drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Browse Source 
Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.
This commit is contained in:
drjones
2026-05-28 19:53:53 -07:00
parent 3316a75f7a
commit 9e26c4babb
16 changed files with 332 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
PROBLEMS.md
View File

@@ -41,8 +41,8 @@ Findings grouped by severity. Updated after bug-sweep pass.
| ID | Issue |
|----|-------|
| C7 | No authentication on control plane (dashboard REST/WS) |
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) |
| C7 | Partial — REST `/api/v1` requires basic auth; dashboard WebSocket + SPA are open. Use **Calibrate → Save session login** so fetch calls authenticate. |
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) on agents that connect to your server |
### High (intentional / deploy-time)