`consensus/yolo-agent.md`

51 lines
# Consensus — yolo-agent
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `server.js:17-18`, `ledger-app/src/lib/xfetch.ts:18`, `dashboard/task-ledger.html:279`: hardcoded `admin:DWSecure2024!` shipped in server and browser code. Anyone who sees the UI/source can control the agent. Fix: env-only secret, rotate password, remove client-side auth embedding.
- `server.js:614-625` + `server.js:226-239`: `/api/run` accepts arbitrary prompt, auto-starts, and launches Claude with `Bash/Write/Edit` in `/Users/stevestudio2/Projects`. With leaked auth this is remote code execution over the whole projects tree. Fix: bind to VPN/localhost, remove dangerous tools by default, require manual approval for write/bash tasks.
- `create-missing-collections.js:15`, `scripts/collection-descriptions.js:16`, `tasks/done/AG_dw-exclusive-page-update.md:9`, `tasks/done/14_shopify-image-audit.md:5`: live-looking Slack webhook, Gemini key, Shopify tokens, and Postgres credentials are committed in code/task artifacts. Fix: revoke/rotate all exposed secrets and purge/redact task archive.
- `server.js:1038-1043`: service binds `0.0.0.0` and prints public IP dashboard URL while auth is static/basic. Failure mode is internet-exposed agent control. Fix: bind `127.0.0.1` behind SSH/VPN or enforce firewall plus fresh credentials.


## Round-1 applied
## Applied
- server.js:18 — removed hardcoded Basic Auth defaults and fail fast unless `YOLO_AUTH_USER`/`YOLO_AUTH_PASS` are set — prevents fallback to shipped credentials.
- server.js:605 — added JSON body guards on task/mode/cooldown POST routes — malformed requests now return 400 instead of destructuring failures.
- server.js:1051 — changed listener from public bind to `127.0.0.1` and removed the public dashboard URL — local-only tool should not expose the agent port.
- ledger-app/src/lib/xfetch.ts:18, dashboard/task-ledger.html:584, ledger-dist/assets/index-BwgB1DeC.js:149 — removed embedded `admin` password headers and use same-origin credentials — avoids shipping agent credentials in browser code.
- create-missing-collections.js:15, scripts/collection-descriptions.js:17 — moved Slack/Gemini/local dashboard auth to env vars with fail-fast checks — removes live-looking secrets from source.
- scripts/body-html-cleanup.js:72 — escaped generated product title/vendor HTML and changed logs/env loading to project-relative paths — prevents stored HTML injection and nonportable `/root` paths.
- scripts/collection-image-refresh.js:91, orphan-audit.js:188 — replaced `/root` log/report paths with paths derived from `__dirname` — keeps generated files inside this project.
- .env.example:1 — added placeholder env keys only — documents required config without adding real secrets.


## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
create-missing-collections.js:3 — new `.env` loading depends on `dotenv`, but `package.json:9` dependencies do not include `dotenv`; the catch hides the import failure, so copying `.env.example` will not satisfy the new fail-fast env checks — severity P1  
scripts/collection-descriptions.js:3 — same missing `dotenv` dependency makes documented `.env` config ineffective for this script’s new required env vars — severity P1  
server.js:1051 — bind changed to loopback, but remote setup still advertises host-IP access at `setup-yolo-remote.sh:196`; a normal remote install will appear live but be unreachable except locally/through a tunnel — severity P2


## Round-2 applied
## Round 2 Applied
- server.js:15 — added a dependency-free `.env` loader before auth env vars are read — fixes the `server.js`/`.env.example` concern that documented credentials must actually satisfy fail-fast startup without adding `dotenv`.
- create-missing-collections.js:5 — replaced the hidden `require('dotenv')` dependency with a local `.env` parser — fixes the P1 rereview finding that missing `dotenv` made `.env.example` ineffective.
- scripts/collection-descriptions.js:5 — replaced the hidden `require('dotenv')` dependency with a local `.env` parser — fixes the same P1 rereview finding for this script's required env vars.
- setup-yolo-remote.sh:196 — changed the setup output from a host-IP dashboard URL to `localhost` plus an SSH tunnel command — fixes the missed call-site where remote setup still assumed public dashboard access after loopback binding.


## Still deferred for Steve
- P0 — server.js:226 — Claude still runs with Bash/Write/Edit over `/Users/stevestudio2/Projects` — permission/workflow redesign is not a safe surgical fix.
- P0 — server.js:614 — `/api/run` still queues arbitrary prompts and auto-starts — changing approval semantics needs owner decision.
- P0 — tasks/done/* — committed task artifacts still contain exposed Slack/Gemini/DB/auth values — requires credential rotation and archive purge/redaction by Steve.
- P0 — promote-and-parallel.sh:7, setup-yolo-remote.sh:101 — old auth remains in operational scripts — changing deployment/CLI auth patterns was outside the cited safe source/browser fix.
- P1 — server.js:441 — Basic Auth parser/timing-safe compare unchanged — not in the safe fix list.
- P1 — server.js:486 — `/api/live-log` can read recent `/tmp/*.log` tails — behavior change needs log ownership design.
- P1 — server.js:1058 — auto-retry metadata remains in-memory — persistence changes are not safe without testing.
- P1 — promote-and-parallel.sh:45 — parallel workers still bypass scheduler guardrails — scheduler redesign deferred.
- P1 — server.js:491 — synchronous dashboard API work remains — async/cache refactor deferred.