Jason Woltje
c74b6b13d1
chore: Start MS-SEC-001 (orchestrator API auth)
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-05 15:14:19 -06:00
Jason Woltje
630f946718
chore(orchestrator): Bootstrap tasks.md from review report
...
ci/woodpecker/push/woodpecker Pipeline failed
Parsed 124 findings into 44 tasks across 2 phases (critical + high).
Estimated total: ~400K tokens.
Issues created:
- #337 : Phase 1 Critical Security (14 tasks)
- #338 : Phase 2 High Priority (30 tasks)
- #339 : Phase 3 Medium (deferred)
- #340 : Phase 4 Low (deferred)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 15:13:48 -06:00
Jason Woltje
9dfbf8cf61
chore: Remove pre-created task files, add review reports
...
ci/woodpecker/push/woodpecker Pipeline failed
- Delete docs/tasks.md (let orchestrator bootstrap from scratch)
- Delete docs/claude/task-tracking.md (superseded by universal guide)
- Add codebase review reports for orchestrator to parse
Tests orchestrator's autonomous bootstrap capability.
2026-02-05 15:08:02 -06:00
Jason Woltje
b56bef0747
feat: Set up security remediation task tracking
...
ci/woodpecker/push/woodpecker Pipeline failed
- Update CLAUDE.md to point to universal orchestrator guide
- Add docs/tasks.md with 28 tasks across 4 phases:
- Phase 1: Critical Security (MS-SEC-001 to MS-SEC-010)
- Phase 2: High Security (MS-HIGH-001 to MS-HIGH-006)
- Phase 3: Code Quality (MS-CQ-001 to MS-CQ-007)
- Phase 4: Test Coverage (MS-TEST-001 to MS-TEST-005)
- Add project-specific task-tracking.md reference
Based on comprehensive codebase review (124 findings).
2026-02-05 14:58:52 -06:00
bbc211f56e
Merge pull request 'feat( #329 ): Add usage budget management and cost governance' ( #336 ) from feature/329-usage-budget into develop
...
ci/woodpecker/push/woodpecker Pipeline failed
Reviewed-on: #336
2026-02-05 20:37:51 +00:00
6b63ca3e07
Merge branch 'develop' into feature/329-usage-budget
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-05 20:37:17 +00:00
c22bde16cd
Merge pull request 'feat( #101 ): Add Task Progress widget for orchestrator monitoring' ( #335 ) from feature/101-task-progress-ui into develop
...
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #335
2026-02-05 19:33:41 +00:00
4e4454b0ca
Merge branch 'develop' into feature/101-task-progress-ui
ci/woodpecker/push/woodpecker Pipeline is pending
ci/woodpecker/pr/woodpecker Pipeline is pending
2026-02-05 19:33:33 +00:00
670809afdb
Merge pull request 'test( #229 ): Add performance test suite for orchestrator' ( #334 ) from feature/229-performance-testing into develop
...
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #334
2026-02-05 19:33:16 +00:00
7bc37fc513
Merge branch 'develop' into feature/229-performance-testing
ci/woodpecker/push/woodpecker Pipeline is pending
ci/woodpecker/pr/woodpecker Pipeline is pending
2026-02-05 19:33:06 +00:00
dc4857b167
Merge pull request 'docs( #230 ): Comprehensive orchestrator documentation' ( #333 ) from feature/230-documentation into develop
...
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #333
2026-02-05 19:32:55 +00:00
8f2afcd022
Merge branch 'develop' into feature/230-documentation
ci/woodpecker/pr/woodpecker Pipeline is pending
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-05 19:32:40 +00:00
0f0488856f
Merge pull request 'test(#226,#227,#228): Add E2E integration tests for agent orchestration' ( #332 ) from feature/226-e2e-agent-lifecycle into develop
...
ci/woodpecker/push/woodpecker Pipeline is pending
Reviewed-on: #332
2026-02-05 19:32:31 +00:00
a8828cb53e
Merge branch 'develop' into feature/226-e2e-agent-lifecycle
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-05 19:32:23 +00:00
25bed45411
Merge pull request '[ORCH-134] Update root documentation' ( #331 ) from feature/235-update-root-docs into develop
...
ci/woodpecker/push/woodpecker Pipeline failed
Reviewed-on: #331
2026-02-05 19:32:15 +00:00
02cd6d4815
Merge branch 'develop' into feature/235-update-root-docs
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-05 19:32:09 +00:00
9e89fa320a
Merge pull request '[ORCH-132] Connect agent dashboard to real API' ( #330 ) from feature/233-agent-dashboard-api into develop
...
ci/woodpecker/push/woodpecker Pipeline failed
Reviewed-on: #330
2026-02-05 19:32:00 +00:00
Jason Woltje
c68b541b6f
fix( #226 ): Remediate code review findings for E2E tests
...
