Repository navigation
Conversation
…dable auth home - Reinstall node_modules lost from the project dir; npm audit fix + qs override -> 0 vulnerabilities (was 1 critical / 9 high / 2 moderate) - npm test now runs node --test test/*.test.js only; Playwright e2e gets test:e2e (test/office suite) and test:qa (qa/ routes) entry points - auth.js honors HERMES_HOME env so e2e can run against an isolated home Verified: unit 11/11 pass; e2e 33 passed / 3 conditional skips / 0 fail against isolated server on :8790; prod instance on :10272 healthy (200).
- README rewrite (June draft): fix fact drift against code — RBAC is 28 permissions (not 20), version 3.5.1, Node >=20, list all 10 pages incl. Monitor/Office; add Testing section (npm test / test:e2e / test:qa) - AGENTS.md agent onboarding doc (CLAUDE.md is a symlink to it); correct page count to 10 - playwright.config.mts + qa/qa-routes.spec.mts: GSD route QA suite (test:qa entry), screenshots/qa-report.json are run artifacts -> ignored - Verified against code: rate limits (5/15min, 30/min), bcrypt cost 10, CSRF on 45 mutating endpoints, dist asset names
…form Hashed asset names drift on every build (index-DXC1lv8V.js -> index-DZsU5115.js after vite build); commit the rebuilt index.html and describe dist/assets generically.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ee0f580). SemVer-safe updates for ws, vite, multer, js-yaml, body-parser, express-rate-limit/ip-address, nanoid, postcss, source-map-js, proxy-addr. The remaining transitiveqs(via express 4.x) is pinned to^6.16.2throughoverridesinstead of forcing an express 5 major bump.npm testwas barenode --test, which also collected the Playwright e2e spec intest/and failed ontest.describe(). Now:test→node --test test/*.test.js(unit only), plustest:qafor the GSD route QA suite (playwright.config.mts,qa/).test:e2efollows the suite added in 00cf2db.auth.jshonorsHERMES_HOMEenv — the users store was hardcoded to~/.hermes, so e2e runs mixed with the productionhci-users.json. With the override unset the default path is unchanged.AGENTS.md,CLAUDE.mdsymlink), Testing section in README, genericdist/assetsdescription (hashed filenames drift on every build).Verification
npm audit→found 0 vulnerabilitiesnpm test→ 13/13 pass (unit)test/office-visualization.spec.js) against an isolated server on:8790(tempHERMES_HOME, runtime-generated credentials): 33 passed / 3 conditional skips / 0 failed — the 3 skips are by-designtest.skip()when no running agents existvite build→ success;dist/index.htmlcommitted from that buildNotes for reviewer
main@ee0f580(v3.6.2); conflicts resolved by keeping upstream's newer README/package.json as the base and layering only the additions above.qsoverride can be dropped once express 4.x ships a patchedqsrange (or on an express 5 migration).— generated by Grok (claude-workspace session, 2026-11-03)