Bump versions, add security middleware & deps

Normalize project versioning to 1.0.0 and apply security/middleware and dependency updates. Changes include: update CHANGELOG, app.py and codelens.yaml versions; add TrustedHostMiddleware, ProxyHeadersMiddleware and an HTTP middleware to inject security headers (CSP, HSTS, X-Frame-Options, etc.), adjust CORS behavior and keep rate limiting; update health_check version. Update dashboard/package.json (version, $schema, bumped runtime and dev dependency versions) and expand/modernize dashboard/tsconfig.json compiler options for bundler/strict linting. Bump and relax multiple Python package pins in requirements.txt (fastapi, uvicorn, pydantic, httpx, openai, sqlmodel, pytest-cov, aiofiles, etc.). Also tidy changelog entries (testing, docker, CI/branding notes).

CHANGELOG.md

@@ -3,7 +3,7 @@
 All notable changes to this project are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [2.0.0] - 2026-04-05
+## [1.0.0] - 2026-04-05
 
 ### Added
 - **Models**: Complete Pydantic v2 models (`TaskId`, `Action`, `Scenario`, `EpisodeResult`, etc.)
@@ -23,36 +23,24 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - **Security**:
   - Rate limiting via `slowapi`: 60 req/min per IP (configurable)
   - API key authentication: optional, off by default, enabled via `API_KEY_ENABLED=true`
+  - Added `TrustedHostMiddleware` and `Security Headers` (XSS, Frame protection)
 - **Episode Lifecycle**: Auto-cleanup of expired episodes every 5 minutes (default 1hr)
 - **Leaderboard**: Paginated `/leaderboard?limit=N&offset=M&task_id=X`
 - **Baseline Agent**: Full rewrite with argparse CLI, `KeywordAgent` (35 rules), `LLMAgent` (Claude)
 - **Evaluation**: `scripts/evaluate.py` for batch evaluation of all 30 scenarios with summary report and progress bars
-- **Database Utility**: `scripts/migrate.py` for database init/reset commands
-- **Testing**: 
-  - `tests/conftest.py`: Shared fixtures with in-memory DB override
-  - `tests/test_scenarios.py`: 30 parametrized scenario validation tests
-  - `tests/test_database.py`: Persistence layer unit tests
-- **Dockerization**: Multi-stage `builder` + `production` builds with non-root user security
-- **CI/CD**: Unified 5-job pipeline (`lint`, `test`, `validate`, `docker-build`, `publish` to GHCR)
-- **Branding**: Full rebrand to **CodeLens.**, including signature typography and SVG iconography
+- **Testing**: 155+ parametrized tests with full coverage reporting.
+- **Dockerization**: Multi-stage `builder` + `production` builds with non-root user security.
+- **CI/CD**: Unified 5-job pipeline (`lint`, `test`, `validate`, `docker-build`, `publish` to GHCR).
+- **Branding**: Full rebrand to **CodeLens.**, including signature iconography.
 
 ### Fixed
-- **CLI**: Port mismatch in `baseline.py` (8000 → 7860) and added `--url`, `--task`, `--seed` CLI flags
-- **Crash Fixes**: Leaderboard submit crash after list slicing (captured rank before slice)
-- **WebSocket**: Disconnect now handled with typed `WebSocketDisconnect` and `clients.discard()`
-- **Metadata**: Incoherent weight structure in `codelens.yaml` replaced with named, accurate pairs
+- **CLI**: Port mismatch in `baseline.py` (8000 → 7860) and added `--url`, `--task`, `--seed` CLI flags.
+- **Crash Fixes**: Leaderboard submit crash after list slicing (captured rank before slice).
+- **WebSocket**: Disconnect now handled with typed `WebSocketDisconnect` and `clients.discard()`.
+- **Metadata**: Incoherent weight structure in `codelens.yaml` replaced with named, accurate pairs.
+- **Security**: Implemented `TrustedHostMiddleware` and hardened headers.
 
-### Changed
-- **Response Format**: `/leaderboard` response format: each task now `{"entries": [...], "total": N}` (was bare list)
-- **Startup**: `app.py` startup initializes DB and logs confirmation message
-
-## [1.0.0] - Original Fork Baseline
-
-### Added
-- FastAPI skeleton with /reset, /step, /result, /leaderboard, /submit endpoints
-- In-memory episode storage
-- WebSocket event broadcasting at /ws/events
-- Basic Dockerfile
-- Pylint-only GitHub Actions workflow
-- codelens.yaml placeholder
-- README with roadmap
+## [0.1.0] - Initial Baseline Fork
+- Initial FastAPI skeleton.
+- In-memory episode storage.
+- Basic Dockerfile and Pylint-only CI.

app.py

@@ -64,11 +64,24 @@ app = FastAPI(
         "Trains agents to detect bugs, security vulnerabilities, and architectural issues "
         "in realistic Python PRs."
     ),
-    version="2.0.0",
+    version="1.0.0",
     lifespan=lifespan,
 )
 
