CRITICAL fixes:
- Path traversal prevention in brain/backup/skill/file endpoints
- Unsafe tar extraction with safe_extractall() path validation
HIGH fixes:
- XSS: encodeURIComponent for onclick handlers in skills/memory/prompts/standards/backups
- XSS: escapeHtml() for user-controlled text in cost/plugins/settings/audit/dashboard
- XSS: safe class name mapping in setup-wizard (attribute injection)
- Security headers middleware (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- CORS restricted to localhost:8080
- Settings API keys masked before returning to client
- Session replay content limited to 2000 chars + path validation
MEDIUM fixes:
- Chat message length limit (10000 chars)
- Input validation on brain/skill/backup file names (reject .. and /)
New features:
- Kanban Board: Visual task management with drag-and-drop, filter, priority, block/unblock
- Goals: Project targets with progress tracking, auto-sync to brain/active-projects.md
- Journal: Daily entries stored as brain/journal/YYYY-MM-DD.md with search
- Agent Health: Real-time monitoring of 3 agents (opencode/hermes/gemini)
- Smart Router: Keyword-based task routing with confidence scoring
- Learning Analytics: Skill evaluation scores and performance trends
- Session Replay: Browse and replay past opencode sessions
Technical changes:
- 30 new API endpoints across all 7 features
- api.patch() method added for PATCH support
- UI modernization: glass morphism cards, gradients, glow effects, skeleton loaders, empty states
- New CSS section (v0.2.0) with kanban board, goal cards, journal entries, agent health cards, smart router suggestions, chart cards, session messages
- 7 new sidebar nav items under Workflow and Monitoring sections
- All changes are additive (zero breaking changes to existing 13 pages / 28 endpoints)
- Full smoke test verified: every endpoint returns correct data
- New Agentic OS logo: SVG hexagon with gradient (replaces unicode)
- Modern sidebar toggle: SVG chevron with 180° rotation animation
- Favicon: proper SVG favicon returning 200 with browser icon
- Agent status cache (15s TTL) eliminates slow subprocess on every status call
- Chat moved to top of sidebar nav (Primary section, before Dashboard)
- Reorganized sidebar: Primary > Agents > Management > System sections
- Glassmorphism card effects with gradient overlays
- Stat values with gradient text, enhanced stat icons with glow
- Button micro-interactions: scale, shadow, gradient overlay on hover
- Table polish: better row transitions, border-spacing
- Chat sidebar: active agent indicator, hover animations
- Gradient logo text matching SVG accent
- All 13 pages verified 200, zero console errors
- AGENTS.md single source of truth with 51+10 features
- FastAPI backend with 20+ REST endpoints
- 15 skills with self-improvement (eval + learnings)
- Web SPA dashboard with 12 pages
- Agent configs for opencode, Hermes, Gemini CLI
- APScheduler, plugin registry, standards system
- 10 prompt templates, cost analytics, backup/restore
modimihir07