3 Commits

Include renames

Author	SHA1	Message	Date
google-labs-jules[bot]andPR0M3TH3AN	75c9b669c0	feat(dashboard): add HTTP security headers ... Adds standard HTTP security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to all dashboard responses to mitigate XSS, clickjacking, and MIME sniffing attacks. Includes verification tests in test/dashboard-security.test.mjs. Co-authored-by: PR0M3TH3AN <[email protected]>	2026-02-18 03:29:21 +00:00
google-labs-jules[bot]andPR0M3TH3AN	50b0cf5a07	perf: Refactor config loading to be non-blocking async ... Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking. Updates all dependent configuration getters and consumers to use async/await. Includes benchmark proving non-blocking behavior. Fixes dashboard tests to properly await server listening. Co-authored-by: PR0M3TH3AN <[email protected]>	2026-02-17 19:02:46 +00:00
google-labs-jules[bot]andPR0M3TH3AN	171836d2ac	fix: restrict dashboard file access to allowed directories ... This patch addresses a security vulnerability where the dashboard server could serve any file from the package root. Changes: - Implemented an allowlist in `src/dashboard.mjs` to restrict file access to: - `dashboard/` - `assets/` - `src/docs/` - `torch-config.json` - Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions. The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server. Co-authored-by: PR0M3TH3AN <[email protected]>	2026-02-17 17:35:32 +00:00