3 Commits

Include renames

Author	SHA1	Message	Date
Krystie	e99413150e	[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps ... Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls): P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076. server.js passed module exports (DependencyManager class, {AutoRestartManager} namespace, SSLMonitor class) instead of createApp()'s live instances — first .on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx exposed in src/app.js; server.js passes all 8 real EventEmitter instances. P0-2: error.log corrupted since 2026-07-14. errorMiddleware called logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper — logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper + ~74 log.error sites swept to pass real error objects (AST-verified scope- safe 71/71, 29/29 modules load clean). P0-3: auth-polling storm (stranded grade=B commit never landed in prod): 401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect every 2-8s, with misleading direct-probe fallback marking services 'up'. Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears _dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes. Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors); dockerode@5/uuid deferred (semver-major, Docker API surface). Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings; node --check all changed files; bundles rebuilt + SW cache bumped. Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial delegate per operator directive 2026-08-07. Round 1: 98-call mechanical verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM (re-auth freeze) — fixed in this commit as prescribed.	2026-08-16 04:18:07 -07:00
Hermes	6025f68b22	DC-004: Fix all 19 ESLint warnings (zero remaining) ... Removed unused imports (path, validateStartupConfig, platformPaths), renamed unused destructures (_timeout, _logEntry), replaced nested ternaries with lookup tables, added eslint-disable comments on require-await functions that are intentionally async for API stability, and extracted helper functions to reduce max-depth and complexity in app.js, dns.js, provider-dns.js, and site.js. All 879 tests pass.	2026-06-13 11:53:18 -07:00
Hermes	e5d7da6edd	Add config migration system ... When config.json schema changes between versions, register a migration function in src/config/migrations.js. On startup, loadSiteConfig() detects the stored version, runs all migrations forward, and writes the result back. Users never see the migration — it runs silently and the rest of the app only ever sees the current schema. Includes: - v0 → v1: normalize dns from string to object - v1 → v2: add dns.provider field (default 'technitium') - Forward compat: configs from future versions left untouched - Idempotent: re-running on already-migrated config is a no-op - Safe: no user data is removed during migration 21 unit tests covering edge cases: null input, forward compat, corrupt JSON, missing parent dirs, idempotency, full migration chain.	2026-06-10 20:06:09 -07:00