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
- Fix CRITICAL: Remove unused imports (Test, TestingModule, CleanupService)
- Fix CRITICAL: Remove unused mockValkeyService declaration
- Fix IMPORTANT: Rename misleading test describe/names to match actual behavior
- Fix IMPORTANT: Verify spawned agents exist before kill-all assertion
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:26:21 -06:00
Jason Woltje
5a0f090cc5
fix( #230 ): Correct documentation errors from code review
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
- Fix CRITICAL: Correct 5 environment variable names to match actual config
(VALKEY_HOST not ORCHESTRATOR_VALKEY_HOST, CLAUDE_API_KEY not ORCHESTRATOR_CLAUDE_API_KEY, etc.)
- Fix CRITICAL: Correct quality gate profiles table to match actual gate-config service
(minimal = tests only, not typecheck+lint; add agent type defaults)
- Fix IMPORTANT: Add missing gateProfile optional field to spawn request docs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:24:54 -06:00
Jason Woltje
0796cbc744
fix( #229 ): Remediate code review findings for performance tests
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
- Fix CRITICAL: Increase single-spawn threshold from 10ms to 50ms (CI flakiness)
- Fix CRITICAL: Replace no-op validation test with real backoff scale tests
- Fix IMPORTANT: Add warmup iterations before all timed measurements
- Fix IMPORTANT: Increase scan position ratio tolerance to 10x for sub-ms noise
- Refactored queue perf tests to use actual service methods (calculateBackoffDelay)
- Helper function to reduce spawn request duplication
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:23:19 -06:00
Jason Woltje
92ae8097df
fix( #101 ): Remediate code review findings for TaskProgressWidget
...
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
- Fix CRITICAL: Replace .sort() state mutation with [...tasks].sort()
- Fix CRITICAL: Replace PDA-unfriendly red colors with calm amber tones
- Fix IMPORTANT: Add TaskProgressWidget + ActiveProjectsWidget to WidgetComponentType
- Fix IMPORTANT: Add tests for interval cleanup, HTTP error responses, slice limit
- 3 new tests added (10 total)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:19:57 -06:00
Jason Woltje
2cb3fe8f5a
fix( #329 ): Harden BudgetService against security review findings
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
- Fix CRITICAL: Unbounded memory growth via daily record purging
- Fix CRITICAL: Negative/NaN/Infinity token bypass via input clamping
- Fix HIGH: TOCTOU race via atomic trySpawnAgent() method
- Fix HIGH: Phantom agent leak via Set<string> ID tracking (not counter)
- Fix HIGH: isAgentOverBudget now scoped to today only
- Fix HIGH: Config validation clamps invalid values to safe defaults
- Fix MEDIUM: Wire BudgetModule into AppModule
- Fix MEDIUM: Sanitize agentId in log output to prevent log injection
- Fix MEDIUM: Use Date objects for timezone-safe comparisons
- Fix MEDIUM: Reject empty agentId/taskId in recordUsage
- Add tests for negative tokens, NaN, Infinity, empty IDs, config edge cases
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:15:33 -06:00
Jason Woltje
22dc964503
feat( #329 ): Add usage budget management and cost governance
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Implement BudgetService for tracking and enforcing agent usage limits:
- Daily token limit tracking (default 10M tokens)
- Per-agent token limit enforcement (default 2M tokens)
- Maximum concurrent agent cap (default 10)
- Task duration limits (default 120 minutes)
- Hard/soft limit enforcement modes
- Real-time usage summaries with budget status
(within_budget/approaching_limit/at_limit/exceeded)
- Per-agent usage breakdown with percentage calculations
Includes BudgetModule for NestJS DI and 23 unit tests.
