mirror of
https://github.com/rowboatlabs/rowboat.git
synced 2026-07-12 21:02:17 +02:00
3e34cbe1af
- checkCapability choke point (D7): tools/llm/copilot access requires the capability in the app's manifest; 403 capability_not_declared otherwise - POST /_rowboat/tools/search|execute: Composio pass-through with the same request shape as the builtin, typed error mapping - POST /_rowboat/fetch: SSRF-guarded proxy (loopback/RFC1918/link-local/ULA/ *.localhost rejection re-checked per redirect hop, 5MB cap + truncated flag, 30s timeout, Host/Cookie stripped) - POST /_rowboat/llm/generate: default-model plumbing, override validated against the allowed set, token/concurrency caps, usage attributed app_llm_generate/<folder> - POST /_rowboat/copilot/run: headless run (bg-task tool profile, no shell), app-attributed audit turn with origin context, 10-min timeout, 1-per-app cap - registered M2 routes are POST-only (GETs are D17-exempt and must not reach them) - bundled agents (§8): strict AppAgentDefinitionSchema, deterministic app--<folder>--<name> slugs materialized disabled with sourceApp, manifest removals deactivate, app delete removes owned tasks; sourceApp in summaries - new use cases app_llm_generate / app_copilot_run in runs + analytics enums |
||
|---|---|---|
| .. | ||
| cli | ||
| docs | ||
| experimental | ||
| python-sdk | ||
| rowboat | ||
| rowboatx | ||
| x | ||