diff --git a/public/css/styles.css b/public/css/styles.css index 3813402..e17ff79 100644 --- a/public/css/styles.css +++ b/public/css/styles.css @@ -3437,50 +3437,36 @@ tbody tr:hover td { white-space: nowrap; } -.history-card-status { - display: flex; - align-items: center; - gap: 10px; - flex-shrink: 0; -} - -.history-card-date { - font-size: 12px; - color: var(--text-muted); - white-space: nowrap; -} - -.history-card-meta { - display: flex; - align-items: center; - justify-content: space-between; - gap: 12px; -} - .history-card-task { font-size: 13px; color: var(--text-secondary); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; - flex: 1; - min-width: 0; } +.history-card-info { + display: flex; + align-items: center; + gap: 16px; + font-size: 12px; + color: var(--text-muted); +} + +.history-card-date, .history-card-duration { display: flex; align-items: center; - gap: 4px; - font-size: 12px; - color: var(--text-muted); - flex-shrink: 0; + gap: 5px; white-space: nowrap; } +.history-card-date i, .history-card-duration i { - width: 12px; - height: 12px; + width: 13px; + height: 13px; flex-shrink: 0; + opacity: 0.6; } .history-card-actions { @@ -3986,12 +3972,6 @@ tbody tr:hover td { height: 12px; } -.history-card-duration-group { - display: flex; - align-items: center; - gap: 12px; -} - .pipeline-step-meta-group { display: flex; align-items: center; diff --git a/public/index.html b/public/index.html index a623da6..962d721 100644 --- a/public/index.html +++ b/public/index.html @@ -1118,6 +1118,7 @@ + diff --git a/public/js/app.js b/public/js/app.js index bd54933..0c0a6db 100644 --- a/public/js/app.js +++ b/public/js/app.js @@ -253,7 +253,7 @@ const App = {
Aprovação necessária - Passo ${stepIndex + 1} (${agentName || 'agente'}) aguardando autorização + Passo ${stepIndex + 1} (${Utils.escapeHtml(agentName) || 'agente'}) aguardando autorização
@@ -661,8 +661,8 @@ const App = { hidden.value = JSON.stringify(tags); chips.innerHTML = tags.map((t) => ` - ${t} - + ${Utils.escapeHtml(t)} + `).join(''); }; diff --git a/public/js/components/agents.js b/public/js/components/agents.js index 8f3580c..319f49e 100644 --- a/public/js/components/agents.js +++ b/public/js/components/agents.js @@ -76,7 +76,7 @@ const AgentsUI = { const model = (agent.config && agent.config.model) || agent.model || 'claude-sonnet-4-6'; const updatedAt = AgentsUI.formatDate(agent.updated_at || agent.updatedAt || agent.created_at || agent.createdAt); const tags = Array.isArray(agent.tags) && agent.tags.length > 0 - ? `
${agent.tags.map((t) => `${t}`).join('')}
` + ? `
${agent.tags.map((t) => `${Utils.escapeHtml(t)}`).join('')}
` : ''; return ` @@ -87,12 +87,12 @@ const AgentsUI = { ${initials}
-

