fix: generate release notes ourselves for hotfix releases

Hotfixes land on main via git cherry-pick (hotfix-cherry-pick.yml),
not a PR merged into main, so GitHub's generate_release_notes can't
associate any PR with those commits and the release body comes back
empty (see v0.30.1).

Build the "What's Changed" list from the cherry-picked
"Merge pull request #N ..." commit messages instead, resolving each
PR's title/author via gh.

.claude/settings.json

@@ -1,22 +0,0 @@
-{
-	"worktree": {
-		"baseRef": "fresh"
-	},
-	"hooks": {
-		"PostToolUse": [
-			{
-				"matcher": "EnterWorktree",
-				"hooks": [
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/install-worktree-deps.sh\""
-					},
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/assign-worktree-port.sh\""
-					}
-				]
-			}
-		]
-	}
-}

.claude/skills/fix-issue/SKILL.md

@@ -1,55 +0,0 @@
----
-name: fix-issue
-description: Implement a GitHub issue with reproduction and verification
-allowed-tools: Bash, Edit, Write, Read, Glob, Grep, mcp__playwright__*, mcp__dokploy__*
----
-
-The issue number is passed as $1.
-
-## Instance
-
-No instance is running yet — start your own, isolated to this worktree:
-
-1. Check `apps/dokploy/.env` for `PORT` (assigned per-worktree already).
-2. If nothing is listening on that port, start it: `pnpm dokploy:dev` in the
-   background, then poll `curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT`
-   until it answers (usually ~10-15s).
-3. Use `http://localhost:$PORT` as the base URL for Playwright navigation.
-
-Note: `mcp__dokploy__*` (this repo's `.mcp.json`) resolves its URL from
-`$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port
-discovered mid-session. If those tools are unavailable or point at the wrong
-instance, fall back to `curl`/`gh api` for API-level checks, or ask the user
-to relaunch with `DOKPLOY_BASE_URL` exported first.
-
-## Tools
-
-- `mcp__dokploy__*` — the Dokploy API of the running instance. Use it to set up
-  state (create a project, an app, an env var) and to verify backend behavior.
-  Search for the tool you need; they are not all loaded upfront.
-- `mcp__playwright__*` — the browser at $DOKPLOY_BASE_URL. Use it for anything
-  a user would see or click.
-
-Pick by where the bug lives, not by convenience:
-
-- Bug in the UI (rendering, forms, navigation, state) → reproduce in Playwright.
-  The API returning correct data proves nothing here.
-- Bug in the API, deploy logic, or data → reproduce with the Dokploy MCP.
-  A green screenshot proves nothing here.
-- Unclear → do both.
-
-Use the MCP to reach the state you need quickly, then verify in the UI. Do not
-click through ten screens to create a project the API can create in one call.
-
-## Steps
-
-1. Run `gh issue view $1` and read the full issue, including comments.
-2. Reproduce the bug with the appropriate tool. If you cannot reproduce it,
-   comment on the issue explaining what you tried and STOP.
-   Do not implement anything.
-3. Implement the fix. Keep the change minimal and scoped to the issue.
-4. Run `pnpm test`, then re-run the same reproduction from step 2.
-5. Only if both pass: commit and run `gh pr create`. The PR description must
-   include the before/after reproduction steps and reference the issue.
-
-Never skip step 2. A fix you cannot reproduce and then verify is not a fix.

.github/workflows/dokploy.yml

@@ -162,13 +162,44 @@ jobs:
           { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
           mv install-pinned.sh install.sh
 
+      - name: Generate release notes
+        # Hotfixes land on main via `git cherry-pick` (hotfix-cherry-pick.yml),
+        # not a PR merged into main, so GitHub's own generate_release_notes
+        # can't associate any PR with these commits and comes back empty.
+        # Build the "What's Changed" list ourselves from the cherry-picked
+        # "Merge pull request #N ..." commit messages instead.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          RANGE="HEAD"
+          [ -n "$PREV_TAG" ] && RANGE="${PREV_TAG}..HEAD"
+
+          {
+            echo "## What's Changed"
+            git log "$RANGE" --reverse --format='%s' \
+              | grep -oE '^Merge pull request #[0-9]+' \
+              | grep -oE '[0-9]+' \
+              | while read -r PR; do
+                gh pr view "$PR" --repo "${{ github.repository }}" \
+                  --json title,author -q '"* \(.title) by @\(.author.login) in #'"$PR"'"' \
+                  2>/dev/null || true
+              done
+            if [ -n "$PREV_TAG" ]; then
+              echo ""
+              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...${{ steps.get_version.outputs.version }}"
+            fi
+          } > release-notes.md
+
+          cat release-notes.md
+
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
           target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
-          generate_release_notes: true
+          body_path: release-notes.md
           draft: false
           prerelease: false
           files: install.sh

