⚡ Bolt: Optimize Goals List Performance

.jules/bolt.md

@@ -0,0 +1,7 @@
+## 2024-05-23 - Chat Latency Optimization
+**Learning:** Independent asynchronous operations (Embedding Generation + Vector Search vs User Context DB Queries) were being executed sequentially in the chat route and service, adding unnecessary latency.
+**Action:** Always check for opportunities to use `Promise.all` when fetching multiple independent data sources for a request context. Parallelizing external API calls (Embeddings) with local DB queries is a high-impact optimization.
+
+## 2026-01-18 - Dashboard Latency Optimization
+**Learning:** The dashboard endpoint was sequentially fetching user metrics *after* fetching global metrics, doubling the latency for logged-in users.
+**Action:** Group all independent `Promise` returning functions in a single `Promise.all` block, even if some depend on conditional logic (use ternary operators to pass `Promise.resolve(undefined)` or similar).

.jules/sentinel.md

@@ -0,0 +1,19 @@
+## 2026-01-03 - [SSRF Protection]
+**Vulnerability:** Found a potential Server-Side Request Forgery (SSRF) vulnerability in `backend/src/services/langchain/langgraph/step-nodes.ts` where user-provided URLs in `executeWebhookStep` were fetched without validation.
+**Learning:** `fetch` calls in automation or webhook steps are prime candidates for SSRF if they accept arbitrary URLs. Developers might assume that because it's a "webhook", the user *should* be able to call anything, but internal network access must be restricted.
+**Prevention:** Implemented a `validateWebUrl` utility that resolves DNS and checks against private IP ranges (IPv4 and IPv6). Applied this check before the `fetch` call. Also, using `dns.lookup` is necessary because simple string matching on hostname is insufficient due to DNS rebinding or different IP representations.
+
+## 2026-01-20 - [Auth Timing Attack Prevention]
+**Vulnerability:** The login endpoint (`/api/auth/login`) was vulnerable to **User Enumeration** via **Timing Attack**. The code returned immediately if the user was not found (`!user`), but performed an expensive `bcrypt.compare` operation if the user existed. This timing difference allowed attackers to verify valid email addresses.
+**Learning:** Authentication failures must take approximately the same amount of time regardless of whether the user exists or the password is incorrect. `bcrypt` is computationally expensive (by design), making the timing gap significant and easily measurable.
+**Prevention:** Implemented **Constant Time Comparison** (or rather, "Equalized Time"). If the user is not found, the system now compares the provided password against a pre-calculated "dummy" hash (with the same cost factor). This ensures that every login attempt performs exactly one `bcrypt.compare` operation, masking the existence of the user.
+
+## 2025-10-24 - [Password Complexity Enforcement]
+**Vulnerability:** The registration endpoint (`/api/auth/register`) allowed weak passwords (minimum 8 characters, but no complexity requirements). This increased susceptibility to brute-force and credential stuffing attacks.
+**Learning:** Relying solely on length is insufficient. Zod schemas in `auth-simple.ts` were only checking `.min(8)`.
+**Prevention:** Enhanced `registerSchema` in `backend/src/routes/auth-simple.ts` to enforce: 1 lowercase, 1 uppercase, 1 number, and max length of 100 characters (to prevent DoS).
+
+## 2026-02-23 - [XSS in Custom Markdown Parser]
+**Vulnerability:** A Stored XSS vulnerability was identified in `src/components/preview/viewers/MarkdownViewer.tsx`. The component used a custom regex-based Markdown parser that failed to validate URL protocols in links, allowing payloads like `[click](javascript:alert(1))` to execute arbitrary JavaScript.
+**Learning:** Custom regex parsers for complex formats like Markdown are notoriously prone to security bypasses. Validating input structure via regex is insufficient for preventing XSS in HTML output; context-aware sanitization is required.
+**Prevention:** Integrated `DOMPurify` to sanitize the HTML output of the custom parser. Configured it to allow necessary tags and attributes (like `class` for styling) while stripping dangerous content (like `javascript:` URIs).

backend/e2e-evidence/v4-2025-12-20/control-plane-stats.json

@@ -0,0 +1,32 @@
+{
+  "success": true,
+  "data": {
+    "v4Enabled": false,
+    "features": {
+      "agentFactory": true,
+      "tracing": true,
+      "memory": true,
+      "workflow": true,
+      "planning": true,
+      "reasoning": true,
+      "reflection": true,
+      "evaluation": true
+    },
+    "stats": {
+      "agents": {
+        "cached": 1,
+        "maxCache": 50,
+        "hitRate": 0
+      },
+      "memory": {
+        "total": 0
+      },
+      "workflows": {
+        "cached": 5
+      },
+      "tracing": {
+        "spansLast7Days": 18
+      }
+    }
+  }
+}

