4 Commits

Include renames

Author	SHA1	Message	Date
Hermes	388a1fe487	[grade=B] DC-081: Input validation for 20 highest-risk mutating routes ... Secures 20 mutating routes across 7 files against path traversal, shell injection, and ReDoS vectors: - containers.js: container ID validation + resource limit bounds (6 routes) - recipes/manage.js: recipe ID slug validation (4 routes) - tailscale.js: subdomain regex before interpolation + shell char blocking (2) - workflows.js: workflow ID slug validation (3 routes) - dependencies.js: service ID + dependsOn array validation (3 routes) - logs.js: YYYY-MM-DD date format validation (1 route) - sites.js: additional domain validation (1 route) Uses existing REGEX patterns from constants.js. No new dependencies. Codex: B (no blocking issues, 4 Low follow-ups for tests + strict bools). 1552/1552 tests pass, 0 regressions.	2026-08-12 06:20:48 -07:00
Hermes	7bc2a207f3	DC-005: Fix all 138 broken test paths after src/ refactor ... After the DC-005 module reorganization (41 files moved into src/ subdirs), 138 test suites failed because the refactor script's path-rewrite logic missed three categories: 1. Files inside src/ doing 'require("./src/...")' — should be 'require("../...")' 2. Files in src/X/Y/ doing 'require("../../../src/...")' — should be 'require("../../...")' 3. Test files in __tests__/ with leftover 'require("../../../src/...")' paths Root cause: the original refactor script ran before all files were moved, so it computed relative paths against stale filesystem state. Result: - 30/30 test suites pass - 879/879 tests pass (was: 18/30 suites, 614/687 tests) Also fixed: - routes/apps/restore.js: wrong responses import path - routes/*/*.js: '../../src/utilities/X' → '../src/utilities/X' (depth 2 routes)	2026-06-13 12:16:56 -07:00
Hermes	11cfb8c26a	Consolidate response helpers and error logger to single modules ... Two cleanups in one pass for the v1.14.0 'works on any platform' theme: 1. Response helpers — merged src/utils/responses.js and the root-level response-helpers.js into a single module at src/utils/responses.js. The old module had a richer set (created, noContent, validationError, unauthorized, forbidden, notFound, conflict) and is now re-exported from the new location. Updated 15 routes to import from src/utils/responses and deleted the root response-helpers.js. 2. Error logger — error-handler.js now uses the unified src/utils/logging.js#logError (same one src/app.js uses), so all errors go to one log file with one rotation policy. Removed the dead asyncHandler export (the real one is in src/utils/async-handler.js and is used everywhere). Deleted the legacy error-logger.js. Both are invisible to users — same HTTP response shapes, same log file path, same error format. Internal-only refactor.	2026-06-10 21:37:55 -07:00
Hermes	954be9e868	feat: auto-restart policies, SSL monitoring, DNS propagation, dependency tracking, config drift detection	2026-06-10 14:43:46 -07:00