.worktreeinclude

@@ -1,2 +0,0 @@
-.env
-.env.local

CLAUDE.md

@@ -1,6 +0,0 @@
-## Code style
-- Don't write comments that restate what the code already says.
-- Comment only the "why" when something isn't obvious: workarounds,
-  counterintuitive decisions, constraints from an external API.
-- No section-divider comments like `// --- Helpers ---`.
-- Don't leave comments describing the change you just made.

apps/dokploy/__test__/backups/volume-backup-restart.test.ts

@@ -1,82 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { createRestartSafeBackupCommand } from "@dokploy/server/utils/volume-backups/backup";
-import { describe, expect, it } from "vitest";
-
-const runCommand = (command: string) =>
-	spawnSync("bash", ["-c", command], {
-		encoding: "utf8",
-	});
-
-const outputLines = (stdout: string) =>
-	stdout
-		.trim()
-		.split("\n")
-		.filter((line) => line.length > 0);
-
-describe("createRestartSafeBackupCommand", () => {
-	it("restarts the service and preserves the backup error status", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("preserves the backup error status when the restart also fails", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"Service restart also failed with exit code 17",
-		]);
-	});
-
-	it("returns the restart error status when the backup succeeds", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(17);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("uploads only after a successful backup and service restart", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(0);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"upload",
-		]);
-	});
-});

apps/dokploy/__test__/compose/compose-project-directory.test.ts

@@ -1,58 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	command: "",
-};
-
-describe("compose createCommand --project-directory", () => {
-	it("pins --project-directory to the code dir when composePath is nested", () => {
-		const cmd = createCommand(
-			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f ./deploy/docker-compose.yml");
-	});
-
-	it("omits --project-directory when no projectPath is passed", () => {
-		const cmd = createCommand({
-			...base,
-			composePath: "./deploy/docker-compose.yml",
-		} as any);
-
-		expect(cmd).not.toContain("--project-directory");
-	});
-
-	it("does not add --project-directory to stack deploy (unsupported flag)", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composeType: "stack",
-				composePath: "./deploy/docker-compose.yml",
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--project-directory");
-		expect(cmd.startsWith("stack deploy")).toBe(true);
-	});
-
-	it("keeps raw sourceType resolving from the code dir (root docker-compose.yml)", () => {
-		const cmd = createCommand(
-			{ ...base, sourceType: "raw", composePath: "docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f docker-compose.yml");
-	});
-});

apps/dokploy/__test__/compose/env-file-literals.test.ts

@@ -32,9 +32,6 @@ const cases: Record<string, string> = {
 	APOSTROPHE: "it's a test",
 	UNICODE: "héllo wörld 日本語 🚀",
 	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
-	APP_URL: "https://example.com",
-	ASSET_URL: "https://example.com",
-	DB_HOST: "localhost",
 };
 
 // How each value must be typed in the UI so the (unchanged) dotenv input
@@ -49,9 +46,6 @@ const inputEncoding: Record<string, string> = {
 	APOSTROPHE: "it's a test",
 	UNICODE: "héllo wörld 日本語 🚀",
 	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
-	APP_URL: "https://example.com",
-	ASSET_URL: '"${APP_URL}"',
-	DB_HOST: '"${UNDEFINED_HOST:-localhost}"',
 };
 
 describe("getCreateEnvFileCommand", () => {

apps/dokploy/__test__/deploy/railpack.command.test.ts

@@ -50,15 +50,6 @@ describe("getRailpackCommand", () => {
 		expect(command).toContain("--build-arg cache-key=");
 	});
 
-	it("installs Railpack through sudo for non-root users", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain(
-			'$SUDO_CMD bash -c "$(curl -fsSL https://railpack.com/install.sh)"',
-		);
-		expect(command).toContain("sudo -n true 2>/dev/null");
-	});
-
 	it("changes secrets-hash when an environment value changes", () => {
 		const firstCommand = getRailpackCommand(
 			createApplication({

