源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)
This commit is contained in:
agent-radar
@@ -0,0 +1,346 @@
|
||||
{
|
||||
"hosts": [
|
||||
{
|
||||
"host": "accounts.google.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Google Workspace OAuth authorization page opened when a user connects Google Workspace.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Users cannot complete Google Workspace sign-in from OpenWork.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "api.github.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "GitHub API calls for importing and previewing GitHub-hosted Claude Code/OpenWork plugins.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "GitHub plugin import cannot inspect repositories, branches, or plugin manifests.",
|
||||
"override": "OPENWORK_GITHUB_API_BASE"
|
||||
},
|
||||
{
|
||||
"host": "api.githubcopilot.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Example remote MCP server URL for GitHub Copilot; reached only if a user configures that URL.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "A GitHub Copilot MCP connection using the example URL cannot connect.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "api.openai.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Direct OpenAI Realtime voice and image-generation calls when the user provides an OpenAI key.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Direct OpenAI voice or image features fail for users who configured OpenAI.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "api.openwork.software",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Legacy hosted OpenWork Connect API origin retained for older Cloud configurations.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Older hosted configurations that still use the legacy API origin cannot reconcile OpenWork Connect or native MCP Apps.",
|
||||
"override": "self-hosted Den API origin"
|
||||
},
|
||||
{
|
||||
"host": "api.openworklabs.com",
|
||||
"kind": "fetched",
|
||||
"components": ["installer", "server"],
|
||||
"purpose": "Legacy hosted OpenWork public API origin retained for older install and Cloud configurations.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Older hosted install or API configurations that still use this legacy origin cannot reach OpenWork Cloud.",
|
||||
"override": "installer apiUrl / self-hosted Den API origin"
|
||||
},
|
||||
{
|
||||
"host": "api.app.openworklabs.com",
|
||||
"kind": "fetched",
|
||||
"components": ["desktop", "renderer", "server"],
|
||||
"purpose": "Hosted OpenWork Den API origin derived from app.openworklabs.com for desktop Den API and OpenWork Connect MCP calls.",
|
||||
"requirement": "required-for-cloud",
|
||||
"blockedEffect": "Hosted Cloud desktop configuration, telemetry, sign-out, and OpenWork Connect MCP calls cannot reach the Den API.",
|
||||
"override": "desktop apiBaseUrl / self-hosted Den API origin"
|
||||
},
|
||||
{
|
||||
"host": "app.openwork.software",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Legacy hosted OpenWork Cloud web origin retained for older desktop configurations.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Older hosted configurations that still derive Den MCP calls from the legacy web origin cannot reconcile OpenWork Connect or native MCP Apps.",
|
||||
"override": "desktop base URL (self-hosted Den replaces this host)"
|
||||
},
|
||||
{
|
||||
"host": "app.openworklabs.com",
|
||||
"kind": "fetched",
|
||||
"components": ["desktop", "renderer", "bootstrap"],
|
||||
"purpose": "Hosted OpenWork Cloud web origin; the desktop derives Den API and MCP calls from this base URL.",
|
||||
"requirement": "required-for-cloud",
|
||||
"blockedEffect": "Hosted Cloud sign-in, org settings, marketplace, and remote workspace flows cannot load.",
|
||||
"override": "desktop base URL (self-hosted Den replaces this host)"
|
||||
},
|
||||
{
|
||||
"host": "cdn.simpleicons.org",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Brand icons for MCP and extension cards when a built-in local icon is not available.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Some provider icons are missing; the app still works.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "chat.googleapis.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Google Chat API calls for Google Workspace chat actions.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Google Chat spaces, messages, and send-message actions fail for connected Google Workspace accounts.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "code.claude.com",
|
||||
"kind": "link-only",
|
||||
"components": ["server"],
|
||||
"purpose": "Source-code comment pointing maintainers to the Claude Code plugin format reference.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "No runtime effect; it is not opened or fetched by OpenWork.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "discord.gg",
|
||||
"kind": "link-only",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Community link from Settings.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "The Discord community link will not open.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "ghcr.io",
