Hermes
e8ab0e09a0
[mm-grade=A] (MiniMax-M3 adversarial review, 3 rounds) Codex quota exhausted 2026-08-19 21:26 UTC. Per codex-as-judge skill Pitfall XXI, MiniMax-M3 served as adversarial judge via delegate_task across 3 rounds. Final grade: A. No blocking defects remaining. Round 1 (initial: C — 14 issues): CRITICAL/HIGH fixed: 1. Layer-2 delivery idempotency (different event + same session) 2. Mislabeled idempotency test (#2 was layer-1 not layer-2) 3. CRLF test was vacuous (regex matched space-after-colon) 4. Currency: native symbols for EUR/GBP/JPY/etc, ISO code fallback 5. PDF graceful degradation on poison-pill inputs 6. Retry uses claim.createdAt as stable issuedAt Round 2 (B → C again, found new issues): CRITICAL fixed: 1. amountCents accepted string/NaN/Infinity/negative → rendered $0.00 silently (financial-document bug) 2. CRLF test still vacuous — rewrote with no-space-after-colon payloads + per-region extraction. Mutation-tested: deleting stripControlChars → test FAILS. 3. Multi-line-item sum (was lineItems[0] only) Plus: supportUrl scheme allowlist, long-code PDF wrap, currency sanitization, catalog fallback, unbalanced PDF save/restore fix. Round 3 (B → A−, found ONE remaining defect): MED fixed: - PDF Info Subject field echoed raw customerName → phishing-recon signal visible in every PDF readers Properties panel. Now constant. - PDF body Bill To had raw <script> visible (no XSS but phishing). Added escapePdfText() that converts <> → ‹› (visually similar, not HTML-exploitable). Polish: - Bridge wiring: claim.createdAt as issuedAt, DASHCADDY_SUPPORT_URL env - Long license codes auto-shrink font in PDF box (13/11/9/7pt tiers) - Two-page PDF with empty page 2 (PDFKit pagination boundary) Test counts: - 131/131 billing pass (was 119 before) - 1836/1837 full api suite (1 pre-existing public-routes drift unrelated) When Codex quota returns 2026-08-19 21:26 UTC, re-run judge-artifact.sh for the canonical verdict and supersede [mm-grade=A] if needed.
56 lines
1.7 KiB
JSON
56 lines
1.7 KiB
JSON
{
|
|
"name": "dashcaddy-api",
|
|
"version": "1.15.0",
|
|
"description": "DashCaddy API server - Dashboard backend for Docker, Caddy & DNS management",
|
|
"main": "server.js",
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"test:coverage": "jest --coverage",
|
|
"test:ci": "jest --ci --coverage --maxWorkers=2 --forceExit",
|
|
"test:unit": "jest --testPathPattern=__tests__/(?!routes|integration) --no-coverage",
|
|
"test:routes": "jest --testPathPattern=__tests__/routes --no-coverage",
|
|
"test:security": "jest --testPathPattern=(crypto-utils|credential-manager|csrf-protection|auth-manager|input-validator|backup-manager) --no-coverage",
|
|
"test:changed": "jest --onlyChanged --no-coverage",
|
|
"test:debug": "node --inspect-brk node_modules/jest/bin/jest.js --runInBand --no-coverage",
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"format": "prettier --write '**/*.{js,json,md}'"
|
|
},
|
|
"dependencies": {
|
|
"compression": "^1.8.1",
|
|
"cors": "^2.8.6",
|
|
"dockerode": "^4.0.9",
|
|
"dropbox": "^10.34.0",
|
|
"express": "^4.22.1",
|
|
"express-rate-limit": "^7.5.1",
|
|
"helmet": "^8.1.0",
|
|
"joi": "^18.2.3",
|
|
"js-yaml": "^4.1.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"lru-cache": "^10.4.3",
|
|
"nodemailer": "^8.0.4",
|
|
"otplib": "^12.0.1",
|
|
"pdfkit": "^0.15.2",
|
|
"png-to-ico": "^2.1.8",
|
|
"proper-lockfile": "^4.1.2",
|
|
"qrcode": "^1.5.3",
|
|
"sharp": "^0.33.5",
|
|
"ssh2-sftp-client": "^11.0.0",
|
|
"validator": "^13.11.0",
|
|
"webdav": "^5.7.1",
|
|
"ws": "^8.20.0"
|
|
},
|
|
"devDependencies": {
|
|
"eslint": "^8.57.1",
|
|
"jest": "^29.7.0",
|
|
"pdf-parse": "^1.1.4",
|
|
"prettier": "^3.8.1",
|
|
"supertest": "^6.3.4"
|
|
}
|
|
}
|