69 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	e5f4b562c3	refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a) ... Prep for the Werkbank Docker executor (sharang/werkbank#5): the dynamic-execution logic has to be usable by the runner (a separate repo), so lift it out of the agent into a shared crate. New crate `werkbank-exec` (git-mv preserves history): - src/ics/* — the read-only industrial-protocol probe (Modbus/OPC-UA/ EtherNet-IP/portscan), moved verbatim. - src/plc/* — ephemeral soft-PLC provisioning (DockerSoftPlc), the OpenPLC program-load client, and provision_and_test/extract_program. - src/error.rs — a crate-local ExecError, replacing the agent's AgentError. - src/fingerprint.rs — compute_fingerprint (copied from the agent's dedup). Depends only on compliance-core + compliance-dast, so the runner can pull it without the agent's server stack. compliance-agent consumes it: - AgentError gains `Exec(#[from] werkbank_exec::ExecError)`. - The orchestrator's ICS-probe + provision-and-test call sites point at werkbank_exec::{ics,plc}; the old pipeline::ics and plc::runtime modules are removed (the static PLC scanner stays). - CI clippy-checks + tests the new crate. Pure move + rename — no behaviour change. 27 moved tests pass in the new crate; 283 agent lib tests pass; clippy + fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 14:25:22 +02:00
sharang	633f945a1e	feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02) (#206)	2026-07-17 09:15:23 +00:00
sharang	7ad7bce9db	feat(plc): dynamic PLC testing via ephemeral soft-PLC (#193)	2026-07-17 07:47:43 +00:00
sharang	0f4c75b6b3	fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// (#182)	2026-07-16 21:28:47 +00:00
sharang	097f86243e	feat(cve): match the CODESYS runtime against NVD by CPE (#180)	2026-07-16 20:10:18 +00:00
sharang	4f9e2c2828	fix(plc): scan every PLC-source artifact, not just the first (#178)	2026-07-16 19:59:58 +00:00
sharang	98357cae10	fix(upload): raise body-size limit to 512 MiB + surface upload errors (#177)	2026-07-16 18:03:40 +00:00
sharang	7932f60ab9	feat(ics): EtherNet/IP probe + OT service-discovery port scan (#175)	2026-07-16 16:48:22 +00:00
sharang	b96c4d594c	feat(ics): OPC UA reachability probe (#174)	2026-07-16 16:35:54 +00:00
sharang	d2003eb3c0	feat(cve): notifications for the PLC control-app SBOM (#173)	2026-07-16 16:30:19 +00:00
sharang	77eced8314	feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices (#172)	2026-07-16 16:25:04 +00:00
sharang	a3f3f1d4f5	feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)	2026-07-16 15:47:04 +00:00
sharang	7369e031c4	feat(plc): control-application SBOM from CODESYS .projectarchive (#170)	2026-07-16 15:28:42 +00:00
sharang	386d8457d6	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML (#169)	2026-07-16 11:43:49 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00
sharang	23cf37b6c3	fix: CVE notifications during scan + help chat doc loading + Dockerfile (#55)	2026-03-30 13:10:56 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
sharang	4388e98b5b	feat: add E2E test suite with nightly CI, fix dashboard Dockerfile (#52)	2026-03-30 10:04:07 +00:00
sharang	a8bb05d7b1	feat: add floating help chat widget, remove settings page (#51)	2026-03-30 08:05:29 +00:00
sharang	bae24f9cf8	fix: cascade-delete DAST targets, pentests, and downstream data on repo delete (#50)	2026-03-30 07:11:23 +00:00
sharang	dd53132746	feat: refine all LLM system prompts for precision and reduced false positives (#49)	2026-03-30 07:11:17 +00:00
sharang	ff088f9eb4	feat: deduplicate code review findings across LLM passes (#48)	2026-03-29 20:38:52 +00:00
3 people	745ad8a441	fix: check Gitea API response status and fallback for PR reviews (#47) ... ## Summary - Add HTTP response status checking to all Gitea tracker methods that were silently swallowing errors - Add fallback in create_pr_review: if inline comments fail, retry as plain PR comment ## Test plan - [ ] Deploy and trigger a PR review, check logs for actual error details - [ ] Verify fallback posts summary comment when inline comments fail Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #47	2026-03-25 16:26:09 +00:00
sharang	a9d039dad3	fix: stop storing code review findings in dashboard (#22)	2026-03-18 15:18:07 +00:00