apps/dokploy/__test__/logs/container-selection.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
-
-const containers = [
-	{ containerId: "first-container" },
-	{ containerId: "selected-container" },
-];
-
-describe("resolveContainerSelection", () => {
-	it("selects the first container when no container is selected", () => {
-		expect(resolveContainerSelection(undefined, containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("preserves a manual selection when refreshed data contains it", () => {
-		const refreshedContainers = containers.map((container) => ({
-			...container,
-		}));
-
-		expect(
-			resolveContainerSelection("selected-container", refreshedContainers),
-		).toBe("selected-container");
-	});
-
-	it("falls back to the first container when the selection disappears", () => {
-		expect(resolveContainerSelection("removed-container", containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("keeps the current selection while container data is loading", () => {
-		expect(resolveContainerSelection("selected-container", undefined)).toBe(
-			"selected-container",
-		);
-	});
-
-	it("clears the selection when no containers are available", () => {
-		expect(resolveContainerSelection("selected-container", [])).toBeUndefined();
-	});
-});

apps/dokploy/__test__/permissions/check-permission.test.ts

@@ -126,13 +126,6 @@ describe("member is denied org-level enterprise resources (CVE: bypass via stati
 		await expect(checkPermission(ctx, { server: ["read"] })).rejects.toThrow();
 	});
 
-	it("member is denied server.terminal", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-	});
-
 	it("member is denied registry.create", async () => {
 		memberToReturn = mockMemberData("member");
 		await expect(

apps/dokploy/__test__/permissions/resolve-permissions.test.ts

@@ -105,7 +105,6 @@ describe("enterprise resources for static roles", () => {
 		const perms = await resolvePermissions(ctx);
 
 		expect(perms.server.read).toBe(false);
-		expect(perms.server.terminal).toBe(false);
 		expect(perms.registry.read).toBe(false);
 		expect(perms.certificate.read).toBe(false);
 		expect(perms.destination.read).toBe(false);

apps/dokploy/__test__/permissions/server-terminal.test.ts

@@ -1,105 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockMemberData = (role: string) => ({
-	id: "member-1",
-	role,
-	userId: "user-1",
-	organizationId: "org-1",
-	accessedProjects: [] as string[],
-	accessedServices: [] as string[],
-	accessedEnvironments: [] as string[],
-	accessedServers: [] as string[],
-	canCreateProjects: false,
-	canDeleteProjects: false,
-	canCreateServices: false,
-	canDeleteServices: false,
-	canCreateEnvironments: false,
-	canDeleteEnvironments: false,
-	canAccessToTraefikFiles: false,
-	canAccessToDocker: false,
-	canAccessToAPI: false,
-	canAccessToSSHKeys: false,
-	canAccessToGitProviders: false,
-	user: { id: "user-1", email: "test@test.com" },
-});
-
-let memberToReturn = mockMemberData("deployer");
-let rolesToReturn: { permission: string }[] = [];
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			member: {
-				findFirst: vi.fn(() => Promise.resolve(memberToReturn)),
-				findMany: vi.fn(() => Promise.resolve([])),
-			},
-			organizationRole: {
-				findFirst: vi.fn(),
-				findMany: vi.fn(() => Promise.resolve(rolesToReturn)),
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: vi.fn(() => Promise.resolve(true)),
-}));
-
-const { checkPermission, resolvePermissions } = await import(
-	"@dokploy/server/services/permission"
-);
-
-const ctx = {
-	user: { id: "user-1" },
-	session: { activeOrganizationId: "org-1" },
-};
-
-const withPermissions = (permissions: Record<string, string[]>) => {
-	rolesToReturn = [{ permission: JSON.stringify(permissions) }];
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	memberToReturn = mockMemberData("deployer");
-	rolesToReturn = [];
-});
-
-describe("server.terminal on custom roles", () => {
-	it("a role with server.read alone cannot open a terminal", async () => {
-		withPermissions({ server: ["read"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["read"] }),
-		).resolves.toBeUndefined();
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.read).toBe(true);
-		expect(perms.server.terminal).toBe(false);
-	});
-
-	it("a role with server.terminal can open a terminal", async () => {
-		withPermissions({ server: ["read", "terminal"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).resolves.toBeUndefined();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.terminal).toBe(true);
-	});
-
-	it("owner and admin keep terminal access", async () => {
-		for (const role of ["owner", "admin"]) {
-			memberToReturn = mockMemberData(role);
-			await expect(
-				checkPermission(ctx, { server: ["terminal"] }),
-			).resolves.toBeUndefined();
-
-			const perms = await resolvePermissions(ctx);
-			expect(perms.server.terminal).toBe(true);
-		}
-	});
-});