${name}

+

${Utils.escapeHtml(name)}

${statusLabel}
- ${agent.description ? `

${agent.description}

` : ''} + ${agent.description ? `

${Utils.escapeHtml(agent.description)}

` : ''} ${tags}
@@ -279,7 +279,7 @@ const AgentsUI = { selectEl.innerHTML = '' + allAgents .filter((a) => a.status === 'active') - .map((a) => ``) + .map((a) => ``) .join(''); selectEl.value = agentId; @@ -311,7 +311,7 @@ const AgentsUI = { savedTaskSelect.innerHTML = '' + tasks.map((t) => { const label = t.category ? `[${t.category.toUpperCase()}] ${t.name}` : t.name; - return ``; + return ``; }).join(''); AgentsUI._savedTasksCache = tasks; } catch { diff --git a/public/js/components/dashboard.js b/public/js/components/dashboard.js index 2260f10..572afab 100644 --- a/public/js/components/dashboard.js +++ b/public/js/components/dashboard.js @@ -78,8 +78,8 @@ const DashboardUI = { list.innerHTML = executions.map((exec) => { const statusClass = DashboardUI._statusBadgeClass(exec.status); const statusLabel = DashboardUI._statusLabel(exec.status); - const name = exec.agentName || exec.pipelineName || exec.agentId || 'Execução'; - const taskText = exec.task || exec.input || ''; + const name = Utils.escapeHtml(exec.agentName || exec.pipelineName || exec.agentId || 'Execução'); + const taskText = Utils.escapeHtml(exec.task || exec.input || ''); const typeBadge = exec.type === 'pipeline' ? 'Pipeline ' : ''; diff --git a/public/js/components/history.js b/public/js/components/history.js index 56391bd..feb8799 100644 --- a/public/js/components/history.js +++ b/public/js/components/history.js @@ -70,22 +70,21 @@ const HistoryUI = {
${typeBadge} - ${HistoryUI._escapeHtml(name)} -
-
+ ${Utils.escapeHtml(name)} ${statusBadge} - ${date}
-
- ${HistoryUI._escapeHtml(task)} - - - - ${duration} - - ${costHtml} +
${Utils.escapeHtml(task)}
+
+ + + ${date} + + + ${duration} + + ${costHtml}
` : ''} ${step.result ? `
Resultado -
${HistoryUI._escapeHtml(step.result)}
+
${Utils.escapeHtml(step.result)}
` : ''} ${step.status === 'error' ? `
Passo falhou.
` : ''} @@ -316,7 +315,7 @@ const HistoryUI = {
Pipeline - ${HistoryUI._escapeHtml(exec.pipelineName || exec.pipelineId || '—')} + ${Utils.escapeHtml(exec.pipelineName || exec.pipelineId || '—')}
Status @@ -343,7 +342,7 @@ const HistoryUI = { ${exec.input ? `

Input Inicial

-

${HistoryUI._escapeHtml(exec.input)}

+

${Utils.escapeHtml(exec.input)}

` : ''} ${steps.length > 0 ? `
@@ -355,7 +354,7 @@ const HistoryUI = { ${exec.error ? `

Erro

-
${HistoryUI._escapeHtml(exec.error)}
+
${Utils.escapeHtml(exec.error)}
` : ''} `; }, @@ -435,15 +434,6 @@ const HistoryUI = { }); }, - _escapeHtml(str) { - if (!str) return ''; - return String(str) - .replace(/&/g, '&') - .replace(//g, '>') - .replace(/"/g, '"') - .replace(/'/g, '''); - }, }; window.HistoryUI = HistoryUI; diff --git a/public/js/components/pipelines.js b/public/js/components/pipelines.js index 91ab139..a1b6674 100644 --- a/public/js/components/pipelines.js +++ b/public/js/components/pipelines.js @@ -83,7 +83,7 @@ const PipelinesUI = { const stepCount = steps.length; const flowHtml = steps.map((step, index) => { - const agentName = step.agentName || step.agentId || 'Agente'; + const agentName = Utils.escapeHtml(step.agentName || step.agentId || 'Agente'); const isLast = index === steps.length - 1; const approvalIcon = step.requiresApproval && index > 0 ? ' ' @@ -102,12 +102,12 @@ const PipelinesUI = {
-

${pipeline.name || 'Sem nome'}

+

${Utils.escapeHtml(pipeline.name || 'Sem nome')}

${stepCount} ${stepCount === 1 ? 'passo' : 'passos'}
- ${pipeline.description ? `

