Spaces:
Sleeping
Sleeping
Commit History
-
feat: audit hardening, webhook retry, and local Claude session tracking (#68)
nykUnverified signatureSecurity hardening: - Fix timing-safe comparison bugs in webhooks.ts and auth.ts (was comparing buffer with itself) - Harden rate limiter IP extraction — use rightmost untrusted IP from XFF chain with MC_TRUSTED_PROXIES support - Add 12-char minimum password validation in Zod schema and runtime check - Add Zod validation on PUT /api/tasks bulk status update Webhook retry system (completing in-progress feature): - Exponential backoff with circuit breaker in webhooks.ts - POST /api/webhooks/retry endpoint for manual retry - GET /api/webhooks/verify-docs endpoint for signature verification docs - Scheduler integration for automatic retry processing - Unit tests for signature verification and backoff logic Local Claude Code session tracking: - New claude-sessions.ts scanner parses JSONL transcripts from ~/.claude/projects/ - Extracts model, tokens, messages, cost estimates, active status per session - Migration 020 adds claude_sessions table - GET/POST /api/claude/sessions endpoint with …959f8d7
-
feat: v1.2.0 — validation hardening, unit tests, quality improvements
Nyk- Fix task status enum mismatch (blocked → quality_review) - Add 12 Zod schemas for all unvalidated mutation routes - Apply validateBody() across 11 API route handlers - Add readLimiter (120/min) for GET-heavy endpoints - Extend heavyLimiter to search, backup, cleanup routes - Add security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) - Fill auth test stubs with real assertions (safeCompare, requireRole) - Add validation, rate-limit, and db-helpers unit test suites (60 tests total) - Replace as-any casts with typed interfaces (SessionQueryRow, UserQueryRow, CountRow) - Bump version to 1.2.0, add CHANGELOG.md, update README roadmapbfccd36
-
chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check
Nyk- Add Contributor Covenant 2.1 Code of Conduct (Closes #16) - Add bug report and feature request issue templates (Closes #17) - Standardize DELETE handlers to use request body instead of query params (Closes #18) - Cap unbounded limit params to Math.min(limit, 200) on 12 endpoints (Closes #19) - Add CSRF Origin header validation for mutating requests in middleware (Closes #20)391842a -
fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization
Nyk1dc7696
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f