Fixes #329
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 13:00:26 -06:00
Jason Woltje
e7f277ff0c
feat( #101 ): Add Task Progress widget for orchestrator task monitoring
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Create TaskProgressWidget showing live agent task execution progress:
- Fetches from orchestrator /agents API with 15s auto-refresh
- Shows stats (total/active/done/stopped), sorted task list
- Agent type badges (worker/reviewer/tester)
- Elapsed time tracking, error display
- Dark mode support, PDA-friendly language
- Registered in WidgetRegistry for dashboard use
Includes 7 unit tests covering all states.
Fixes #101
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 12:57:10 -06:00
Jason Woltje
b93f4c59ce
test( #229 ): Add performance test suite for orchestrator
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Add 14 performance benchmarks across 3 test files:
- Spawner throughput: single/sequential/concurrent spawn latency,
session lookup, list performance, memory efficiency
- Queue service: backoff calculation throughput, validation perf
- Secret scanner: content scanning throughput, pattern scalability
Adds test:perf script to package.json.
Fixes #229
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 12:52:30 -06:00
Jason Woltje
751005391b
docs( #230 ): Comprehensive orchestrator documentation
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Update README with complete API reference, module architecture tree,
service catalog, Valkey state keys, quality gate profiles, and
configuration reference.
Fixes #230
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 12:49:54 -06:00
Jason Woltje
c8c81fc437
test(#226,#227,#228): Add E2E integration tests for agent orchestration
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Add comprehensive E2E test suites covering:
- Full agent lifecycle (spawn → running → completed/failed) - 7 tests
- Killswitch emergency stop mechanism (single/all/partial) - 5 tests
- Concurrent agent spawning and isolation - 5 tests
Includes vitest config for integration test runner with 30s timeout.
Fixes #226
Fixes #227
Fixes #228
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 12:46:44 -06:00
Jason Woltje
dd954ffee3
docs( #235 ): Update README with orchestration layer information
...
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
- Add orchestrator and coordinator to deployment list
- Update project structure with agent orchestration apps
- Add Agent Orchestration Layer section with architecture overview
- Update implementation status to reflect M6 milestone completion
- Document test coverage (2168+ tests passing)
Fixes #235
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-05 12:33:43 -06:00
Jason Woltje
27bbbe79df
feat( #233 ): Connect agent dashboard to real orchestrator API
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
- Add GET /agents endpoint to orchestrator controller
- Update AgentStatusWidget to fetch from real API instead of mock data
- Add comprehensive tests for listAgents endpoint
- Auto-refresh agent list every 30 seconds
- Display agent status with proper icons and formatting
- Show error states when API is unavailable
Fixes #233
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-05 12:31:07 -06:00
Jason Woltje
06fa8f7402
chore: Remove old QA reports and milestone status files
...
ci/woodpecker/push/woodpecker Pipeline failed
Remove 661 outdated files:
- 634 QA automation reports from docs/reports/qa-automation/
- 27 old milestone completion and status tracking files
Preserved core documentation structure and active project reports.
2026-02-05 11:25:00 -06:00
Jason Woltje
6de631cd07
feat( #313 ): Implement FastAPI and agent tracing instrumentation
...
ci/woodpecker/push/woodpecker Pipeline failed
Add comprehensive OpenTelemetry distributed tracing to the coordinator
FastAPI service with automatic request tracing and custom decorators.
Implementation:
- Created src/telemetry.py: OTEL SDK initialization with OTLP exporter
- Created src/tracing_decorators.py: @trace_agent_operation and
@trace_tool_execution decorators with sync/async support
- Integrated FastAPI auto-instrumentation in src/main.py
- Added tracing to coordinator operations in src/coordinator.py
- Environment-based configuration (OTEL_ENABLED, endpoint, sampling)
Features:
- Automatic HTTP request/response tracing via FastAPIInstrumentor
- Custom span enrichment with agent context (issue_id, agent_type)
- Graceful degradation when telemetry disabled
- Proper exception recording and status management
- Resource attributes (service.name, service.version, deployment.env)
- Configurable sampling ratio (0.0-1.0, defaults to 1.0)
Testing:
- 25 comprehensive tests (17 telemetry, 8 decorators)
- Coverage: 90-91% (exceeds 85% requirement)
- All tests passing, no regressions
Quality:
- Zero linting errors (ruff)
- Zero type checking errors (mypy)
- Security review approved (no vulnerabilities)
- Follows OTEL semantic conventions
- Proper error handling and resource cleanup
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-04 14:25:48 -06:00
Jason Woltje
b836940b89
feat( #309 ): Add LLM usage tracking and analytics
...
