97 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Opus 4.8	aab22d6492	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML ... CODESYS control logic is frequently written in graphical languages, but the scanner only understood Structured-Text bodies — FBD/LD/SFC were skipped, so their comm calls, hardcoded arguments and safety writes went unseen. Translate FBD/LD networks to synthetic ST and run them through the existing ST parser + rules: blocks become calls (`TypeName(pin := arg, …)`), out-variables and coils become assignments, and input pins are resolved by tracing `connectionPointIn`/`refLocalId` back through the network (contacts AND-chain to the power rail; nested blocks are referenced by a synthetic result so calls are emitted exactly once). SFC step/transition graphs are skipped, but the ST/FBD/LD bodies embedded in their actions/transitions are still translated. Also fixes a latent doubling bug in `collect_text`: `descendants()` yields both an element and its child text node, so every value was collected twice. Harmless for ST (duplicate statements landed on one synthetic line and deduped) but it corrupted graphical single-token expressions (`502` -> `502502`, `FALSE` -> `FALSEFALSE`). Now only text nodes are gathered. Adds an FBD demo fixture (pump_fbd.xml) + FBD/LD/regression tests. Part of #165 (graphical languages). Native `.project`/`.projectarchive` parsing and SFC graph semantics remain follow-ons. Tracker #167. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-16 13:36:34 +02:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	613847d4d3	feat(agent): real nix (sandbox=false) for firmware SBOM, replacing nix-portable (#159)	2026-07-13 16:01:09 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	9e70bd1c8e	ci: don't cancel-in-progress for main-branch runs (only pull_request) (#152)	2026-07-12 22:08:58 +00:00
sharang	9ec07ff7a1	fix(ci): authenticate tramiton fetch in dashboard + mcp image builds (#147)	2026-07-12 21:52:38 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	17f788858d	feat(dashboard): onboarding wizard UI (#144)	2026-07-12 21:28:52 +00:00
sharangandSharang Parnerkar	c6b5622113	fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys) (#143) ... The PR `check` job authenticates the private tramiton-core git fetch, but the main-branch **`deploy-agent`** job builds `Dockerfile.agent` where cargo also fetches tramiton-core — inside the image build, with no credentials — so **agent image builds on main fail**. Fix: inject the PAT as a **BuildKit secret** (never baked into an image layer). - `Dockerfile.agent`: `RUN --mount=type=secret,id=tramiton_token …` applies the same `https`-insteadOf rewrite + `CARGO_NET_GIT_FETCH_WITH_CLI=true` before `cargo build`. - `deploy-agent`: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …`, reusing the existing `TRAMITON_FETCH_TOKEN` secret. Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). **Self-tests on merge** — changing `Dockerfile.agent` makes `detect-changes` run `deploy-agent`. Note: couldn't fully run the image build locally (no PAT value on hand + no `.dockerignore` so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes). --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #143	2026-07-12 20:25:39 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	a074efd0b4	ci: Kellnr crates.io mirror + persistent S3-backed sccache (#140)	2026-07-10 16:30:51 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	aed551231c	feat(dashboard): UI for managing MCP tokens (#94) ... Adds /mcp-tokens page so a logged-in user can mint, list, and revoke bearer tokens for the MCP server without curl. Pairs with #92's tenant-scoped MCP middleware — copy a token from the dashboard straight into an LLM client config.	2026-06-30 16:32:54 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	e9536b6d98	fix(audit): bump quinn-proto + ignore rmcp DNS-rebinding advisory (#97) ... RUSTSEC-2026-0185 (quinn-proto 0.11.14): patch-bump to 0.11.15. RUSTSEC-2026-0189 (rmcp 0.16 DNS rebinding): added to ignore with public-hostname + bearer-auth threat-model justification; rmcp 0.16->2.x migration tracked as a separate multi-hour PR.	2026-06-30 16:07:01 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	69c4f7bb78	feat(dashboard): proactively refresh expired Keycloak tokens (#91)	2026-06-17 20:01:37 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	dbadff0aac	fix(m7.1): JWKS refresh-on-failure in auth middleware (#84)	2026-06-04 14:46:14 +00:00
sharang	116293519d	M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service (#83)	2026-06-04 14:38:35 +00:00
sharang	a8cef58e02	feat(dashboard): add light/dark theme with sidebar toggle (#81)	2026-05-13 11:44:22 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang Parnerkar	5cafd13f44	ci: log orca webhook response so deploy steps arent silent	2026-04-08 15:09:27 +02:00
Sharang ParnerkarandClaude Opus 4.6	69209649a5	ci: trigger first orca build for all services ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:10:07 +02:00
Sharang ParnerkarandClaude Opus 4.6	d5439adc0d	ci: trigger build of dashboard, docs, mcp images for orca ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:09:49 +02:00
Sharang ParnerkarandClaude Opus 4.6	bc7cdd35e4	ci: replace coolify webhook with orca deploy ... Each deploy job now builds the per-service image, pushes to the private registry as :latest and :sha, then triggers an HMAC-signed orca redeploy webhook. Coolify webhooks are no longer used. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:06:11 +02:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00
sharang	23cf37b6c3	fix: CVE notifications during scan + help chat doc loading + Dockerfile (#55) v0.2.0	2026-03-30 13:10:56 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
sharang	4388e98b5b	feat: add E2E test suite with nightly CI, fix dashboard Dockerfile (#52)	2026-03-30 10:04:07 +00:00
sharang	a8bb05d7b1	feat: add floating help chat widget, remove settings page (#51)	2026-03-30 08:05:29 +00:00
sharang	bae24f9cf8	fix: cascade-delete DAST targets, pentests, and downstream data on repo delete (#50)	2026-03-30 07:11:23 +00:00
sharang	dd53132746	feat: refine all LLM system prompts for precision and reduced false positives (#49)	2026-03-30 07:11:17 +00:00