4 Commits

Include renames

Author	SHA1	Message	Date
Krystie	e99413150e	[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps ... Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls): P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076. server.js passed module exports (DependencyManager class, {AutoRestartManager} namespace, SSLMonitor class) instead of createApp()'s live instances — first .on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx exposed in src/app.js; server.js passes all 8 real EventEmitter instances. P0-2: error.log corrupted since 2026-07-14. errorMiddleware called logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper — logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper + ~74 log.error sites swept to pass real error objects (AST-verified scope- safe 71/71, 29/29 modules load clean). P0-3: auth-polling storm (stranded grade=B commit never landed in prod): 401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect every 2-8s, with misleading direct-probe fallback marking services 'up'. Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears _dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes. Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors); dockerode@5/uuid deferred (semver-major, Docker API surface). Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings; node --check all changed files; bundles rebuilt + SW cache bumped. Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial delegate per operator directive 2026-08-07. Round 1: 98-call mechanical verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM (re-auth freeze) — fixed in this commit as prescribed.	2026-08-16 04:18:07 -07:00
Hermes	17edb3bc90	Fix 5 critical security vulnerabilities ... 1. WebSocket exec auth bypass (exec.js): Require valid JWT or API key before accepting WebSocket upgrade. Reject unauthenticated requests with 401 before the upgrade completes. 2. Shell injection in router auto-login (session-handlers.js): Validate baseUrl against safe hostname pattern before embedding in wget shell command. Reject with null session if invalid. 3. Path traversal in credentials routes (services.js): Add explicit serviceId validation (alphanumeric + dash/underscore/dot, max 100 chars) to all three credential endpoints. Removed redundant try/catch wrapper. 4. execSync injection in CA CSR generation (ca.js): Add sanitize step replacing any non-alphanumeric domain chars with underscore before interpolation into shell subj argument. Redundant with existing validation but provides defense-in-depth. 5. Auth bypass when TOTP disabled (middleware.js): Split the logic cleanly — disabled TOTP means no auth (initial setup state), enabled TOTP means all auth methods checked (session/JWT/API key). Removed the sessionDuration:never conflating shortcut.	2026-05-27 18:05:35 -07:00
Krystie	95b137bf17	Fix DNS2 self-updater path and sync live dashboard version UI	2026-05-05 17:26:42 -07:00
SamiandClaude Opus 4.6	bdf3f247b1	feat: add 7 new features — exec shell, SSE events, compose import, docker resources, resource limits, email notifications, auto-updates ... - Container exec/shell via WebSocket + xterm.js (subtle >_ button on cards) - Live dashboard updates via SSE (resource alerts, health changes, update notices) - Docker Compose import with YAML parsing, preview, and dependency-ordered deploy - Volume & network management modal with disk usage overview - CPU/memory resource limits on deploy and live update - Email SMTP notifications (nodemailer) alongside Discord/Telegram/ntfy - Scheduled auto-update scheduler with maintenance windows (daily/weekly/monthly) New deps: ws, js-yaml, nodemailer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-05 16:15:14 -07:00