Implements comprehensive LLM usage tracking with analytics endpoints.
Implementation:
- Added LlmUsageLog model to Prisma schema
- Created llm-usage module with service, controller, and DTOs
- Added tracking for token usage, costs, and durations
- Implemented analytics aggregation by provider, model, and task type
- Added filtering by workspace, provider, model, user, and date range
Testing:
- 20 unit tests with 90.8% coverage (exceeds 85% requirement)
- Tests for service and controller with full error handling
- Tests use Vitest following project conventions
API Endpoints:
- GET /api/llm-usage/analytics - Aggregated usage analytics
- GET /api/llm-usage/by-workspace/:workspaceId - Workspace usage logs
- GET /api/llm-usage/by-workspace/:workspaceId/provider/:provider - Provider logs
- GET /api/llm-usage/by-workspace/:workspaceId/model/:model - Model logs
Database:
- LlmUsageLog table with indexes for efficient queries
- Relations to User, Workspace, and LlmProviderInstance
- Ready for migration with: pnpm prisma migrate dev
Refs #309
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-04 13:41:45 -06:00
Jason Woltje
6516843612
feat( #312 ): Implement core OpenTelemetry infrastructure
...
ci/woodpecker/push/woodpecker Pipeline failed
Complete the telemetry module with all acceptance criteria:
- Add service.version resource attribute from package.json
- Add deployment.environment resource attribute from env vars
- Add trace sampling configuration with OTEL_TRACES_SAMPLER_ARG
- Implement ParentBasedSampler for consistent distributed tracing
- Add comprehensive tests for SpanContextService (15 tests)
- Add comprehensive tests for LlmTelemetryDecorator (29 tests)
- Fix type safety issues (JSON.parse typing, template literals)
- Add security linter exception for package.json read
Test coverage: 74 tests passing, 85%+ coverage on telemetry module.
Fixes #312
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-04 12:52:20 -06:00
Jason Woltje
5d683d401e
fix( #121 ): Remediate security issues from ORCH-121 review
...
ci/woodpecker/push/woodpecker Pipeline failed
Priority Fixes (Required Before Production):
H3: Add rate limiting to webhook endpoint
- Added slowapi library for FastAPI rate limiting
- Implemented per-IP rate limiting (100 req/min) on webhook endpoint
- Added global rate limiting support via slowapi
M4: Add subprocess timeouts to all gates
- Added timeout=300 (5 minutes) to all subprocess.run() calls in gates
- Implemented proper TimeoutExpired exception handling
- Removed dead CalledProcessError handlers (check=False makes them unreachable)
M2: Add input validation on QualityCheckRequest
- Validate files array size (max 1000 files)
- Validate file paths (no path traversal, no null bytes, no absolute paths)
- Validate diff summary size (max 10KB)
- Validate taskId and agentId format (non-empty)
Additional Fixes:
H1: Fix coverage.json path resolution
- Use absolute paths resolved from project root
- Validate path is within project boundaries (prevent path traversal)
Code Review Cleanup:
- Moved imports to module level in quality_orchestrator.py
- Refactored mock detection logic into separate helper methods
- Removed dead subprocess.CalledProcessError exception handlers from all gates
Testing:
- Added comprehensive tests for all security fixes
- All 339 coordinator tests pass
- All 447 orchestrator tests pass
- Followed TDD principles (RED-GREEN-REFACTOR)
Security Impact:
- Prevents webhook DoS attacks via rate limiting
- Prevents hung processes via subprocess timeouts
- Prevents path traversal attacks via input validation
- Prevents malformed input attacks via comprehensive validation
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-04 11:50:05 -06:00
3a98b78661
fix: Complete CSRF protection implementation
...
