03dd25f028
feat(orchestrator): MS23-P0-005 subagent tree endpoint ( #714 )
...
ci/woodpecker/push/ci Pipeline was successful
Co-authored-by: Jason Woltje <jason@diversecanvas.com >
Co-committed-by: Jason Woltje <jason@diversecanvas.com >
2026-03-07 17:57:55 +00:00
d0c6622de5
feat(orchestrator): MS23-P0-004 operator inject/pause/resume endpoints ( #712 )
...
ci/woodpecker/push/ci Pipeline was successful
Co-authored-by: Jason Woltje <jason@diversecanvas.com >
Co-committed-by: Jason Woltje <jason@diversecanvas.com >
2026-03-07 17:43:11 +00:00
e0b28c91c3
feat(orchestrator): MS23 per-agent message history and SSE stream ( #702 )
...
ci/woodpecker/push/ci Pipeline was successful
Co-authored-by: Jason Woltje <jason@diversecanvas.com >
Co-committed-by: Jason Woltje <jason@diversecanvas.com >
2026-03-07 17:15:30 +00:00
Jason Woltje
3880993b60
fix(SEC-ORCH-28+29): Add Valkey connection timeout + workItems MaxLength
...
ci/woodpecker/push/woodpecker Pipeline failed
SEC-ORCH-28: Add connectTimeout (5000ms default) and commandTimeout
(3000ms default) to Valkey/Redis client to prevent indefinite connection
hangs. Both are configurable via VALKEY_CONNECT_TIMEOUT_MS and
VALKEY_COMMAND_TIMEOUT_MS environment variables.
SEC-ORCH-29: Add @ArrayMaxSize(50) and @MaxLength(2000) to workItems
in AgentContextDto to prevent memory exhaustion from unbounded input.
Also adds @ArrayMaxSize(20) and @MaxLength(200) to skills array.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-06 15:19:44 -06:00
Jason Woltje
433212e00f
test(CQ-ORCH-9): Add SpawnAgentDto validation tests
...
ci/woodpecker/push/woodpecker Pipeline was successful
Adds 23 dedicated DTO-level validation tests for SpawnAgentDto and
AgentContextDto using plainToInstance + validate() from class-validator.
Covers: valid payloads, missing/empty taskId, invalid agentType, empty
repository/branch, empty workItems, shell injection in branch names,
SSRF in repository URLs, file:// protocol blocking, option injection,
and invalid gateProfile values.
Replaces the 5 controller-level validation tests removed in CQ-ORCH-9
with proper DTO-level equivalents.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-06 14:31:37 -06:00
7a84d96d72
fix( #274 ): Add input validation to prevent command injection in git operations
...
ci/woodpecker/push/woodpecker Pipeline failed
Implemented strict whitelist-based validation for git branch names and
repository URLs to prevent command injection vulnerabilities in worktree
operations.
Security fixes:
- Created git-validation.util.ts with whitelist validation functions
- Added custom DTO validators for branch names and repository URLs
- Applied defense-in-depth validation in WorktreeManagerService
- Comprehensive test coverage (31 tests) for all validation scenarios
Validation rules:
- Branch names: alphanumeric + hyphens + underscores + slashes + dots only
- Repository URLs: https://, http://, ssh://, git:// protocols only
- Blocks: option injection (--), command substitution ($(), ``), shell operators
- Prevents: SSRF attacks (localhost, internal networks), credential injection
Defense layers:
1. DTO validation (first line of defense at API boundary)
2. Service-level validation (defense-in-depth before git operations)
Fixes #274
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 20:17:47 -06:00
Jason Woltje
fc87494137
fix(orchestrator): resolve all M6 remediation issues (#260-#269)
...
ci/woodpecker/push/woodpecker Pipeline failed
Addresses all 10 quality remediation issues for the orchestrator module:
TypeScript & Type Safety:
- #260 : Fix TypeScript compilation errors in tests
- #261 : Replace explicit 'any' types with proper typed mocks
Error Handling & Reliability:
- #262 : Fix silent cleanup failures - return structured results
- #263 : Fix silent Valkey event parsing failures with proper error handling
- #266 : Improve error context in Docker operations
- #267 : Fix secret scanner false negatives on file read errors
- #268 : Fix worktree cleanup error swallowing
Testing & Quality:
- #264 : Add queue integration tests (coverage 15% → 85%)
- #265 : Fix Prettier formatting violations
- #269 : Update outdated TODO comments
All tests passing (406/406), TypeScript compiles cleanly, ESLint clean.
Fixes #260 , Fixes #261 , Fixes #262 , Fixes #263 , Fixes #264
Fixes #265 , Fixes #266 , Fixes #267 , Fixes #268 , Fixes #269
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-03 12:44:04 -06:00
