Hermes
c9015b59ad
[pending-judge] feat(DC-162 rev2): "Connect your AI" — spec Streamable HTTP MCP + one-click keys
...
Judge r1 (grade D) blockers, each fixed and tested:
1. TRANSPORT: custom POST-only JSON-RPC → MCP 2025-03-10 Streamable HTTP
(spec-canonical; replaced HTTP+SSE). POST answers application/json for
requests; valid notifications -> 202 empty; malformed notifications ->
no reply (204); batching removed in this revision -> arrays rejected
-32600. GET (server->client stream) and DELETE (session termination)
answer 405 + Allow: POST — the spec's explicit allowance for stateless
request/response servers; documented in /info + modal + OpenAPI.
Origin header validated when present (DNS-rebinding MUST); Accept
negotiation (json required, else 406); MCP-Protocol-Version header
checked when sent. Clients needing server-initiated streams use the
stdio bridge (unchanged, shares mcp-core).
2. CREDENTIAL TYPE PRESERVATION: routes/mcp.js now forwards the SAME
scheme the caller authenticated with (req.auth.type from
middleware.js:549-586): apikey -> x-api-key, jwt -> Authorization
Bearer (NOT dk_-coerced-x-api-key as r1 did). mcp-core createToolHandler
accepts explicit headers. Tests assert BOTH shapes downstream
(apikey carries x-api-key & no Authorization; jwt carries Bearer & no
x-api-key; zero downstream calls for session denial).
3. JSON-RPC VALIDATION: validateJsonRpc — jsonrpc:'2.0', non-empty string
method, params object-or-omitted, id string|number|null. Invalid
Request -32600 (empty body, empty array, batch); tools/call without
string params.name -> -32602; unknown method -> -32601; error envelopes
carry id null when unpairable. Transport primitives rejected by the
app-wide strict JSON parser (400; asserted).
4. REPRODUCIBILITY: status/dist/features.js + sw.js regenerated and
committed IN THE PATCH (repo convention: DC-130/131 committed bundle
rebuilds). Verifier greps the built bundle for aiconn- (23),
mcp/connections (1), httpConfig (2) so a clean `git am` checkout serves
the real frontend.
Judge r1 polish, all applied:
- verifier accepts 0_PATCH.diff / PATCH.diff naming (indexed artifact);
- connections list filtered server-side to "AI connection (...)" keys
(new GET /mcp/connections, session-only; modal switched to it);
- URL-encoded tool path params (serviceId, containerId, action,
templateId, category, zone) in mcp-core.
Config shape: POST /mcp/config (session-only; apikey 403) returns the
standard Streamable-HTTP card {url, transport: streamable-http, headers:
{x-api-key}, mcpProtocolVersion} + per-client note (ChatGPT note states
the public-https requirement honestly; no fabricated connector claims).
Tests: 57 green (34 route incl. auth matrix/type-preservation/transport
rules/JSON-RPC errors + 23 core). Composition-root e2e (8) boots the real
createApp with the mount. eslint 0 errors. Full suite: only the
pre-existing pdf-parse billing family red (unchanged since base 470dfaa
2026-10-08 03:46:56 -07:00
Hermes
74e21c1edc
[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring
...
- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
display, settings modal with CalDAV/ICS source management and a
Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
never in responses), aggregated events across sources with per-source
error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
verified byte-for-byte against openssl passwd -apr1 vectors), stores
credentials, registers the source. Deploy hook in routes/apps/deploy.js
wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
route tests). Full suite 3552 passed; only pre-existing pdf-parse
billing/invoice failures remain (proven red at base 448f535
2026-10-07 19:57:22 -07:00
Krystie
503de258b8
[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work
...
Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.
2026-08-12 17:34:10 -07:00
Sami and Claude Opus 4.7
d36705bd90
feat: 1.5.0 prep — API v1 cutover, LICENSE, CHANGELOG, CI
...
- Remove legacy /api/ mount; all routes now under /api/v1/ only
- Update path matchers (CSRF excludes, public routes, audit log, rate limits)
- Move standalone routes (/api/network/ips, /api/docs, /api/docs/spec) to v1
- Update openapi.yaml (110 paths), CA pages, and 4 lingering frontend files
- Add LICENSE (proprietary EULA), CHANGELOG.md (Keep a Changelog format)
- Add .gitea/workflows/ci.yml (test+lint and security audit jobs)
- Fix 9 pre-existing no-empty lint errors so CI starts green
- Drop ad-hoc scratch reports and *.bak files from repo root
All 739 jest tests pass. Lint is clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-17 11:38:45 -07:00
Sami
f61e85d9a7
Initial commit: DashCaddy v1.0
...
Full codebase including API server (32 modules + routes), dashboard frontend,
DashCA certificate distribution, installer script, and deployment skills.
2026-03-05 02:26:12 -08:00
Hermes