gitea
05c76852a2
CI / build (push) Has been cancelled
State Enforcement (v2.0):
- .state file as single source of truth for task phase
- Approval gates for research, decomposition, design, test_design
- status.py --transition refuses illegal phase transitions
- status.py --validate-folder detects out-of-order artifacts
- status.py --audit checks all tasks for violations
- status.py --create-task is the only valid way to create tasks
- Pre-v2.0 tasks without .state are UNTRACKED -- all commands refuse them
- New --upgrade command bootstraps .state files for existing tasks
Project Scoping:
- --project flag added to all status.py commands across 16+ files
- _find_project_dir errors instead of silently falling back to ~/.automaton/
- --scope-check marks framework files OUT_OF_SCOPE when working on a project
- Dashboard handlers use stored project_root instead of re-detecting from CWD
- Prompts reference ~/.automaton/scripts/vram_detect.py (not {project}/.automaton/)
Harness Integration:
- status.py --can-edit now supports project-level checks (no --task required)
- --can-edit --file checks file scope without --task
- --json output for machine-readable harness integration
- opencode plugin (plugins/automaton-guard/plugin.ts) intercepts edit/write
- Git pre-commit hook (scripts/git-hooks/pre-commit) blocks commits without task
- Formal integration contract (contracts/harness-integration.md)
Other:
- upgrade.sh delegates to status.py --upgrade instead of manual heuristics
- Phase prompts reference --project {project} for multi-project scoping
- 200 tests passing (14 new)
69 lines
3.4 KiB
Markdown
69 lines
3.4 KiB
Markdown
# Wire DashboardConfig + Add Caching + Add Size Limits
|
|
|
|
## Goal
|
|
|
|
Activate the dead `DashboardConfig` module, add basic server-side caching to eliminate redundant disk I/O on every API request, and add input size limits to the review POST endpoint.
|
|
|
|
## Requirements
|
|
|
|
### R1. Wire DashboardConfig into the frontend
|
|
|
|
`dashboard/config.py` defines 5 settings but none are consumed by the server or client. `self.config` is loaded at `ui/app.py:323` and immediately abandoned.
|
|
|
|
**Fix**:
|
|
- Add `GET /api/config` endpoint returning `config.to_dict()`
|
|
- Add `PUT /api/config` endpoint accepting `body: dict` and calling `config.save()`
|
|
- On dashboard init (`dashboard.js:466`), fetch `/api/config` and apply:
|
|
- `auto_refresh_interval` → set polling interval (default 2s)
|
|
- `default_view` → switch to board/stats/timeline on load
|
|
- `theme` → set CSS `data-theme` attribute
|
|
- `show_timelines` → show/hide timeline elements
|
|
- `column_width` → set CSS `--col-min-width` variable
|
|
- Remove hardcoded `setInterval(refreshData, 2000)` on line 462 and use config value
|
|
|
|
### R2. Add server-side caching for task scans
|
|
|
|
Currently every `/api/tasks`, `/api/task/{name}`, and `/api/review-summary` call does a full `discover_tasks()` — reading all artifact files from disk. At 2s polling, this is thousands of file reads per minute for ~84KB of data.
|
|
|
|
**Fix**:
|
|
- Add a module-level cache with TTL (e.g., 1 second or triggered by review writes)
|
|
- `/api/tasks` returns cached data within TTL window
|
|
- `/api/task/{name}` looks up task by name from cached list instead of re-scanning
|
|
- Writing a review (`/api/task/{name}/review` POST) invalidates the cache
|
|
- Cache stores the list of `Task` objects, not the serialized JSON
|
|
|
|
### R3. Add input size limits to review POST
|
|
|
|
`ui/app.py:250-263` reads `content_length` from the header and reads the full body with no bounds check. A malicious client can:
|
|
- Send `Content-Length: 999999999` and never send the body → blocks single-threaded server (DoS)
|
|
- Send a 10MB comment → writes 10MB to REVIEW.md (disk abuse)
|
|
|
|
**Fix**:
|
|
- Add `MAX_POST_BODY = 65536` (64KB) constant
|
|
- If `content_length > MAX_POST_BODY`, return 413 Payload Too Large
|
|
- If `content_length <= 0`, return 400 Bad Request
|
|
- Cap `comment` to 4096 characters before writing to disk
|
|
|
|
### R4. Add `/api/task/{name}` to use cache
|
|
|
|
`_serve_task()` at `ui/app.py:170-195` calls `discover_tasks()` to find one task. Use the cache from R2 for O(1) lookup.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] `GET /api/config` returns current config as JSON
|
|
- [ ] `PUT /api/config` with `{"theme": "dark"}` persists to `dashboard-config.json`
|
|
- [ ] Dashboard JS reads config on init and applies theme, default_view, auto_refresh_interval
|
|
- [ ] Changing config via dashboard-config.json and restarting dashboard applies the settings
|
|
- [ ] `/api/tasks` within TTL returns cached data (no disk reads on second poll)
|
|
- [ ] Writing a review via POST invalidates cache; next `/api/tasks` re-reads from disk
|
|
- [ ] POST with `Content-Length: 1000000` returns 413
|
|
- [ ] POST with comment > 4096 chars truncates to 4096 before writing
|
|
- [ ] `test_config.py` tests still pass
|
|
- [ ] `test_app.py` tests still pass
|
|
|
|
## Non-Goals
|
|
|
|
- Not implementing persistent caching (disk/memcached) — in-memory TTL is sufficient
|
|
- Not adding authentication to config endpoints (config changes require local access by design)
|
|
- Not optimizing `discover_tasks()` itself — the cache removes the hot path
|