backend/e2e-evidence/v4-2025-12-20/memory-search-results.json

@@ -0,0 +1,133 @@
+{
+  "memories": [
+    {
+      "id": "a73c5de4-c66c-48e2-a476-462d98c44046",
+      "content": "Notei que usuários preferem respostas curtas",
+      "source_type": "conversation",
+      "metadata": {
+        "supermemory": {
+          "tags": [
+            "general"
+          ],
+          "type": "general",
+          "savedAt": "2025-12-20T19:37:04.816Z",
+          "duration": "medium_term"
+        }
+      },
+      "created_at": "2025-12-20T19:37:05.153Z"
+    },
+    {
+      "id": "ccfddf04-23d2-4b49-9075-2093b009f1a1",
+      "content": "Acredito que Python é uma excelente linguagem para IA",
+      "source_type": "conversation",
+      "metadata": {
+        "supermemory": {
+          "tags": [
+            "general"
+          ],
+          "type": "general",
+          "savedAt": "2025-12-20T19:37:03.161Z",
+          "duration": "medium_term"
+        }
+      },
+      "created_at": "2025-12-20T19:37:03.498Z"
+    },
+    {
+      "id": "02788d43-6175-4998-a331-70cfaf2679de",
+      "content": "Eu visitei o Rio de Janeiro em 2024",
+      "source_type": "conversation",
+      "metadata": {
+        "supermemory": {
+          "tags": [
+            "general"
+          ],
+          "type": "general",
+          "savedAt": "2025-12-20T19:37:01.656Z",
+          "duration": "medium_term"
+        }
+      },
+      "created_at": "2025-12-20T19:37:01.993Z"
+    },
+    {
+      "id": "0236668b-2199-46e8-8232-134994b3f97a",
+      "content": "O Brasil é o maior país da América do Sul",
+      "source_type": "conversation",
+      "metadata": {
+        "supermemory": {
+          "tags": [
+            "general"
+          ],
+          "type": "general",
+          "savedAt": "2025-12-20T19:37:00.090Z",
+          "duration": "medium_term"
+        }
+      },
+      "created_at": "2025-12-20T19:37:00.427Z"
+    },
+    {
+      "id": "4645b940-3d40-46ee-8987-a5b65a4725a7",
+      "content": "Teste rápido para research",
+      "source_type": "message",
+      "metadata": {
+        "type": "user_message",
+        "created_at": "2025-12-20T19:36:55.538031+00:00",
+        "auto_generated": true,
+        "conversation_id": "773fb453-17c9-4556-a36c-e383d754a804",
+        "original_message_id": "0163fe46-d551-4b8c-ab4e-6b2e6f04eae2"
+      },
+      "created_at": "2025-12-20T19:36:55.538Z"
+    },
+    {
+      "id": "440c5e90-9a61-4489-a8f1-4cd2935b8954",
+      "content": "Teste rápido para content_creator",
+      "source_type": "message",
+      "metadata": {
+        "type": "user_message",
+        "created_at": "2025-12-20T19:36:43.056398+00:00",
+        "auto_generated": true,
+        "conversation_id": "773fb453-17c9-4556-a36c-e383d754a804",
+        "original_message_id": "40324951-7afe-4f04-ab31-54f3827f9346"
+      },
+      "created_at": "2025-12-20T19:36:43.056Z"
+    },
+    {
+      "id": "e16d6075-d456-4294-9622-85f487ef46dc",
+      "content": "Teste rápido para goal_manager",
+      "source_type": "message",
+      "metadata": {
+        "type": "user_message",
+        "created_at": "2025-12-20T19:36:29.177213+00:00",
+        "auto_generated": true,
+        "conversation_id": "773fb453-17c9-4556-a36c-e383d754a804",
+        "original_message_id": "d7e45a5a-b582-428d-b7d8-11c345ef2432"
+      },
+      "created_at": "2025-12-20T19:36:29.177Z"
+    },
+    {
+      "id": "02bb5785-1ad5-4778-8bea-d3f5f09bcb60",
+      "content": "Teste rápido para task_manager",
+      "source_type": "message",
+      "metadata": {
+        "type": "user_message",
+        "created_at": "2025-12-20T19:36:17.003627+00:00",
+        "auto_generated": true,
+        "conversation_id": "773fb453-17c9-4556-a36c-e383d754a804",
+        "original_message_id": "ec72e6fe-17c7-4060-b315-152978f86091"
+      },
+      "created_at": "2025-12-20T19:36:17.003Z"
+    },
+    {
+      "id": "6749c6c7-3e42-401b-8b5b-cb75fbf1c0a8",
+      "content": "Olá, estou testando a V4. Responda brevemente.",
+      "source_type": "message",
+      "metadata": {
+        "type": "user_message",
+        "created_at": "2025-12-20T19:36:03.855881+00:00",
+        "auto_generated": true,
+        "conversation_id": "773fb453-17c9-4556-a36c-e383d754a804",
+        "original_message_id": "4f14be66-c156-4bca-a370-6578683db54c"
+      },
+      "created_at": "2025-12-20T19:36:03.855Z"
+    }
+  ]
+}

