3 commits

Author	SHA1	Message	Date
Scrum4Me Agent	aa1fd41bec	feat(security): rate-limit /api/flows/start, CSRF double-submit cookie, CSP headers ... - Rate-limit /api/flows/start to 10 req/min per user (in-memory, matches login pattern) - Add middleware.ts: validates x-csrf-token header against csrf_token cookie on all API POST requests; issues the cookie on GET if missing; sets CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on all responses - Add lib/csrf.ts: client-side apiFetch() wrapper that injects the CSRF header - Update all client components (login, useFlowRun, docker, caddy, git, systemd) to use apiFetch() for POST requests - Cookie config in login route already correct (NODE_ENV check, httpOnly, sameSite=strict) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 20:01:43 +02:00
Scrum4Me Agent	3781fce1e2	feat(ui): add action buttons to Docker, Git, systemd, and Caddy modules ... - Docker table: Restart and Stop buttons per container row (docker_compose_restart / docker_compose_stop) - Git repos list: Fetch and Pull buttons per repo; Pull disabled when working tree is dirty - systemd units list: Restart button per unit (systemctl_restart) - Caddy: Edit link on /caddy page, new /caddy/edit page with textarea + 3-step Validate → Save+Reload flow - All buttons open ConfirmDialog with exact agent-call preview, then stream output via StreamingTerminal - Add docker_compose_stop to ops-agent/commands.yml.example Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 19:14:49 +02:00
Scrum4Me Agent	9e08a7c31f	feat(git): /git overview page and diff viewer ... Add git module with repo status overview (/git) and per-repo detail page (/git/[repo]) featuring a color-coded diff viewer (+ green, - red). Reads repo paths from REPO_PATHS env var, calls ops-agent git_status and git_diff commands. Status badges: clean (green), dirty (orange), behind-origin (blue). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 17:35:11 +02:00