Krystie
e99413150e
Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls):
P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076.
server.js passed module exports (DependencyManager class, {AutoRestartManager}
namespace, SSLMonitor class) instead of createApp()'s live instances — first
.on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx
exposed in src/app.js; server.js passes all 8 real EventEmitter instances.
P0-2: error.log corrupted since 2026-07-14. errorMiddleware called
logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper —
logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error
object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper +
~74 log.error sites swept to pass real error objects (AST-verified scope-
safe 71/71, 29/29 modules load clean).
P0-3: auth-polling storm (stranded grade=B commit never landed in prod):
401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect
every 2-8s, with misleading direct-probe fallback marking services 'up'.
Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears
_dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes.
Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and
sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors);
dockerode@5/uuid deferred (semver-major, Docker API surface).
Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings;
node --check all changed files; bundles rebuilt + SW cache bumped.
Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial
delegate per operator directive 2026-08-07. Round 1: 98-call mechanical
verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM
(re-auth freeze) — fixed in this commit as prescribed.
56 lines
1.7 KiB
JSON
56 lines
1.7 KiB
JSON
{
|
|
"name": "dashcaddy-api",
|
|
"version": "1.15.0",
|
|
"description": "DashCaddy API server - Dashboard backend for Docker, Caddy & DNS management",
|
|
"main": "server.js",
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"test:coverage": "jest --coverage",
|
|
"test:ci": "jest --ci --coverage --maxWorkers=2 --forceExit",
|
|
"test:unit": "jest --testPathPattern=__tests__/(?!routes|integration) --no-coverage",
|
|
"test:routes": "jest --testPathPattern=__tests__/routes --no-coverage",
|
|
"test:security": "jest --testPathPattern=(crypto-utils|credential-manager|csrf-protection|auth-manager|input-validator|backup-manager) --no-coverage",
|
|
"test:changed": "jest --onlyChanged --no-coverage",
|
|
"test:debug": "node --inspect-brk node_modules/jest/bin/jest.js --runInBand --no-coverage",
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"format": "prettier --write '**/*.{js,json,md}'"
|
|
},
|
|
"dependencies": {
|
|
"compression": "^1.8.1",
|
|
"cors": "^2.8.6",
|
|
"dockerode": "^4.0.9",
|
|
"dropbox": "^10.34.0",
|
|
"express": "^4.22.1",
|
|
"express-rate-limit": "^7.5.1",
|
|
"helmet": "^8.1.0",
|
|
"joi": "^18.2.3",
|
|
"js-yaml": "^4.1.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"lru-cache": "^10.4.3",
|
|
"nodemailer": "^9.0.5",
|
|
"otplib": "^12.0.1",
|
|
"pdfkit": "^0.15.2",
|
|
"png-to-ico": "^2.1.8",
|
|
"proper-lockfile": "^4.1.2",
|
|
"qrcode": "^1.5.3",
|
|
"sharp": "^0.35.3",
|
|
"ssh2-sftp-client": "^11.0.0",
|
|
"validator": "^13.11.0",
|
|
"webdav": "^5.7.1",
|
|
"ws": "^8.20.0"
|
|
},
|
|
"devDependencies": {
|
|
"eslint": "^8.57.1",
|
|
"jest": "^29.7.0",
|
|
"pdf-parse": "^1.1.4",
|
|
"prettier": "^3.8.1",
|
|
"supertest": "^6.3.4"
|
|
}
|
|
}
|