chore(actions): recommend approval policy + docs

.github/ACTIONS_POLICY.md

@@ -0,0 +1,9 @@
+# Actions approval policy (proposed)
+
+Proposed default policy for GitHub Actions approval on pull requests from forks:
+
+- **Approval requirement**: Require approval for all external contributors.
+- **Workflow permissions**: Keep `GITHUB_TOKEN` minimal by default (read-only for contents/packages), grant write only to workflows that need it and explicitly pin those workflows.
+- **Allowed actions**: Allow owner + selected Marketplace/verified actions; block untrusted third-party actions.
+
+This file documents the recommended changes and provides the maintainers with an explicit policy to adopt from the Settings > Actions UI.

.github/workflows/networkbuster.yml

@@ -0,0 +1,28 @@
+name: Build NetworkBuster App
+
+on:
+  push:
+    paths:
+      - 'packages/networkbuster/**'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+      - name: Build Docker image
+        run: |
+          cd packages/networkbuster
+          docker build -t networkbuster-app:latest .
+      - name: Upload image tar
+        run: |
+          docker save networkbuster-app:latest -o networkbuster-app.tar
+        # Optionally, upload artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: networkbuster-image
+          path: networkbuster-app.tar

.github/workflows/thruster-artifacts.yml

@@ -0,0 +1,29 @@
+name: Build Thruster Artifacts
+
+on:
+  push:
+    paths:
+      - 'thruster/**'
+      - 'api/**'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Install deps
+        run: npm ci
+      - name: Run thruster tests
+        run: npm run test:thruster
+      - name: Build Thruster Artifacts
+        run: npm run build:thruster-artifacts
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: thruster-artifacts
+          path: build/thruster-artifacts

.vscode/tasks.json

@@ -0,0 +1,10 @@
+{
+	"version": "2.0.0",
+	"tasks": [
+		{
+			"label": "Run tests",
+			"type": "shell",
+			"command": "npm test"
+		}
+	]
+}

COMMIT_EDITMSG.txt

@@ -0,0 +1,18 @@
+
+# Please enter the commit message for your changes. Lines starting
+# with '#' will be ignored, and an empty message aborts the commit.
+#
+# On branch bigtree
+# Your branch is behind 'origin/bigtree' by 2 commits, and can be fast-forwarded.
+#   (use "git pull" to update your local branch)
+#
+# Changes to be committed:
+#	new file:   install-windows-service.ps1
+#
+# Changes not staged for commit:
+#	modified:   .gitignore
+#	modified:   vercel.json
+#
+# Untracked files:
+#	.vscode/
+#

api/server-optimized.js

@@ -1,9 +1,9 @@
-import express from 'express';
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-import compression from 'compression';
-import helmet from 'helmet';
+import express from "express";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import compression from "compression";
+import helmet from "helmet";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const app = express();
@@ -14,7 +14,7 @@ app.use(compression());
 app.use(helmet());
 
 // Performance: Limit request size
-app.use(express.json({ limit: '1mb' }));
+app.use(express.json({ limit: "1mb" }));
 
 // Performance: Load and cache specs on startup
 let specsCache = null;
@@ -23,11 +23,16 @@ const CACHE_DURATION = 300000; // 5 minutes
 
 function loadAndCacheSpecs() {
   try {
-    specsCache = JSON.parse(fs.readFileSync(path.join(__dirname, '../data/system-specifications.json'), 'utf8'));
+    specsCache = JSON.parse(
+      fs.readFileSync(
+        path.join(__dirname, "../data/system-specifications.json"),
+        "utf8",
+      ),
+    );
     specsCacheTTL = Date.now() + CACHE_DURATION;
     return specsCache;
   } catch (error) {
-    console.error('Error loading specs:', error);
+    console.error("Error loading specs:", error);
     return null;
   }
 }
@@ -36,84 +41,86 @@ function loadAndCacheSpecs() {
 loadAndCacheSpecs();
 
 // Performance: Specs endpoint with caching
-app.get('/api/specs', (req, res) => {
+app.get("/api/specs", (req, res) => {
   // Set cache headers
-  res.set('Cache-Control', 'public, max-age=300'); // 5 minutes
-  
+  res.set("Cache-Control", "public, max-age=300"); // 5 minutes
+
   // Reload if cache expired
   if (Date.now() > specsCacheTTL) {
     loadAndCacheSpecs();
   }
-  
+
   if (specsCache) {
     res.json(specsCache);
   } else {
-    res.status(500).json({ error: 'Failed to load specifications' });
+    res.status(500).json({ error: "Failed to load specifications" });
   }
 });
 