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
Closes three CSRF security gaps identified in code review:
1. Added X-CSRF-Token and X-Workspace-Id to CORS allowed headers
- Updated apps/api/src/main.ts to accept CSRF token headers
2. Integrated CSRF token handling in web client
- Added fetchCsrfToken() to fetch token from API
- Store token in memory (not localStorage for security)
- Automatically include X-CSRF-Token in POST/PUT/PATCH/DELETE
- Implement automatic token refresh on 403 CSRF errors
- Added comprehensive test coverage for CSRF functionality
3. Applied CSRF Guard globally
- Added CsrfGuard as APP_GUARD in app.module.ts
- Verified @SkipCsrf() decorator works for exempted endpoints
All tests passing. CSRF protection now enforced application-wide.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-04 07:12:42 -06:00
41f1dc48ed
Merge branch 'fix/201-wikilink-xss-protection' into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 23:00:04 -06:00
e57271c278
fix( #201 ): Enhance WikiLink XSS protection with comprehensive validation
...
ci/woodpecker/push/woodpecker Pipeline failed
Added defense-in-depth security layers for wiki-link rendering:
Slug Validation (isValidWikiLinkSlug):
- Reject empty slugs
- Block dangerous protocols: javascript:, data:, vbscript:, file:, about:, blob:
- Block URL-encoded dangerous protocols (e.g., %6A%61%76%61... = javascript)
- Block HTML tags in slugs
- Block HTML entities in slugs
- Only allow safe characters: a-z, A-Z, 0-9, -, _, ., /
Display Text Sanitization (DOMPurify):
- Strip all HTML tags from display text
- ALLOWED_TAGS: [] (no HTML allowed)
- KEEP_CONTENT: true (preserves text content)
- Prevents event handler injection
- Prevents iframe/object/embed injection
Comprehensive XSS Testing:
- 11 new attack vector tests
- javascript: URLs - blocked
- data: URLs - blocked
- vbscript: URLs - blocked
- Event handlers (onerror, onclick) - removed
- iframe/object/embed - removed
- SVG with scripts - removed
- HTML entity bypass - blocked
- URL-encoded protocols - blocked
- All 25 tests passing (14 existing + 11 new)
Files modified:
- apps/web/src/components/knowledge/WikiLinkRenderer.tsx
- apps/web/src/components/knowledge/__tests__/WikiLinkRenderer.test.tsx
Fixes #201
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:59:41 -06:00
db23486e9e
Merge branch 'fix/200-mermaid-xss-protection' into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:56:19 -06:00
f87a28ac55
fix( #200 ): Enhance Mermaid XSS protection with DOMPurify
...
ci/woodpecker/push/woodpecker Pipeline failed
Added defense-in-depth security layers for Mermaid rendering:
DOMPurify SVG Sanitization:
- Sanitize SVG output after mermaid.render()
- Remove script tags, iframes, objects, embeds
- Remove event handlers (onerror, onclick, onload, etc.)
- Use SVG profile for allowed elements
Label Sanitization:
- Added sanitizeMermaidLabel() function
- Remove HTML tags from all labels
- Remove dangerous protocols (javascript:, data:, vbscript:)
- Remove control characters
- Escape Mermaid special characters
- Truncate to 200 chars for DoS prevention
- Applied to all node labels in diagrams
Comprehensive XSS Testing:
- 15 test cases covering all attack vectors
- Script tag injection variants
- Event handler injection
- JavaScript/data URL injection
- SVG with embedded scripts
- HTML entity bypass attempts
- All tests passing
Files modified:
- apps/web/src/components/mindmap/MermaidViewer.tsx
- apps/web/src/components/mindmap/hooks/useGraphData.ts
- apps/web/src/components/mindmap/MermaidViewer.test.tsx (new)
Fixes #200
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:55:57 -06:00
6ff6957db4
Merge branch 'fix/298-async-dashboard' into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:51:47 -06:00
9582d9a265
fix( #298 ): Fix async response handling in dashboard
...
ci/woodpecker/push/woodpecker Pipeline failed
Replaced setTimeout hacks with proper polling mechanism:
- Added pollForQueryResponse() function with configurable polling interval
- Polls every 500ms with 30s timeout
- Properly handles DELIVERED and FAILED message states
- Throws errors for failures and timeouts
Updated dashboard to use polling instead of arbitrary delays:
- Removed setTimeout(resolve, 1000) hacks
- Added proper async/await for query responses
- Improved response data parsing for new query format
- Better error handling via polling exceptions
This fixes race conditions and unreliable data loading.
