fix: stuff

src/agent.rs

@@ -71,8 +71,16 @@ impl Agent {
     pub async fn run(&mut self) -> Result<(String, Option<String>), Box<dyn std::error::Error>> {
         let mut finished = false;
         let start_time = Instant::now();
-        let max_duration = Duration::from_secs(120);
-        let max_turns = 20;
+        let max_duration_secs = std::env::var("AGENT_MAX_DURATION_SECS")
+            .ok()
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(120);
+        let max_duration = Duration::from_secs(max_duration_secs);
+
+        let max_turns = std::env::var("AGENT_MAX_TURNS")
+            .ok()
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(20);
         let mut turns = 0;
 
         while !finished {

src/scheduler.rs

@@ -100,7 +100,11 @@ impl Scheduler {
         tokio::spawn(async move {
             let (logs, answer, status) = match agent.run().await {
                 Ok((logs, answer)) => (logs, answer, "completed".to_string()),
-                Err(e) => (format!("Scheduled run failed: {}", e), None, "failed".to_string()),
+                Err(e) => (
+                    format!("Scheduled run failed: {}", e),
+                    None,
+                    "failed".to_string(),
+                ),
             };
 
             let run_complete = task_run::ActiveModel {
@@ -110,7 +114,12 @@ impl Scheduler {
                 answer: Set(answer),
                 ..Default::default()
             };
-            let _ = run_complete.update(&db).await;
+            if let Err(e) = run_complete.update(&db).await {
+                eprintln!(
+                    "Failed to update scheduled run status for task {}: {}",
+                    task_id, e
+                );
+            }
         });
 
         Ok(())

src/server.rs

@@ -128,10 +128,24 @@ pub async fn start(db_url: &str) -> Result<(), Box<dyn std::error::Error>> {
         .route("/api/tasks/:id", get(get_task).put(update_task))
         .route("/api/tasks/:id/runs", post(rerun_task))
         .route("/api/runs/recent", get(get_recent_runs))
+        .route("/api/auth/session", get(auth_session))
         .route("/api/auth/callback", get(auth_callback))
         .route("/api/auth/refresh", post(auth_refresh))
         .route("/api/auth/logout", post(auth_logout))
         .layer(cors)
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
+            axum::http::header::CONTENT_SECURITY_POLICY,
+            HeaderValue::from_static("default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"),
+        ))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
+            axum::http::header::X_CONTENT_TYPE_OPTIONS,
+            HeaderValue::from_static("nosniff"),
+        ))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
+            axum::http::header::REFERRER_POLICY,
+            HeaderValue::from_static("strict-origin-when-cross-origin"),
+        ))
+        .layer(tower_http::limit::RequestBodyLimitLayer::new(1024 * 1024)) // 1MB limit
         .with_state(state);
 
     let port = std::env::var("PORT").unwrap_or_else(|_| "3000".to_string());
@@ -453,6 +467,13 @@ async fn auth_logout(jar: CookieJar) -> impl IntoResponse {
     (jar, StatusCode::NO_CONTENT)
 }
 
+async fn auth_session(user: AuthenticatedUser) -> Json<serde_json::Value> {
+    Json(serde_json::json!({
+        "authenticated": true,
+        "user": user.0
+    }))
+}
+
 fn secure() -> bool {
     std::env::var("COOKIE_SECURE")
         .map(|value| value == "true")