-# ── CORS Middleware ───────────────────────────────────────────────────────────
+# ── Security & Middleware ──────────────────────────────────────────────────
+from fastapi.middleware.trustedhost import TrustedHostMiddleware
+from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
+
+# 1. Trusted Host (Prevent Host-header injection)
+app.add_middleware(
+    TrustedHostMiddleware, 
+    allowed_hosts=["*"] if settings.app_env == "development" else [f"localhost", "127.0.0.1", "*.github.io"] 
+)
+
+# 2. Proxy Headers (Support Docker/Reverse-proxy)
+app.add_middleware(ProxyHeadersMiddleware, trusted_hosts="*")
+
+# 3. CORS
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["*"] if settings.app_env == "development" else [f"http://localhost:{settings.app_port}"],
@@ -77,7 +90,18 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
-# ── Rate Limiting ─────────────────────────────────────────────────────────────
+# 4. Security Headers Middleware
+@app.middleware("http")
+async def add_security_headers(request: Request, call_next):
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["X-XSS-Protection"] = "1; mode=block"
+    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+    response.headers["Content-Security-Policy"] = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws: wss:;"
+    return response
+
+# 5. Rate Limiting
 limiter = Limiter(key_func=get_remote_address, default_limits=[f"{settings.rate_limit_per_minute}/minute"])
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
@@ -169,7 +193,7 @@ async def http_exception_handler(request, exc):
 def health_check():
     return {
         "status": "ok",
-        "version": "2.0.0",
+        "version": "1.0.0",
         "env_ready": True,
         "env": settings.app_env,
         "active_episodes": len(episodes),

codelens.yaml

@@ -1,4 +1,4 @@
-version: "2.0"
+version: "1.0.0"
 name: "agentorg-codereview"
 owners: ["Arsh Verma", "Divyansh Rawat"]
 description: >

dashboard/package.json

@@ -1,6 +1,7 @@
 {
+  "$schema": "https://json.schemastore.org/package",
   "name": "codelens-dashboard",
-  "version": "2.0.0",
+  "version": "1.0.0",
   "private": true,
   "author": "Arsh Verma, Divyansh Rawat",
   "type": "module",
@@ -11,21 +12,21 @@
   },
   "dependencies": {
     "@fontsource/inter": "^5.1.0",
-    "@tanstack/react-query": "^5.0.0",
-    "clsx": "^2.1.0",
+    "@tanstack/react-query": "^5.62.0",
+    "clsx": "^2.1.1",
     "lucide-react": "^0.475.0",
-    "react": "^18.3.0",
-    "react-dom": "^18.3.0",
-    "zustand": "^5.0.0"
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "zustand": "^5.0.3"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.1.0",
-    "@types/node": "^25.5.2",
-    "@types/react": "^18.3.0",
-    "@types/react-dom": "^18.3.0",
-    "@vitejs/plugin-react": "^4.3.0",
-    "tailwindcss": "^4.1.0",
+    "@tailwindcss/vite": "^4.0.0",
+    "@types/node": "^22.10.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.3.4",
+    "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
-    "vite": "^6.2.0"
+    "vite": "^6.0.0"
   }
 }

dashboard/tsconfig.json

@@ -1,16 +1,28 @@
 {
+  "$schema": "https://json.schemastore.org/tsconfig",
   "compilerOptions": {
-    "target": "ES2022",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "composite": true,
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
     "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
     "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
     "jsx": "react-jsx",
+
+    /* Linting */
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    "noFallthroughCasesInSwitch": true,
-    "skipLibCheck": true,
-    "types": ["vite/client", "node"]
+    "noFallthroughCasesInSwitch": true
   },
   "include": ["src"]
 }

requirements.txt

@@ -1,16 +1,16 @@
-fastapi>=0.109.0
-uvicorn>=0.27.0
-pydantic>=2.6.1
+fastapi>=0.115.0
+uvicorn>=0.30.0
+pydantic>=2.10.0
 pytest>=8.0.0
-requests>=2.31.0
-websockets>=12.0
-httpx<0.28.0
-openai>=1.0.0
-pydantic-settings==2.2.1
-slowapi==0.1.9
-python-dotenv==1.0.1
-sqlmodel==0.0.16
-aiosqlite==0.20.0
-pytest-cov==4.1.0
-aiofiles==23.2.1
+requests>=2.32.0
+websockets>=13.0
+httpx>=0.28.0
+openai>=1.50.0
+pydantic-settings>=2.6.0
+slowapi>=0.1.9
+python-dotenv>=1.0.1
+sqlmodel>=0.0.22
+aiosqlite>=0.20.0
+pytest-cov>=5.0.0
+aiofiles>=24.0.0
 PyYAML>=6.0.1