Closes the four CRITICAL findings from the 2026-06-13 review.
C1 — Werkzeug debug RCE / dev server in prod:
- FLASK_DEBUG defaults False (kills interactive-debugger network RCE)
- production runs gunicorn (-w 1 --threads 8) via `npm run start`; Dockerfile
builds the frontend and serves it with `vite preview` (host 0.0.0.0); gunicorn
+ uv.lock updated
- Config.validate() now runs inside create_app() so the gunicorn path enforces
SECRET_KEY (prod) / API_KEY / LLM / ZEP at boot
C2 — zero auth on all /api/* routes:
- before_request API-key guard (X-API-Key / Bearer), constant-time bytes compare,
/health + OPTIONS exempt
- AUTH_ENABLED fail-closed parse (only explicit false/0/no/off disables)
- frontend axios injects X-API-Key from build-time VITE_API_KEY, wired through
docker compose build-arg -> Dockerfile ARG -> vite build (+ frontend/.env.example)
C3 — denial-of-wallet (no cost ceiling; OASIS_DEFAULT_MAX_ROUNDS was dead config):
- OASIS_DEFAULT_MAX_ROUNDS now applied when max_rounds omitted (default 150, covers
the 144-round demo); hard ceilings OASIS_MAX_ROUNDS_CAP / OASIS_MAX_AGENTS_CAP;
runner always forwards the clamped rounds to the subprocess
C4 — no simulation deadline; env.step could wedge forever:
- every env.step (initial / round-loop / interview) wrapped in asyncio.wait_for
(OASIS_ROUND_TIMEOUT_SEC) across all 3 run scripts; per-loop total-deadline
(OASIS_RUN_TIMEOUT_SEC); gather(return_exceptions=True) + single-platform
try/except so one platform's failure can't skip env.close
New env vars documented in .env.example + README security section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Eliminated unnecessary warnings suppression related to multiprocessing resource tracking in `run.py` and `run_parallel_simulation.py`, streamlining the code and reducing potential confusion.
- This change enhances clarity in logging by allowing relevant warnings to be displayed during execution, improving traceability and debugging capabilities.
- Added signal handling to gracefully manage shutdown events across simulation scripts, ensuring proper cleanup of resources.
- Introduced a global shutdown event to allow simulations to respond to termination signals, improving robustness.
- Suppressed warnings related to multiprocessing resource tracking to avoid unnecessary log clutter during execution.
- Updated cleanup logic in `SimulationRunner` and `ZepGraphMemoryManager` to prevent redundant calls and ensure efficient resource management.
- Enhanced logging to provide clearer feedback during shutdown processes, improving traceability.
- Added context enrichment for actions in `fetch_new_actions_from_db`, providing complete information for posts, comments, and user interactions.
- Introduced a new `_enrich_action_context` function to supplement action arguments with relevant details such as post content, author names, and comment information.
- Updated the `ZepGraphMemoryUpdater` to batch send activities by platform, improving efficiency in processing and logging.
- Enhanced logging to include detailed statistics on sent activities and skipped actions, ensuring better traceability and monitoring of the activity flow.
- Added a new Interview module to facilitate interactions with agents post-simulation, allowing for single and batch interviews.
- Introduced IPC communication mechanism for command and response handling between the Flask backend and simulation scripts.
- Updated README.md to include detailed instructions on the new Interview functionality, including API endpoints and usage examples.
- Enhanced simulation scripts to support waiting for commands after completion, improving user control over the simulation environment.
- Implemented error handling and logging for interview processes, ensuring robust operation and traceability.
- Removed content truncation logic from the AgentActivity class, allowing full content to be logged for posts, comments, and quotes.
- Updated the `fetch_new_actions_from_db` function to retain complete content in action arguments, enhancing data accuracy.
- Adjusted simulation scripts to ensure that full content is sent during action creation, improving the representation of agent activities.
- Added logging for the start and end of round 0 in both Twitter and Reddit simulations, improving traceability of initial events.
- Updated the logging mechanism to record round end even when no active agents are present, ensuring comprehensive action tracking.
- Introduced initial action count tracking to provide insights into the number of actions taken during the initial phase of simulations.
- Added support for a `max_rounds` parameter in simulation API, allowing users to limit the number of simulation rounds, improving control over simulation duration.
- Updated README.md to reflect the new `max_rounds` parameter and its usage in simulation requests.
- Enhanced error handling for `max_rounds` input validation to ensure it is a positive integer.
- Modified simulation runner and related scripts to incorporate `max_rounds` functionality, ensuring consistent application across Twitter and Reddit simulations.
- Improved logging to indicate when the number of rounds is truncated due to the `max_rounds` setting, enhancing traceability during simulation execution.
- Introduced `get_agent_names_from_config` function to map agent IDs to their entity names from the simulation configuration, enhancing clarity in action representation.
- Updated simulation scripts to utilize this new function for fetching agent names, ensuring that real entity names are displayed instead of default identifiers.
- Improved handling of agent names by falling back to default names only if not specified in the configuration, maintaining consistency across simulations.
- Updated .env.example to include new keys for dual LLM configuration, allowing for both general and boost settings.
- Modified create_model function to support an optional use_boost parameter, enabling the selection of either general or boost LLM configurations based on availability.
- Improved logging to indicate which LLM configuration is being used during model creation, enhancing clarity for users.
- Introduced MaxTokensWarningFilter to suppress specific warnings related to max_tokens in the logging output across simulation scripts.
- Added a semaphore parameter to limit the maximum concurrent LLM requests in Twitter and Reddit simulation functions, preventing API overload.
- Ensured the filter is applied immediately upon module loading for effective logging management.
- Registered a cleanup function for simulation processes to ensure proper termination on server shutdown.
- Improved logging during application startup to confirm the registration of the cleanup function.
- Updated simulation preparation checks to clarify the conditions for considering a simulation ready, enhancing error handling and user feedback.
- Added detailed logging for simulation status changes, improving traceability during the simulation lifecycle.
- Introduced new files for simulation configuration and profile data, supporting enhanced testing and visualization capabilities.
- Updated simulation preparation checks to exclude script files from the required files list, improving clarity on file management.
- Implemented a robust retry mechanism for Zep API calls in the ZepEntityReader service, enhancing reliability.
- Enhanced logging in simulation scripts to provide clearer insights into the simulation process and errors.
- Updated simulation runner to manage stdout and stderr logs more effectively, ensuring better error tracking.
- Improved profile generation to standardize gender fields and ensure all required fields are populated correctly.
- Updated README.md to include new simulation scripts and configuration details for OASIS, including API retry mechanisms and environment variable settings.
- Added simulation management and configuration generation services to streamline the simulation process across Twitter and Reddit platforms.
- Introduced new API routes for simulation-related operations, including entity retrieval and simulation status management.
- Implemented a robust retry mechanism for external API calls to improve system stability.
- Enhanced task management model to include detailed progress tracking.
- Added logging capabilities for action tracking during simulations.
- Included new scripts for running parallel simulations and testing profile formats.
Yo-LRK
666ghj