TypeScript
75 lines
2.5 KiB
TypeScript
// Provenance: Cap-go/capgo.app (vuln).
|
|
// repo: Cap-go/capgo.app
|
|
// commit: 8c0ac7e233946abd8dc26581b871e9fcd0928899
|
|
// parent: 8c0ac7e233946abd8dc26581b871e9fcd0928899
|
|
// commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59
|
|
// cve:
|
|
// license: AGPL-3.0
|
|
// function: createHono
|
|
// relpath: supabase/functions/_backend/utils/hono.ts
|
|
// provenance: agent
|
|
// mechanism: permissive_default
|
|
|
|
export function createHono(functionName: string, _version: string) {
|
|
let appGlobal
|
|
if (getRuntimeKey() === 'deno') {
|
|
appGlobal = new Hono<MiddlewareKeyVariables>().basePath(`/${functionName}`)
|
|
}
|
|
else {
|
|
appGlobal = new Hono<MiddlewareKeyVariables>()
|
|
}
|
|
|
|
// Plugin hot paths (/updates|/stats|/channel_self and the CF plugin worker).
|
|
// HAR/CPU inspect showed middleware + logging dominating non-DB request cost.
|
|
const pluginHotPath = functionName === 'plugin'
|
|
|| functionName === 'updates'
|
|
|| functionName === 'stats'
|
|
|| functionName === 'channel_self'
|
|
|
|
appGlobal.use('*', (c, next): Promise<any> => {
|
|
// ADD HEADER TO IDENTIFY WORKER SOURCE
|
|
const name = `${getEnv(c, 'ENV_NAME') || functionName}-${CapgoVersion}`
|
|
c.header('X-Worker-Source', name)
|
|
const hostname = new URL(c.req.url).hostname
|
|
if (!isPreviewHost(hostname))
|
|
c.header('Content-Security-Policy', API_CONTENT_SECURITY_POLICY)
|
|
return next()
|
|
})
|
|
|
|
// Skip hono's access logger on plugin hot paths — it serializes every request
|
|
// on millions of device calls/day.
|
|
if (!pluginHotPath)
|
|
appGlobal.use('*', logger())
|
|
// Use platform-specific request IDs, fallback to generated UUID.
|
|
// Do not cloudlog inside the generator: it runs on every request (incl. cf-ray).
|
|
appGlobal.use('*', requestId({
|
|
generator: (c) => {
|
|
// Cloudflare provides the Ray ID in the cf-ray header
|
|
// Check this first as it's our primary deployment target
|
|
const cfRay = c.req.header('cf-ray')
|
|
if (cfRay)
|
|
return cfRay
|
|
// Supabase Edge Functions provide SB_EXECUTION_ID
|
|
const sbExecutionId = getEnv(c, 'SB_EXECUTION_ID')
|
|
if (sbExecutionId)
|
|
return sbExecutionId
|
|
// Fallback to crypto.randomUUID() if not on any known platform
|
|
return crypto.randomUUID()
|
|
},
|
|
}))
|
|
|
|
appGlobal.post('/ok', (c) => {
|
|
return c.json(BRES)
|
|
})
|
|
appGlobal.post('/ko', (c) => {
|
|
const defaultResponse: SimpleErrorResponse = {
|
|
error: 'unknown_error',
|
|
message: 'KO',
|
|
moreInfo: {},
|
|
}
|
|
return c.json(defaultResponse, 500)
|
|
})
|
|
|
|
return appGlobal
|
|
}
|