-
- TORCH Logo -

- TORCH Agent Dashboard -

- +
+ TORCH Logo +

+ TORCH Agent Dashboard +

+ + + Connecting… + +
+ - - Connecting… -
+ Home +

Live view of diff --git a/src/dashboard.mjs b/src/dashboard.mjs index f30fa24..94ad80f 100644 --- a/src/dashboard.mjs +++ b/src/dashboard.mjs @@ -160,8 +160,10 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT, host = '127.0. // Security check: restrict access to allowed paths const allowedPaths = [ path.join(packageRoot, 'dashboard'), + path.join(packageRoot, 'landing'), path.join(packageRoot, 'assets'), path.join(packageRoot, 'src', 'docs'), + path.join(packageRoot, 'src', 'prompts'), path.join(packageRoot, 'src', 'constants.mjs'), path.join(packageRoot, 'torch-config.json') ]; diff --git a/test/dashboard-security.test.mjs b/test/dashboard-security.test.mjs index 7c95ef8..1d29044 100644 --- a/test/dashboard-security.test.mjs +++ b/test/dashboard-security.test.mjs @@ -43,6 +43,11 @@ test('Dashboard File Access Security', async (t) => { assert.strictEqual(res.statusCode, 200); }); + await t.test('allows access to landing page', async () => { + const res = await get('/landing/index.html'); + assert.strictEqual(res.statusCode, 200); + }); + await t.test('blocks access to package.json', async () => { const res = await get('/package.json'); assert.strictEqual(res.statusCode, 403);