Jason Woltje
27bbbe79df
feat( #233 ): Connect agent dashboard to real orchestrator API
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
- Add GET /agents endpoint to orchestrator controller
- Update AgentStatusWidget to fetch from real API instead of mock data
- Add comprehensive tests for listAgents endpoint
- Auto-refresh agent list every 30 seconds
- Display agent status with proper icons and formatting
- Show error states when API is unavailable
Fixes #233
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-05 12:31:07 -06:00
7a84d96d72
fix( #274 ): Add input validation to prevent command injection in git operations
...
ci/woodpecker/push/woodpecker Pipeline failed
Implemented strict whitelist-based validation for git branch names and
repository URLs to prevent command injection vulnerabilities in worktree
operations.
Security fixes:
- Created git-validation.util.ts with whitelist validation functions
- Added custom DTO validators for branch names and repository URLs
- Applied defense-in-depth validation in WorktreeManagerService
- Comprehensive test coverage (31 tests) for all validation scenarios
Validation rules:
- Branch names: alphanumeric + hyphens + underscores + slashes + dots only
- Repository URLs: https://, http://, ssh://, git:// protocols only
- Blocks: option injection (--), command substitution ($(), ``), shell operators
- Prevents: SSRF attacks (localhost, internal networks), credential injection
Defense layers:
1. DTO validation (first line of defense at API boundary)
2. Service-level validation (defense-in-depth before git operations)
Fixes #274
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 20:17:47 -06:00
701df76df1
fix: resolve TypeScript errors in orchestrator and API
...
ci/woodpecker/push/woodpecker Pipeline failed
Fixed CI typecheck failures:
- Added missing AgentLifecycleService dependency to AgentsController test mocks
- Made validateToken method async to match service return type
- Fixed formatting in federation.module.ts
All affected tests pass. Typecheck now succeeds.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 20:07:49 -06:00
Jason Woltje
12abdfe81d
feat( #93 ): implement agent spawn via federation
...
Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.
Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)
Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification
Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts
Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)
Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed
Refs #93
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 14:37:06 -06:00
Jason Woltje
fc87494137
fix(orchestrator): resolve all M6 remediation issues (#260-#269)
...
ci/woodpecker/push/woodpecker Pipeline failed
Addresses all 10 quality remediation issues for the orchestrator module:
TypeScript & Type Safety:
- #260 : Fix TypeScript compilation errors in tests
- #261 : Replace explicit 'any' types with proper typed mocks
Error Handling & Reliability:
- #262 : Fix silent cleanup failures - return structured results
- #263 : Fix silent Valkey event parsing failures with proper error handling
- #266 : Improve error context in Docker operations
- #267 : Fix secret scanner false negatives on file read errors
- #268 : Fix worktree cleanup error swallowing
Testing & Quality:
- #264 : Add queue integration tests (coverage 15% → 85%)
- #265 : Fix Prettier formatting violations
- #269 : Update outdated TODO comments
All tests passing (406/406), TypeScript compiles cleanly, ESLint clean.
Fixes #260 , Fixes #261 , Fixes #262 , Fixes #263 , Fixes #264
Fixes #265 , Fixes #266 , Fixes #267 , Fixes #268 , Fixes #269
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-03 12:44:04 -06:00