backend/e2e-evidence/v4-2025-12-20/research-agent-response.json

@@ -0,0 +1,27 @@
+{
+  "agentUsed": "research",
+  "responseLength": 104,
+  "latency": 13569,
+  "metadata": {
+    "processingTime": 12376,
+    "memoryFirstTime": 0,
+    "routingTime": 0,
+    "executionTime": 2626,
+    "routingConfidence": 1,
+    "routingReasoning": "Agente forçado pela requisição",
+    "toolsAvailable": 12,
+    "toolsUsed": [],
+    "supermemoryMatches": 0,
+    "memoryFilterResult": {
+      "saved": false,
+      "type": "not_relevant",
+      "score": 0
+    },
+    "architecture": "v4-enhanced",
+    "traceId": "trace-1766259523094-fu0hmsfpm",
+    "architectureVersion": "v4",
+    "agent": "research",
+    "googleAIConfigured": true,
+    "intelligentRouting": true
+  }
+}

backend/e2e-evidence/v4-2025-12-20/tracing-spans.json

@@ -0,0 +1,98 @@
+{
+  "success": true,
+  "data": [
+    {
+      "id": "82a450f2-0829-4d4d-837e-010eb231142a",
+      "spanType": "response",
+      "agentType": "general",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 2233,
+      "success": true,
+      "startedAt": "2025-12-20T19:37:17.649Z"
+    },
+    {
+      "id": "e37f8e31-3720-4341-a461-55a9a3995d0c",
+      "spanType": "prompt",
+      "agentType": "general",
+      "input": "Teste de tracing V4",
+      "latencyMs": 1694,
+      "success": true,
+      "startedAt": "2025-12-20T19:37:16.283Z"
+    },
+    {
+      "id": "528468b0-1372-4def-a145-17306054c7db",
+      "spanType": "router",
+      "agentType": null,
+      "input": "Teste de tracing V4",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 5794,
+      "success": true,
+      "startedAt": "2025-12-20T19:37:13.907Z"
+    },
+    {
+      "id": "ccff860e-8923-4a49-b4d5-09716916e16b",
+      "spanType": "response",
+      "agentType": "research",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 1429,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:52.747Z"
+    },
+    {
+      "id": "1db40d25-e57d-4b8f-b243-2ed114897e62",
+      "spanType": "prompt",
+      "agentType": "research",
+      "input": "Teste rápido para research",
+      "latencyMs": 897,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:51.318Z"
+    },
+    {
+      "id": "821a5f89-b343-4134-8fb0-63617571ee2a",
+      "spanType": "router",
+      "agentType": null,
+      "input": "Teste rápido para research",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 2497,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:50.783Z"
+    },
+    {
+      "id": "ca9be6de-e372-48b3-9413-5954acdfddec",
+      "spanType": "response",
+      "agentType": "content_creator",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 2096,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:40.311Z"
+    },
+    {
+      "id": "8882160a-b048-47ad-aae4-9e9098bc89cf",
+      "spanType": "prompt",
+      "agentType": "content_creator",
+      "input": "Teste rápido para content_creator",
+      "latencyMs": 1562,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:38.215Z"
+    },
+    {
+      "id": "1f2d747f-4ffb-4e7a-a2a5-9eb2920381aa",
+      "spanType": "router",
+      "agentType": null,
+      "input": "Teste rápido para content_creator",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 3157,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:37.686Z"
+    },
+    {
+      "id": "9b1c9c88-b2a4-494b-9c26-0d18415e270f",
+      "spanType": "response",
+      "agentType": "goal_manager",
+      "output": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+      "latencyMs": 1321,
+      "success": true,
+      "startedAt": "2025-12-20T19:36:26.469Z"
+    }
+  ]
+}

backend/e2e-evidence/v4-2025-12-20/v4-metadata-response.json

@@ -0,0 +1,28 @@
+{
+  "response": "Erro de configuração: O modelo \"gemini-3-flash\" não está disponível. Verifique a configuração do modelo.",
+  "conversationId": "773fb453-17c9-4556-a36c-e383d754a804",
+  "agentUsed": "general",
+  "mode": "auto",
+  "metadata": {
+    "processingTime": 12787,
+    "memoryFirstTime": 0,
+    "routingTime": 986,
+    "executionTime": 2706,
+    "routingConfidence": 0.5,
+    "routingReasoning": "Fallback para agente geral com ferramentas devido a erro ou ambiguidade",
+    "toolsAvailable": 9,
+    "toolsUsed": [],
+    "supermemoryMatches": 0,
+    "memoryFilterResult": {
+      "saved": false,
+      "type": "not_relevant",
+      "score": 0
+    },
+    "architecture": "v4-enhanced",
+    "traceId": "trace-1766259357735-2cef6vq1p",
+    "architectureVersion": "v4",
+    "agent": "general",
+    "googleAIConfigured": true,
+    "intelligentRouting": true
+  }
+}