apps/dokploy/__test__/setup/monitoring-setup.real.test.ts

@@ -1,236 +0,0 @@
-import { execSync } from "node:child_process";
-import { docker } from "@dokploy/server/constants";
-import { setupMonitoring } from "@dokploy/server/setup/monitoring-setup";
-import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
-
-const REAL_TEST_TIMEOUT = 120000;
-const SERVICE_NAME = "dokploy-monitoring";
-const TEST_IMAGE = "busybox:latest";
-
-// Mock ONLY db-backed lookups and remote I/O. Dockerode stays real and talks to
-// the local daemon, so the legacy-container cleanup is exercised for real.
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn().mockResolvedValue({
-		serverId: "test-server",
-		serverType: "deploy",
-		sshKeyId: null, // -> getRemoteDocker returns the local docker instance
-		metricsConfig: {
-			server: {
-				type: "Remote",
-				port: 4500,
-				token: "test-token",
-				urlCallback: "http://localhost/callback",
-				cronJob: "0 0 * * *",
-				retentionDays: 2,
-				refreshRate: 60,
-				thresholds: { cpu: 0, memory: 0 },
-			},
-			containers: { refreshRate: 60, services: { include: [], exclude: [] } },
-		},
-	}),
-}));
-
-vi.mock("@dokploy/server/services/settings", () => ({
-	getDokployImageTag: vi.fn(() => "latest"),
-}));
-
-vi.mock("@dokploy/server/utils/docker/utils", () => ({
-	pullImage: vi.fn().mockResolvedValue(undefined),
-	pullRemoteImage: vi.fn().mockResolvedValue(undefined),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-	execAsyncRemote: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-}));
-
-const containerExists = async (name: string) => {
-	try {
-		await docker.getContainer(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-const serviceExists = async (name: string) => {
-	try {
-		await docker.getService(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-const swarmTaskNames = async () => {
-	const list = await docker.listContainers({ all: true });
-	return list
-		.flatMap((c) => c.Names.map((n) => n.replace(/^\//, "")))
-		.filter((n) => n.startsWith(`${SERVICE_NAME}.`));
-};
-
-const cleanup = async () => {
-	try {
-		await docker.getService(SERVICE_NAME).remove();
-	} catch {}
-	try {
-		await docker.getContainer(SERVICE_NAME).remove({ force: true });
-	} catch {}
-	for (const name of await swarmTaskNames()) {
-		try {
-			await docker.getContainer(name).remove({ force: true });
-		} catch {}
-	}
-};
-
-// Recreates the pre-v0.30.0 standalone agent stuck in a crash loop.
-const createLegacyZombie = async () => {
-	const container = await docker.createContainer({
-		name: SERVICE_NAME,
-		Image: TEST_IMAGE,
-		Cmd: [
-			"sh",
-			"-c",
-			"echo 'Error starting metrics cleanup system: empty spec string'; exit 1",
-		],
-		HostConfig: { RestartPolicy: { Name: "always" }, NetworkMode: "host" },
-	});
-	await container.start();
-};
-
-const pullTestImage = async () => {
-	try {
-		await docker.getImage(TEST_IMAGE).inspect();
-		return;
-	} catch {}
-	await new Promise<void>((resolve, reject) =>
-		docker.pull(TEST_IMAGE, (err: any, stream: any) =>
-			err
-				? reject(err)
-				: docker.modem.followProgress(stream, (e: any) =>
-						e ? reject(e) : resolve(),
-					),
-		),
-	);
-};
-
-// The code under test hardcodes the production name, so this suite cannot
-// namespace its fixtures. Skip rather than wipe a real agent on a Dokploy host.
-const hasRealMonitoring = () => {
-	const query = (cmd: string) => {
-		try {
-			return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })
-				.toString()
-				.trim();
-		} catch {
-			return "";
-		}
-	};
-
-	return (
-		query(
-			`docker service ls --filter name=${SERVICE_NAME} --format '{{.Name}}'`,
-		) !== "" ||
-		query(
-			`docker ps -a --filter name=^${SERVICE_NAME}$ --format '{{.Names}}'`,
-		) !== ""
-	);
-};
-
-describe.skipIf(hasRealMonitoring())(
-	"setupMonitoring - legacy container cleanup (real docker)",
-	() => {
-		beforeEach(async () => {
-			await pullTestImage();
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		afterAll(async () => {
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		it(
-			"removes the legacy standalone container left behind by the swarm migration",
-			async () => {
-				await createLegacyZombie();
-				expect(await containerExists(SERVICE_NAME)).toBe(true);
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"removes the legacy container without touching swarm tasks, which are named dokploy-monitoring.<slot>.<id>",
-			async () => {
-				const taskName = `${SERVICE_NAME}.1.qh3ldvg2h9x0test`;
-				const task = await docker.createContainer({
-					name: taskName,
-					Image: TEST_IMAGE,
-					Cmd: ["sleep", "3600"],
-				});
-				await task.start();
-				await createLegacyZombie();
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await containerExists(taskName)).toBe(true);
-				const inspect = await docker.getContainer(taskName).inspect();
-				expect(inspect.State.Running).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"is idempotent when no legacy container exists",
-			async () => {
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"deploys the service even when removing the legacy container fails",
-			async () => {
-				const failingDocker = {
-					getContainer: () => ({
-						remove: async () => {
-							const error: any = new Error("device or resource busy");
-							error.statusCode = 500;
-							throw error;
-						},
-					}),
-					getService: docker.getService.bind(docker),
-					createService: docker.createService.bind(docker),
-				};
-
-				const remoteDocker = await import(
-					"@dokploy/server/utils/servers/remote-docker"
-				);
-				const spy = vi
-					.spyOn(remoteDocker, "getRemoteDocker")
-					.mockResolvedValue(failingDocker as any);
-
-				try {
-					await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-					expect(spy).toHaveBeenCalled(); // guards against the spy silently not intercepting
-					expect(await serviceExists(SERVICE_NAME)).toBe(true);
-				} finally {
-					spy.mockRestore();
-				}
-			},
-			REAL_TEST_TIMEOUT,
-		);
-	},
-);

