Skip to content

v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jun 02:48
v1.1.0
431e366

AI Agent Simulator v1.1.0

This release adds a real network edge — the production ingress chain an agent request crosses before the backend, running as actual Docker containers — and a third LLM provider, Google Vertex AI.

⚠️ The network edge runs as containers. Bring it up with docker compose up. Local dev (uvicorn + npm run dev) talks to the backend directly and does not exercise the chain.

🌐 Network edge — the real ingress chain

A request now genuinely travels through a chain of real network appliances, each reporting real evidence (not a diagram):

Hop Container Role
DNS CoreDNS Resolves the upstream service
CDN / cache Varnish Browser-facing front door (:8090); cache HIT / BYPASS
TLS / load balancer HAProxy Terminates TLS 1.3 (single decryption point), load-balances
WAF ModSecurity + OWASP CRS Inspects every request; real attacks get a 403
API gateway Kong Path routing + real rate limiting (a burst returns 429)
  • Click the frontend→backend arrow or any appliance to inspect forwarded headers, cache status, LB pool/algorithm, WAF paranoia level + anomaly threshold, and gateway route + rate-limit policy.
  • WAF block visualization — a blocked request lights the path up to the WAF with a 403 badge and an explanation of the matched OWASP CRS rule, plus a bilingual chat note.

✨ Google Vertex AI provider

A real, opt-in third LLM provider alongside OpenAI and Ollama — contributed by new contributor @elizeureisl in #4. 🎉

  • Bind an agent to Vertex AI, configure GCP project/location + a service-account key (persisted, masked on read, with a step-by-step help tooltip), pick a curated Gemini model, and run the agentic loop against real Gemini — no OpenAI key required for that run.
  • Save & test validates the credentials with a live call. Amends constitution §2 (OpenAI + Ollama + Vertex AI). Bilingual EN/PT throughout.

🐛 Fixed

  • WAF blocked the app's own REST calls — the OWASP CRS default allowed_methods returned 403 for PATCH/PUT/DELETE, breaking agent rename, provider switch, settings save and agent delete through the chain. The WAF now allows those verbs.

🔒 Security

  • Scoped WAF exclusion for secret-carrying settings endpoints — /api/settings/* carry opaque secrets (service-account JSON private key, API keys) that false-positive the CRS LFI family (e.g. the credentials field matching rule 930120). A narrow, path-scoped exclusion drops only those rules on those endpoints; the rest of the API keeps full CRS coverage and real attacks stay blocked.

🧩 Also in this release

  • Chunk overlap highlighting — the chunk full-text view highlights the carried overlap prefix; the recursive chunker sub-splits oversized paragraphs.
  • Playwright integration tests — browser E2E driving the live Docker stack through the network chain (manual workflow).

Full changelog: v1.0.1...v1.1.0

Assets 2
Loading