 // Performance: Section-specific specs with caching
-app.get('/api/specs/:section', (req, res) => {
-  res.set('Cache-Control', 'public, max-age=300');
-  
+app.get("/api/specs/:section", (req, res) => {
+  res.set("Cache-Control", "public, max-age=300");
+
   // Reload if cache expired
   if (Date.now() > specsCacheTTL) {
     loadAndCacheSpecs();
   }
-  
+
   const section = req.params.section.toLowerCase();
   if (specsCache && specsCache[section]) {
     res.json({ [section]: specsCache[section] });
   } else {
-    res.status(404).json({ error: 'Section not found' });
+    res.status(404).json({ error: "Section not found" });
   }
 });
 
 // Performance: Lightweight health endpoint (no caching needed)
-app.get('/health', (req, res) => {
+app.get("/health", (req, res) => {
   // Minimal response for load balancers
-  res.status(200).json({ 
-    status: 'ok',
+  res.status(200).json({
+    status: "ok",
     timestamp: new Date().toISOString(),
-    uptime: process.uptime()
+    uptime: process.uptime(),
   });
 });
 
 // Performance: Additional monitoring endpoint
-app.get('/api/health/detailed', (req, res) => {
-  res.set('Cache-Control', 'public, max-age=5');
-  
+app.get("/api/health/detailed", (req, res) => {
+  res.set("Cache-Control", "public, max-age=5");
+
   const memUsage = process.memoryUsage();
   res.json({
-    status: 'healthy',
+    status: "healthy",
     timestamp: new Date().toISOString(),
     uptime: process.uptime(),
     memory: {
       heapUsed: Math.round(memUsage.heapUsed / 1024 / 1024),
       heapTotal: Math.round(memUsage.heapTotal / 1024 / 1024),
-      external: Math.round(memUsage.external / 1024 / 1024)
+      external: Math.round(memUsage.external / 1024 / 1024),
     },
-    cached: specsCache ? 'yes' : 'no',
-    cacheAge: specsCache ? Math.round((Date.now() - (specsCacheTTL - CACHE_DURATION)) / 1000) : 'N/A'
+    cached: specsCache ? "yes" : "no",
+    cacheAge: specsCache
+      ? Math.round((Date.now() - (specsCacheTTL - CACHE_DURATION)) / 1000)
+      : "N/A",
   });
 });
 
 // Performance: Error handling middleware
 app.use((err, req, res, next) => {
-  console.error('Error:', err.message);
-  res.status(500).json({ 
-    error: 'Internal server error',
-    message: process.env.NODE_ENV === 'development' ? err.message : undefined
+  console.error("Error:", err.message);
+  res.status(500).json({
+    error: "Internal server error",
+    message: process.env.NODE_ENV === "development" ? err.message : undefined,
   });
 });
 
 // Performance: 404 handler
 app.use((req, res) => {
-  res.status(404).json({ error: 'Not found' });
+  res.status(404).json({ error: "Not found" });
 });
 
 // Performance: Start server
-const server = app.listen(PORT, '0.0.0.0', () => {
+const server = app.listen(PORT, "0.0.0.0", () => {
   console.log(`\n🚀 Optimized API Server running at http://localhost:${PORT}`);
   console.log(`⚡ Performance optimizations enabled:`);
   console.log(`   • Compression (gzip) enabled`);
@@ -124,14 +131,16 @@ const server = app.listen(PORT, '0.0.0.0', () => {
   console.log(`\n📍 Routes:`);
   console.log(`📊 Specs: http://localhost:${PORT}/api/specs`);
   console.log(`🏥 Health: http://localhost:${PORT}/health`);
-  console.log(`📈 Detailed Health: http://localhost:${PORT}/api/health/detailed\n`);
+  console.log(
+    `📈 Detailed Health: http://localhost:${PORT}/api/health/detailed\n`,
+  );
 });
 
 // Performance: Graceful shutdown
-process.on('SIGTERM', () => {
-  console.log('SIGTERM received, shutting down gracefully...');
+process.on("SIGTERM", () => {
+  console.log("SIGTERM received, shutting down gracefully...");
   server.close(() => {
-    console.log('API Server closed');
+    console.log("API Server closed");
     process.exit(0);
   });
 });