Fixes #298
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:51:25 -06:00
d675189a77
Merge branch 'fix/297-query-processing' into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:49:21 -06:00
4ac4219ce0
fix( #297 ): Implement actual query processing for federation
...
ci/woodpecker/push/woodpecker Pipeline failed
Added query processing to route federation queries to domain services:
- Created query parser to extract intent and parameters from query strings
- Route queries to TasksService, EventsService, and ProjectsService
- Return actual data instead of placeholder responses
- Added workspace context validation
Implemented query types:
- Tasks: "get tasks", "show tasks", etc.
- Events: "get events", "upcoming events", etc.
- Projects: "get projects", "show projects", etc.
Added 5 new tests for query processing (20 tests total, all passing):
- Process tasks/events/projects queries
- Handle unknown query types
- Enforce workspace context requirements
Updated FederationModule to import TasksModule, EventsModule, ProjectsModule.
Fixes #297
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:48:59 -06:00
3e02bade98
Merge branch 'fix/195-rls-context-helpers' into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:45:13 -06:00
68f641211a
fix( #195 ): Implement RLS context helpers consistently across all services
...
ci/woodpecker/push/woodpecker Pipeline failed
Added workspace context management to PrismaService:
- setWorkspaceContext(userId, workspaceId, client?) - Sets session variables
- clearWorkspaceContext(client?) - Clears session variables
- withWorkspaceContext(userId, workspaceId, fn) - Transaction wrapper
Extended db-context.ts with workspace-scoped helpers:
- setCurrentWorkspace(workspaceId, client)
- setWorkspaceContext(userId, workspaceId, client)
- clearWorkspaceContext(client)
- withWorkspaceContext(userId, workspaceId, fn)
All functions use SET LOCAL for transaction-scoped variables (connection pool safe).
Added comprehensive tests (11 passing unit tests).
Fixes #195
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:44:54 -06:00
555fcd04db
Merge fix/194-workspace-id-transmission into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:38:40 -06:00
88be403c86
feat( #194 ): Fix workspace ID transmission mismatch between API and client
...
ci/woodpecker/push/woodpecker Pipeline failed
- Update WorkspaceGuard to support query string as fallback (backward compatibility)
- Priority order: Header > Param > Body > Query
- Update web client to send workspace ID via X-Workspace-Id header (recommended)
- Extend apiRequest helpers to accept workspace ID option
- Update fetchTasks to use header instead of query parameter
- Add comprehensive tests for all workspace ID transmission methods
- Tests passing: API 11 tests, Web 6 new tests (total 494)
This ensures consistent workspace ID handling with proper multi-tenant isolation
while maintaining backward compatibility with existing query string approaches.
Fixes #194
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:38:13 -06:00
ae4221968e
Merge fix/193-auth-alignment into develop
ci/woodpecker/push/woodpecker Pipeline failed
2026-02-03 22:30:11 -06:00
a2b61d2bff
feat( #193 ): Align authentication mechanism between API and web client
...
ci/woodpecker/push/woodpecker Pipeline failed
- Update AuthUser type in @mosaic/shared to include workspace fields
- Update AuthGuard to support both cookie-based and Bearer token authentication
- Add /auth/session endpoint for session validation
- Install and configure cookie-parser middleware
- Update CurrentUser decorator to use shared AuthUser type
- Update tests for cookie and token authentication (20 tests passing)
This ensures consistent authentication handling across API and web client,
with proper type safety and support for both web browsers (cookies) and
API clients (Bearer tokens).
Fixes #193
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 22:29:42 -06:00
8aadfb99af
Merge pull request 'M7.1 Remediation: P2 Reliability Improvements (#291-#293, #295 )' ( #321 ) from feature/m7.1-reliability-remediation into develop
...
ci/woodpecker/push/woodpecker Pipeline failed
Reviewed-on: #321
2026-02-04 04:11:01 +00:00