LotusGuild/pulse
3
0
Fork 0
Code Issues 33 Pull Requests Actions Packages Projects Releases Wiki Activity
68 Commits 3 Branches 3 Tags
1c3a2777c8b796fddbe03726732252af89372f2c
Commit Graph
8 Commits
Author SHA1 Message Date
jaredandClaude Fable 5.1 1c3a2777c8 chore(deps): npm audit fix — ws 8.21.3, mysql2 3.24.4, qs 6.16.0 (0 vulnerabilities)
Lint / JS (eslint) (push) Successful in 10s
Details
Lint / Notify on failure (push) Skipped
Details
Lint / Deploy (push) Skipped
Details
Lint / JS (eslint) (pull_request) Successful in 10s
Details
Lint / Notify on failure (pull_request) Skipped
Details
Lint / Deploy (pull_request) Skipped
Details
Security / JS Security (npm audit) (push) Successful in 10s
Details
Test / JS Tests (jest) (push) Successful in 10s
Details
Security / JS Security (npm audit) (pull_request) Successful in 10s
Details
Test / JS Tests (jest) (pull_request) Successful in 11s
Details 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HamVMDrA8RqhyxmUHgiqRp
 2026-09-08 22:21:47 -04:00
jaredandClaude Fable 5.1 cbb91a306d feat(ui): TDS migration stage 1 — EJS layout, CSP, vendored design system, shared runtime 
- Vendor web_template base.css/base.js (v1.2 bbec859) under public/web_template with sync script
- Add views/layout.ejs (fixed upstream EJS comment delimiters, mobile drawer, cmd palette,
  keys help, WS status, theme toggle) and lib/render.js two-step renderer
- Add page routes for /, /workers, /workflows, /executions, /quick, /scheduler (stub views)
- helmet with strict nonce CSP (script-src-attr 'none'), /csp-report, report-only toggle
- lib/pageauth.js: shared users upsert + HTML 401/403 for page routes
- PULSE_DEV_READONLY guard disabling background writers for local testing
- public/assets/app.js shared runtime (Pulse namespace, delegated actions, WS singleton,
  themed confirm modal) and app.css
- eslint globals for browser files; ignore vendored assets

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HamVMDrA8RqhyxmUHgiqRp
 2026-09-08 21:46:24 -04:00
jaredandClaude Sonnet 4.6 f4e44b67a9 Fix ESLint errors in test files and npm vulnerabilities
Lint / JS (eslint) (push) Successful in 11s
Details
Security / JS Security (npm audit) (push) Successful in 10s
Details
Test / JS Tests (jest) (push) Successful in 10s
Details
Lint / Deploy (push) Successful in 3s
Details 
- Add tests/.eslintrc.json to declare jest globals (describe/test/expect)
- Fix no-useless-escape in lib/utils.js regex character class
- Run npm audit fix: updated path-to-regexp and qs (1 high, 1 moderate fixed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 12:41:09 -04:00
jaredandClaude Sonnet 4.6 6e5f18ea58 Add jest test suite, extract pure utils module, fix cron-parser v5 API
Lint / JS (eslint) (push) Failing after 12s
Details
Security / JS Security (npm audit) (push) Failing after 13s
Details
Test / JS Tests (jest) (push) Successful in 13s
Details
Lint / Deploy (push) Has been skipped
Details 
- Extract validateWebhookUrl, applyParams, evalCondition, calculateNextRun
  to lib/utils.js so they can be tested without DB connection
- Fix cron-parser v5 API: parseExpression → CronExpressionParser.parse
- Add 31 jest tests covering all four utility functions
- Add test.yml CI workflow running jest on every push/PR
- Add jest devDependency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 12:24:30 -04:00
jaredandClaude Sonnet 4.6 d523b6d02a ci: add ESLint lint workflow with per-directory configs
Lint / JS (eslint) (push) Failing after 8s
Details 
Node.js env for server.js/worker/, browser env for public/.
All errors downgraded to warnings (empty blocks, inner declarations,
loose equality, useless escape, constant condition) for practical CI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-13 23:46:46 -04:00
jaredandClaude Sonnet 4.6 2d6a0f1054 Add rate limiting, cron scheduling, webhooks, dry-run, execution filtering, and UX improvements 
- Rate limiting: 300 req/15min general, 20 req/min on POST /api/executions
- Cron schedule type support using cron-parser for full cron expressions
- Webhook notifications: POST to workflow webhook_url on execution complete/failed
- Dry-run mode: simulate workflow execution without running any commands
- Global execution timeout via EXECUTION_MAX_MINUTES env var (default 60min)
- Execution filtering: status, workflow_id, started_by, after, before, search
- Event-driven command result delivery (replaces 500ms DB polling)
- Atomic log appends via JSON_ARRAY_APPEND (no read-modify-write race)
- Separate browserClients/workerClients sets (workers no longer receive broadcasts)
- Stale execution cleanup on startup (mark running→failed after crash)
- Scheduler overlap prevention (skip if same workflow already running)
- Frontend: webhook_url field in create/edit workflow modals
- Frontend: dry-run checkbox in workflow param modal
- Frontend: ESC closes modals, ws.onerror handler added
- Frontend: selectedExecutions changed from Array to Set (O(1) ops)
- Frontend: XSS fixes via escapeHtml() on all user-controlled innerHTML
- Frontend: param modal keydown listener deduplication fix
- Remove unused npm packages (bcryptjs, body-parser, cors, js-yaml, jsonwebtoken)
- Add express-rate-limit and cron-parser dependencies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-11 23:06:09 -04:00
jaredandClaude Sonnet 4.6 58c172e131 Security hardening, bug fixes, and performance improvements 
Security fixes:
- Replace new Function() condition eval with vm.runInNewContext() (RCE fix)
- Add admin checks to DELETE executions, all scheduled-commands endpoints
- Remove api_key from GET /api/workers response (was exposed to all employees)
- Separate browserClients/workerClients sets; broadcast() now sends to browsers only
- Add worker WebSocket auth: reject if api_key provided but invalid
- Fix XSS: escapeHtml() on step_name, duration, worker_id, user info, execution_id

Bug fixes:
- Replace DB-polling waitForCommandResult with event-driven _commandResolvers Map
- Replace non-atomic addExecutionLog with JSON_ARRAY_APPEND (fixes concurrent write race)
- Add stale execution recovery on startup: running→failed with log entry
- Fix calculateNextRun returning null for unknown types (now throws)
- Fix scheduler overlap: skip if previous execution still running
- Fix JSON double-parse on worker_ids column
- Fix switchTab() bare event.target reference
- Fix selectedExecutions Array→Set (O(1) lookups, fixes performance regression)
- Fix param modal event listener leak (delegated handler, removes before re-adding)
- Add ws.onerror handler (was silently swallowing WebSocket errors)
- Move misplaced routes to before server.listen()

Performance/cleanup:
- DB connection pool 10→50
- EXECUTION_RETENTION_DAYS default 1→30 (matches docs)
- Remove unused packages: bcryptjs, body-parser, cors, js-yaml, jsonwebtoken
- Remove generateUUID() wrapper, use crypto.randomUUID() directly
- Remove dead example workflow constants
- Add ESC key handler to close modals
- Fix clearCompletedExecutions limit 1000→9999
- Add security notice to README.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-11 22:53:25 -04:00
jared dcca2b9e50 Initial PULSE server commit with Authelia SSO integration 2025-11-29 19:26:20 -05:00