${pipeline.description}

` : ''} + ${pipeline.description ? `

${Utils.escapeHtml(pipeline.description)}

` : ''}
${flowHtml || 'Nenhum passo configurado'} @@ -192,7 +192,7 @@ const PipelinesUI = { } const agentOptions = PipelinesUI.agents - .map((a) => ``) + .map((a) => ``) .join(''); container.innerHTML = PipelinesUI._steps.map((step, index) => { @@ -225,7 +225,7 @@ const PipelinesUI = { placeholder="{{input}} será substituído pelo output anterior" data-step-field="inputTemplate" data-step-index="${index}" - >${step.inputTemplate || ''} + >${Utils.escapeHtml(step.inputTemplate || '')} ${approvalHtml}
diff --git a/public/js/components/schedules.js b/public/js/components/schedules.js index 7c8a835..a0d6d4b 100644 --- a/public/js/components/schedules.js +++ b/public/js/components/schedules.js @@ -44,8 +44,8 @@ const SchedulesUI = { return ` - ${schedule.agentName || '—'} - ${schedule.taskDescription || '—'} + ${Utils.escapeHtml(schedule.agentName || '—')} + ${Utils.escapeHtml(schedule.taskDescription || '—')} ${cronExpr} @@ -106,7 +106,7 @@ const SchedulesUI = { select.innerHTML = '' + agents .filter((a) => a.status === 'active') - .map((a) => ``) + .map((a) => ``) .join(''); } @@ -233,12 +233,12 @@ const SchedulesUI = { const duration = SchedulesUI._formatDuration(exec.startedAt, exec.endedAt); const cost = exec.costUsd || exec.totalCostUsd || 0; const costStr = cost > 0 ? `$${cost.toFixed(4)}` : '—'; - const taskStr = SchedulesUI._escapeHtml(SchedulesUI._truncate(exec.task || '', 60)); + const taskStr = Utils.escapeHtml(Utils.truncate(exec.task || '', 60)); return ` - ${SchedulesUI._escapeHtml(exec.agentName || '—')} - ${taskStr} + ${Utils.escapeHtml(exec.agentName || '—')} + ${taskStr} ${status} ${date} ${duration} @@ -283,16 +283,6 @@ const SchedulesUI = { return `${minutes}m ${seconds}s`; }, - _escapeHtml(str) { - if (!str) return ''; - return String(str).replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"'); - }, - - _truncate(str, max) { - if (!str || str.length <= max) return str; - return str.slice(0, max) + '…'; - }, - cronToHuman(expression) { if (!expression) return '—'; diff --git a/public/js/components/tasks.js b/public/js/components/tasks.js index 175e0b7..b0a2753 100644 --- a/public/js/components/tasks.js +++ b/public/js/components/tasks.js @@ -65,10 +65,10 @@ const TasksUI = { return `
-

