agentic-os

Commit Graph

Author	SHA1	Message	Date
modimihir07	a30162d114	Security audit fixes: path traversal, XSS, info disclosure, missing headers CRITICAL fixes: - Path traversal prevention in brain/backup/skill/file endpoints - Unsafe tar extraction with safe_extractall() path validation HIGH fixes: - XSS: encodeURIComponent for onclick handlers in skills/memory/prompts/standards/backups - XSS: escapeHtml() for user-controlled text in cost/plugins/settings/audit/dashboard - XSS: safe class name mapping in setup-wizard (attribute injection) - Security headers middleware (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) - CORS restricted to localhost:8080 - Settings API keys masked before returning to client - Session replay content limited to 2000 chars + path validation MEDIUM fixes: - Chat message length limit (10000 chars) - Input validation on brain/skill/backup file names (reject .. and /)	2026-06-29 13:57:44 +05:30
modimihir07	43c3413bca	Complete dashboard revamp: modern glassmorphism UI, all 12 pages functional - Complete CSS redesign with glassmorphism, gradients, animations - All 12 SPA pages rewritten with working forms, modals, charts - Fixed server.py static file serving for dashboard assets - Enhanced utils: modal system, toast with icons, skeletons - Dashboard: stat cards, agent status, activity feed, quick run - Skills: grid/list views, filter, detail with performance chart - Memory: browse/edit brain files inline - Scheduler: CRUD jobs with cron input - Audit: filterable log viewer - Cost: Chart.js agent/time charts, test recording, free-tier alerts - Plugins: registry browser with install flow - Backups: create/restore with confirmation dialog - Prompts: card grid with preview, copy-to-clipboard - Standards: index + detail cards, pattern discovery - Settings: agent toggle, API keys, free-tier limits, dark mode - Setup Wizard: 4-step guided configuration	2026-05-17 15:48:54 +05:30
modimihir07	73efe0f7e4	Initial commit: Agentic OS v1.0.0 - AGENTS.md single source of truth with 51+10 features - FastAPI backend with 20+ REST endpoints - 15 skills with self-improvement (eval + learnings) - Web SPA dashboard with 12 pages - Agent configs for opencode, Hermes, Gemini CLI - APScheduler, plugin registry, standards system - 10 prompt templates, cost analytics, backup/restore	2026-05-17 15:23:44 +05:30

Author

SHA1

Message

Date

modimihir07

a30162d114

Security audit fixes: path traversal, XSS, info disclosure, missing headers

CRITICAL fixes:
- Path traversal prevention in brain/backup/skill/file endpoints
- Unsafe tar extraction with safe_extractall() path validation

HIGH fixes:
- XSS: encodeURIComponent for onclick handlers in skills/memory/prompts/standards/backups
- XSS: escapeHtml() for user-controlled text in cost/plugins/settings/audit/dashboard
- XSS: safe class name mapping in setup-wizard (attribute injection)
- Security headers middleware (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- CORS restricted to localhost:8080
- Settings API keys masked before returning to client
- Session replay content limited to 2000 chars + path validation

MEDIUM fixes:
- Chat message length limit (10000 chars)
- Input validation on brain/skill/backup file names (reject .. and /)

2026-06-29 13:57:44 +05:30

modimihir07

43c3413bca

Complete dashboard revamp: modern glassmorphism UI, all 12 pages functional

- Complete CSS redesign with glassmorphism, gradients, animations
- All 12 SPA pages rewritten with working forms, modals, charts
- Fixed server.py static file serving for dashboard assets
- Enhanced utils: modal system, toast with icons, skeletons
- Dashboard: stat cards, agent status, activity feed, quick run
- Skills: grid/list views, filter, detail with performance chart
- Memory: browse/edit brain files inline
- Scheduler: CRUD jobs with cron input
- Audit: filterable log viewer
- Cost: Chart.js agent/time charts, test recording, free-tier alerts
- Plugins: registry browser with install flow
- Backups: create/restore with confirmation dialog
- Prompts: card grid with preview, copy-to-clipboard
- Standards: index + detail cards, pattern discovery
- Settings: agent toggle, API keys, free-tier limits, dark mode
- Setup Wizard: 4-step guided configuration

2026-05-17 15:48:54 +05:30

modimihir07

73efe0f7e4

Initial commit: Agentic OS v1.0.0

- AGENTS.md single source of truth with 51+10 features
- FastAPI backend with 20+ REST endpoints
- 15 skills with self-improvement (eval + learnings)
- Web SPA dashboard with 12 pages
- Agent configs for opencode, Hermes, Gemini CLI
- APScheduler, plugin registry, standards system
- 10 prompt templates, cost analytics, backup/restore

2026-05-17 15:23:44 +05:30

3 Commits