Archive completed tasks, add cleanup commands, self-documenting dashboard UI

- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
2026-06-24 22:43:33 -04:00
parent e13513faaa
commit 4a2301b077
572 changed files with 856 additions and 101 deletions
@@ -1 +0,0 @@
-complete
@@ -1,24 +0,0 @@
-# Implementation: Harden Dashboard Security and Fix Scripts
-
-## Summary
-Closed security holes in the dashboard static file serving and tightened task name validation. Fixed `update.sh` to warn about uncommitted changes. Replaced placeholder URLs with the real Gitea repository URL. Added artifact integrity guidance.
-
-## Files Changed
- `automaton/dashboard/ui/app.py`
-  - Replaced string-prefix path traversal check with robust `Path.relative_to()` resolution.
-  - Tightened task name validation to allow only `[A-Za-z0-9_-]+`.
-  - Added `import re`.
- `tests/test_app.py` — added symlink path-traversal test and static-file happy-path test.
- `scripts/update.sh` — added uncommitted-changes check before `git pull`.
- `README.md` — replaced placeholder install URL with `http://10.37.0.86:3003/hermes/automaton`.
- `scripts/install.sh` — replaced placeholder clone URL with `http://10.37.0.86:3003/hermes/automaton`.
- `.rules.md` — added "Artifact Integrity" section with atomic-write guidance.
-
-## Verification
- `python -m pytest tests/` passes: **72 tests passed**.
- `bash -n scripts/update.sh` passes.
- `bash -n scripts/install.sh` passes.
-
-## Decisions
- Task names are restricted to kebab-case/alphanumeric to prevent filesystem traversal.
- Symlinks escaping `html_dir` are rejected with 403.
@@ -1,4 +0,0 @@
-# Review
- **Status**: approved
- **Timestamp**: 2026-06-14T09:59:34.838092
- **Comment**: 
@@ -1,25 +0,0 @@
-# SPEC: Harden Dashboard Security and Fix Scripts
-
-## Goal
-Close obvious security holes in the dashboard and fix script/documentation bugs identified in the audit.
-
-## Requirements
-1. Fix path-traversal guard in `automaton/dashboard/ui/app.py`:
-   - Replace string-prefix check with `Path.relative_to` resolution.
-2. Tighten task name validation in the review API.
-3. Add uncommitted-changes warning to `scripts/update.sh` before running `git pull`.
-4. Replace the placeholder repository URL in `README.md` and `scripts/install.sh` with `http://10.37.0.86:3003/hermes/automaton`.
-5. Add guidance on atomic artifact writes to `references/stop-hook-pattern.md` or `.rules.md`.
-
-## Acceptance Criteria
- [ ] Path-traversal check uses robust `Path` comparison.
- [ ] Tests include path-traversal attempts.
- [ ] `update.sh` aborts or warns when local uncommitted changes exist.
- [ ] `README.md` and `install.sh` contain the real Gitea URL.
-
-## Non-Goals
- Adding authentication to the dashboard.
- Rewriting scripts in another language.
-
-## Stop Condition
-When all acceptance criteria are met, output "CONTRACT_MET".
@@ -1,20 +0,0 @@
-# Verdict: Harden Dashboard Security and Fix Scripts
-
-## Status: PASS
-**Completion Date**: 2026-06-14
-
-## Summary
-Dashboard static file serving now uses a robust path containment check, task names are strictly validated, `update.sh` protects against overwriting local changes, and repository URLs point to the real Gitea instance.
-
-## Findings
- Path traversal check uses `Path.relative_to()`.
- Task name regex rejects special characters and path separators.
- `update.sh` aborts on uncommitted changes.
- README and install script contain the real Gitea URL.
- Atomic-write guidance added to `.rules.md`.
-
-## Remaining Issues
-None.
-
-## Score
-+10 PASS