`yolo-agent/review.md`

34 lines

## Snapshot
- Autonomous Claude Code task runner/dashboard for Steve’s wallcoverings ops queue.
- Stack: Node.js/Express, React/Vite/TypeScript ledger UI, filesystem queues/logs; no datastore in app.
- How it's run: PM2 intended; `npm start` manual also works.
- Status: stale-ish/live artifact; logs show April PM2 start, no active history.

## Top Risks (P0 — fix this week)
- `server.js:17-18`, `ledger-app/src/lib/xfetch.ts:18`, `dashboard/task-ledger.html:279`: hardcoded `admin:DWSecure2024!` shipped in server and browser code. Anyone who sees the UI/source can control the agent. Fix: env-only secret, rotate password, remove client-side auth embedding.
- `server.js:614-625` + `server.js:226-239`: `/api/run` accepts arbitrary prompt, auto-starts, and launches Claude with `Bash/Write/Edit` in `/Users/stevestudio2/Projects`. With leaked auth this is remote code execution over the whole projects tree. Fix: bind to VPN/localhost, remove dangerous tools by default, require manual approval for write/bash tasks.
- `create-missing-collections.js:15`, `scripts/collection-descriptions.js:16`, `tasks/done/AG_dw-exclusive-page-update.md:9`, `tasks/done/14_shopify-image-audit.md:5`: live-looking Slack webhook, Gemini key, Shopify tokens, and Postgres credentials are committed in code/task artifacts. Fix: revoke/rotate all exposed secrets and purge/redact task archive.
- `server.js:1038-1043`: service binds `0.0.0.0` and prints public IP dashboard URL while auth is static/basic. Failure mode is internet-exposed agent control. Fix: bind `127.0.0.1` behind SSH/VPN or enforce firewall plus fresh credentials.

## Notable Issues (P1 — fix this month)
- `server.js:441-443`: Basic auth parsing uses `decoded.split(':')`; passwords containing `:` break, and comparison is not constant-time. Fix: robust parser plus timing-safe compare.
- `server.js:486-514`: `/api/live-log` reads current log and arbitrary recent `/tmp/*.log` tails; authenticated users can see unrelated process output/secrets. Fix: only read agent-owned log path under `LOGS_DIR`.
- `server.js:1058-1072`: auto-retry requeues every failed task every 2 hours, while lifetime retry counts are in-memory only (`server.js:35-39`). Restart resets protection and can loop destructive tasks. Fix: persist retry metadata beside task/history.
- `promote-and-parallel.sh:45-92`: launches parallel Claude workers outside the server’s concurrency breaker/rate-limit model. Failure: simultaneous Shopify/DB mutations despite server guardrails. Fix: route all worker starts through one scheduler.
- `server.js:491`, `server.js:523`, `server.js:552`: sync file/process calls in hot dashboard APIs can block the event loop. Fix: cache/poll process state asynchronously.
- `scripts/body-html-cleanup.js:67-75`: generated Shopify HTML interpolates product title/vendor without escaping. Failure: stored HTML/script injection if catalog data contains markup. Fix: escape text before wrapping in HTML.

## Polish (P2 — when convenient)
- `setup-yolo-remote.sh:137-146` sets env vars (`YOLO_PORT`, timeouts, cwd) that `server.js:15-27` mostly ignores. Align config or delete wrapper claims.
- `package.json:10-11`: dependencies are loose ranges; pin and run audit in CI.
- No README/runbook observed; operational behavior is scattered across shell scripts and task files.

## Strengths
- `server.js:682-688` validates staged filenames against traversal before promote/reject.
- `server.js:243-251` adds task timeout/SIGKILL fallback, preventing indefinite stuck runs.
- Task history/logging structure is simple and inspectable.

## Open questions for the owner
- Is port `9670` currently reachable from the public internet?
- Are the leaked Shopify/Gemini/Slack/Postgres credentials still active?
- Should this agent be allowed to mutate all projects, or only `DW-Agents/yolo-agent`?