|
||||
"kind": "subprocess",
|
||||
"components": ["den"],
|
||||
"purpose": "Container registry for self-hosted Den API, web, inference images, and Helm chart pulls.",
|
||||
"requirement": "required",
|
||||
"blockedEffect": "A self-hosted Den deployment cannot pull OpenWork images or the Helm chart from GitHub Container Registry.",
|
||||
"override": "container registry mirror / Helm image.repository values"
|
||||
},
|
||||
{
|
||||
"host": "github.com",
|
||||
"kind": "fetched",
|
||||
"components": ["desktop", "installer", "renderer", "server"],
|
||||
"purpose": "Desktop installer and updater release URLs, GitHub issue links, and GitHub plugin source URLs.",
|
||||
"requirement": "required-in-practice",
|
||||
"blockedEffect": "Desktop install/update downloads cannot start; GitHub issue and plugin-source links may not open.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "gmail.googleapis.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Gmail API calls for Google Workspace message search, reading, attachments, and draft creation.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Gmail read and draft actions fail for connected Google Workspace accounts.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "linear.app",
|
||||
"kind": "link-only",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Sample link in the deterministic demo transcript used to exercise link rendering.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Clicking that sample Linear link fails; OpenWork functionality is unaffected.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "mail.google.com",
|
||||
"kind": "link-only",
|
||||
"components": ["server"],
|
||||
"purpose": "Gmail draft and thread links returned after Google Workspace Gmail actions.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Generated Gmail draft/thread links cannot open in the user's browser.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "mcp.context7.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Context7 MCP Quick Connect preset.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Context7 MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "mcp.linear.app",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Linear MCP Quick Connect preset.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Linear MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "mcp.notion.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Notion MCP Quick Connect preset.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Notion MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "mcp.sentry.dev",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Sentry MCP Quick Connect preset.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Sentry MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "mcp.slack.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Slack MCP connection preset and OAuth guidance.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Slack MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "mcp.stripe.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer", "server"],
|
||||
"purpose": "Stripe MCP Quick Connect preset.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "The Stripe MCP connection cannot connect when enabled.",
|
||||
"override": "MCP server URL setting"
|
||||
},
|
||||
{
|
||||
"host": "models.openworklabs.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "First-party OpenCode model catalog mirror passed to managed OpenCode as OPENCODE_MODELS_URL.",
|
||||
"requirement": "required-in-practice",
|
||||
"blockedEffect": "The model catalog is unavailable or degraded; model selection may be stale or incomplete.",
|
||||
"override": "OPENCODE_MODELS_URL"
|
||||
},
|
||||
{
|
||||
"host": "oauth2.googleapis.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Google OAuth token exchange, refresh, and revocation for Google Workspace connections.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Google Workspace accounts cannot finish OAuth, refresh tokens, or revoke tokens cleanly.",
|
||||
"override": "OPENWORK_GOOGLE_WORKSPACE_TOKEN_BROKER_URL for token exchange/refresh only"
|
||||
},
|
||||
{
|
||||
"host": "release-assets.githubusercontent.com",
|
||||
"kind": "redirect-target",
|
||||
"components": ["desktop", "installer"],
|
||||
"purpose": "Current GitHub release-asset download target reached after github.com redirects installer and updater downloads. Verified live against a real OpenWork release asset.",
|
||||
"requirement": "required-in-practice",
|
||||
"blockedEffect": "OpenWork downloads start from github.com and then fail partway through when the redirect target is blocked.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "objects.githubusercontent.com",
|
||||
"kind": "redirect-target",
|
||||
"components": ["desktop", "installer"],
|
||||
"purpose": "Legacy GitHub release-asset download target. GitHub has migrated to release-assets.githubusercontent.com, but allow both so older clients and any staged rollback keep working.",