${task.name}

- ${categoryLabel} +

${Utils.escapeHtml(task.name)}

+ ${Utils.escapeHtml(categoryLabel)}
- ${task.description ? `

${task.description}

` : ''} + ${task.description ? `

${Utils.escapeHtml(task.description)}

` : ''}
@@ -117,7 +117,7 @@ const TasksUI = {
- +
@@ -133,7 +133,7 @@ const TasksUI = {
- +
@@ -228,7 +228,7 @@ const TasksUI = { const selectEl = document.getElementById('execute-agent-select'); if (selectEl) { selectEl.innerHTML = '' + - activeAgents.map((a) => ``).join(''); + activeAgents.map((a) => ``).join(''); selectEl.value = ''; } diff --git a/public/js/components/terminal.js b/public/js/components/terminal.js index bc848dd..3901e8a 100644 --- a/public/js/components/terminal.js +++ b/public/js/components/terminal.js @@ -102,7 +102,7 @@ const Terminal = { const html = lines.map((line) => { const typeClass = line.type && line.type !== 'default' ? ' ' + line.type : ''; - const escaped = Terminal._escapeHtml(line.content); + const escaped = Utils.escapeHtml(line.content); const formatted = escaped.replace(/\n/g, '
'); return `
@@ -120,14 +120,6 @@ const Terminal = { if (Terminal.autoScroll) Terminal.scrollToBottom(); }, - _escapeHtml(text) { - return String(text) - .replace(/&/g, '&') - .replace(//g, '>') - .replace(/"/g, '"') - .replace(/'/g, '''); - }, }; window.Terminal = Terminal; diff --git a/public/js/components/webhooks.js b/public/js/components/webhooks.js index 773e6ab..d92235c 100644 --- a/public/js/components/webhooks.js +++ b/public/js/components/webhooks.js @@ -71,7 +71,7 @@ const WebhooksUI = {
- ${WebhooksUI._escapeHtml(webhook.name)} + ${Utils.escapeHtml(webhook.name)} ${typeBadge} ${statusBadge}
@@ -87,7 +87,7 @@ const WebhooksUI = {
Destino - ${WebhooksUI._escapeHtml(targetName)} + ${Utils.escapeHtml(targetName)}
URL @@ -150,10 +150,10 @@ const WebhooksUI = { if (targetType === 'agent') { selectEl.innerHTML = '' + - WebhooksUI.agents.map((a) => ``).join(''); + WebhooksUI.agents.map((a) => ``).join(''); } else { selectEl.innerHTML = '' + - WebhooksUI.pipelines.map((p) => ``).join(''); + WebhooksUI.pipelines.map((p) => ``).join(''); } }, @@ -243,15 +243,6 @@ const WebhooksUI = { } }, - _escapeHtml(str) { - if (!str) return ''; - return String(str) - .replace(/&/g, '&') - .replace(//g, '>') - .replace(/"/g, '"') - .replace(/'/g, '''); - }, }; window.WebhooksUI = WebhooksUI; diff --git a/public/js/utils.js b/public/js/utils.js new file mode 100644 index 0000000..6abd7d0 --- /dev/null +++ b/public/js/utils.js @@ -0,0 +1,32 @@ +const Utils = { + escapeHtml(str) { + if (str === null || str === undefined) return ''; + return String(str) + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, '''); + }, + + formatDuration(ms) { + if (!ms || ms < 0) return '—'; + if (ms < 1000) return `${ms}ms`; + if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`; + const m = Math.floor(ms / 60000); + const s = Math.floor((ms % 60000) / 1000); + return `${m}m ${s}s`; + }, + + formatCost(usd) { + if (!usd || usd === 0) return '$0.0000'; + return `$${Number(usd).toFixed(4)}`; + }, + + truncate(str, max = 80) { + if (!str) return ''; + return str.length > max ? str.slice(0, max) + '…' : str; + }, +}; + +window.Utils = Utils; diff --git a/server.js b/server.js index 531efe1..bb7be4a 100644 --- a/server.js +++ b/server.js @@ -4,6 +4,7 @@ import { WebSocketServer } from 'ws'; import { fileURLToPath } from 'url'; import { dirname, join } from 'path'; import { v4 as uuidv4 } from 'uuid'; +import crypto from 'crypto'; import apiRouter, { setWsBroadcast, setWsBroadcastTo, hookRouter } from './src/routes/api.js'; import * as manager from './src/agents/manager.js'; import { setGlobalBroadcast } from './src/agents/manager.js'; @@ -14,6 +15,24 @@ const __dirname = dirname(fileURLToPath(import.meta.url)); const PORT = process.env.PORT || 3000; const AUTH_TOKEN = process.env.AUTH_TOKEN || ''; const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN || ''; +const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET || ''; + +function verifyWebhookSignature(req, res, next) { + if (!WEBHOOK_SECRET) return next(); + const sig = req.headers['x-hub-signature-256']; + if (!sig) return res.status(401).json({ error: 'Assinatura ausente' }); + const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET); + hmac.update(req.rawBody || ''); + const expected = 'sha256=' + hmac.digest('hex'); + try { + if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) { + return res.status(401).json({ error: 'Assinatura inválida' }); + } + } catch { + return res.status(401).json({ error: 'Assinatura inválida' }); + } + next(); +} const app = express(); const httpServer = createServer(app); @@ -39,8 +58,10 @@ if (AUTH_TOKEN) { }); } -app.use(express.json()); -app.use('/hook', hookRouter); +app.use(express.json({ + verify: (req, res, buf) => { req.rawBody = buf; }, +})); +app.use('/hook', verifyWebhookSignature, hookRouter); app.use(express.static(join(__dirname, 'public'))); app.use('/api', apiRouter); diff --git a/src/store/db.js b/src/store/db.js index 1bc29d5..bb5e081 100644 --- a/src/store/db.js +++ b/src/store/db.js @@ -41,6 +41,7 @@ function createStore(filePath) { let mem = null; let dirty = false; let timer = null; + let maxSize = Infinity; function boot() { if (mem !== null) return; @@ -81,6 +82,9 @@ function createStore(filePath) { updated_at: new Date().toISOString(), }; mem.push(item); + if (maxSize !== Infinity && mem.length > maxSize) { + mem.splice(0, mem.length - maxSize); + } touch(); return clone(item); }, @@ -118,6 +122,10 @@ function createStore(filePath) { dirty = false; } }, + + setMaxSize(n) { + maxSize = n; + }, }; allStores.push(store); @@ -185,5 +193,9 @@ export const tasksStore = createStore(`${DATA_DIR}/tasks.json`); export const pipelinesStore = createStore(`${DATA_DIR}/pipelines.json`); export const schedulesStore = createStore(`${DATA_DIR}/schedules.json`); export const executionsStore = createStore(`${DATA_DIR}/executions.json`); +executionsStore.setMaxSize(5000); export const webhooksStore = createStore(`${DATA_DIR}/webhooks.json`); export const settingsStore = createSettingsStore(`${DATA_DIR}/settings.json`); +export const secretsStore = createStore(`${DATA_DIR}/secrets.json`); +export const notificationsStore = createStore(`${DATA_DIR}/notifications.json`); +export const agentVersionsStore = createStore(`${DATA_DIR}/agent_versions.json`);