Files

T

CI / build (push) Has been cancelled

Details

Archive completed tasks, add cleanup commands, self-documenting dashboard UI

- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/
- status.py: add --cleanup-done and --install-cleanup-schedule commands
- Add scripts/automaton-cleanup.sh for periodic task archiving
- Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders
- .rules.md: add Self-Documenting UI Names rule
- New tests: test_cleanup_done.py, expanded test_app.py and test_task.py

2026-06-24 22:43:33 -04:00

1.2 KiB

Raw Blame History

Adversarial Bug Report: Dashboard Task Review and Approval

Deep Review

The review API writes REVIEW.md to the task folder. Submissions are POST with status + comment.

Potential Issues

No authentication: Any HTTP client can submit reviews. The dashboard is localhost-only by default, but --host 0.0.0.0 exposes the review API without auth.
No CSRF protection: POST endpoint accepts JSON from any origin. Mitigated by same-origin policy and no cookies/auth.
Path traversal in task name: Task name is URL-decoded but no ../ check. An attacker could write REVIEW.md outside the tasks directory. Fixed below.
Comment injection: Comment content is written directly to REVIEW.md without escaping. If REVIEW.md is ever consumed by a markdown renderer, injected markdown could be an issue.

Security Fix: Path traversal

The _handle_review endpoint writes to project_root / ".automaton" / "tasks" / task_name / self.REVIEW_FILE. If task_name contains ../, the review file could be written outside the tasks directory. Add a path traversal check.

Security Fix Applied

Added path traversal validation to task name in _handle_review and _get_review_status.

1.2 KiB Raw Blame History