|
||||
"requirement": "required-in-practice",
|
||||
"blockedEffect": "OpenWork downloads start from github.com and then fail partway through if GitHub serves this legacy redirect target and it is blocked.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "ollama.com",
|
||||
"kind": "link-only",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Ollama download and library links in local model settings.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Users cannot open Ollama download/library links from the settings UI; local Ollama traffic remains loopback.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "opencode.ai",
|
||||
"kind": "fetched",
|
||||
"components": ["desktop", "renderer", "server"],
|
||||
"purpose": "Fallback OpenCode installer command plus OpenCode auth/docs links and config schema identifiers.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Guided fallback OpenCode installation and OpenCode web links fail; packaged builds still use bundled OpenCode.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "openwork.dev",
|
||||
"kind": "link-only",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Documentation and feedback links in the command palette.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Those external support links will not open.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "openworklabs.com",
|
||||
"kind": "link-only",
|
||||
"components": ["desktop", "renderer"],
|
||||
"purpose": "Documentation, feedback, support, and sample OpenWork links.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Documentation or feedback links do not open; core app networking is unaffected.",
|
||||
"override": "VITE_OPENWORK_FEEDBACK_URL for the feedback link only"
|
||||
},
|
||||
{
|
||||
"host": "raw.githubusercontent.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Raw file downloads for GitHub-hosted plugin manifests, MCP configs, skills, commands, and agents.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "GitHub plugin import can discover metadata but cannot download component contents.",
|
||||
"override": "OPENWORK_GITHUB_RAW_BASE"
|
||||
},
|
||||
{
|
||||
"host": "registry.npmjs.org",
|
||||
"kind": "subprocess",
|
||||
"components": ["desktop", "renderer"],
|
||||
"purpose": "npx package resolution for openwork-ui-mcp and development-only MCP helper commands.",
|
||||
"requirement": "required-in-practice",
|
||||
"blockedEffect": "The OpenWork UI-control MCP is silently unavailable when npx cannot download openwork-ui-mcp.",
|
||||
"override": "npm registry configuration used by npx"
|
||||
},
|
||||
{
|
||||
"host": "schemas.agentskills.io",
|
||||
"kind": "schema-string",
|
||||
"components": ["server"],
|
||||
"purpose": "Skill index $schema identifier used for validation; OpenWork does not fetch the schema URL.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "No runtime network effect.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "us.i.posthog.com",
|
||||
"kind": "fetched",
|
||||
"components": ["renderer"],
|
||||
"purpose": "Optional product analytics endpoint when analytics are enabled and a PostHog key is configured.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Analytics events are dropped silently; user-facing app behavior is unaffected.",
|
||||
"override": "VITE_OPENWORK_POSTHOG_HOST; users can disable analytics with the analyticsEnabled preference"
|
||||
},
|
||||
{
|
||||
"host": "www.google.com",
|
||||
"kind": "fetched",
|
||||
"components": ["desktop", "renderer"],
|
||||
"purpose": "Favicon image service and the embedded browser panel's user-created new-tab page.",
|
||||
"requirement": "optional",
|
||||
"blockedEffect": "Favicons may be missing and the browser panel's new tab page may not load.",
|
||||
"override": null
|
||||
},
|
||||
{
|
||||
"host": "www.googleapis.com",
|
||||
"kind": "fetched",
|
||||
"components": ["server"],
|
||||
"purpose": "Google profile, Calendar, and Drive API calls for Google Workspace connections.",
|
||||
"requirement": "opt-in",
|
||||
"blockedEffect": "Google profile, Calendar, and Drive actions fail for connected Google Workspace accounts.",
|
||||
"override": null
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
# Outbound network access for OpenWork
|
||||
|
||||
Status: maintainer pointer
|
||||
|
||||
The canonical machine-readable allowlist source is [`outbound-access.json`](./outbound-access.json). Keep new hosts, blocked effects, override names, and component ownership there first; CI validates it with `node scripts/check-outbound-access.mjs`.
|
||||
|
||||
The published customer-facing guidance lives in [`packages/docs/start-here/outbound-network-access.mdx`](../../packages/docs/start-here/outbound-network-access.mdx) and is surfaced in the Self-host docs navigation as **Outbound network access**.
|
||||
|
||||
Do not maintain a second full human allowlist in this repository file. If customer wording needs to change, update the published page and keep this file as the stable internal path for maintainers and automation.
|
||||
Reference in New Issue
Block a user