apps/dokploy/__test__/traefik/reconnect-services.test.ts

@@ -1,71 +0,0 @@
-import { reconnectServicesToTraefik } from "@dokploy/server/services/settings";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findMany: vi.fn(),
-	execAsync: vi.fn(),
-	execAsyncRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			compose: {
-				findMany: mocks.findMany,
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: mocks.execAsync,
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-describe("reconnectServicesToTraefik", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.findMany.mockResolvedValue([]);
-	});
-
-	it("does not execute an empty local command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-
-	it("does not execute an empty remote command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments to the local Traefik network", async () => {
-		mocks.findMany.mockResolvedValue([
-			{ appName: "first-compose" },
-			{ appName: "second-compose" },
-		]);
-
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).toHaveBeenCalledOnce();
-		expect(mocks.execAsync).toHaveBeenCalledWith(
-			'docker network connect first-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n' +
-				'docker network connect second-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments on a remote server", async () => {
-		mocks.findMany.mockResolvedValue([{ appName: "remote-compose" }]);
-
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			'docker network connect remote-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/traefik/write-app-traefik-config.test.ts

@@ -1,116 +0,0 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { writeAppTraefikConfig } from "@dokploy/server/utils/traefik/application";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => {
-	const actual =
-		await importOriginal<
-			typeof import("@dokploy/server/utils/process/execAsync")
-		>();
-	return {
-		...actual,
-		execAsyncRemote: mocks.execAsyncRemote,
-	};
-});
-
-describe("writeAppTraefikConfig", () => {
-	let cwd: string;
-	let dynamicPath: string;
-
-	beforeEach(() => {
-		cwd = fs.mkdtempSync(path.join(os.tmpdir(), "dokploy-traefik-"));
-		dynamicPath = path.join(cwd, ".docker", "traefik", "dynamic");
-		fs.mkdirSync(dynamicPath, { recursive: true });
-		vi.spyOn(process, "cwd").mockReturnValue(cwd);
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		fs.rmSync(cwd, { recursive: true, force: true });
-	});
-
-	// Regression test for #5189: Traefik's file provider rejects a standalone
-	// `routers: {}` / `services: {}` map and aborts its watcher for every
-	// dynamic config once it hits one, so an app with no domains must never
-	// get an on-disk config file at all.
-	it("removes the file instead of writing empty routers/services", async () => {
-		const appName = "no-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-		fs.writeFileSync(configPath, "stale content", "utf8");
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(false);
-	});
-
-	it("writes the file when routers/services are present", async () => {
-		const appName = "with-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						[`${appName}-router-1`]: {
-							rule: "Host(`x`)",
-							service: `${appName}-service`,
-						},
-					},
-					services: {},
-				},
-			},
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(true);
-	});
-
-	it("removes the remote file instead of writing empty routers/services", async () => {
-		mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			"no-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		const [, command] = mocks.execAsyncRemote.mock.calls[0] ?? [];
-		expect(command).toMatch(/^rm -f /);
-		expect(command).toContain("no-domain-app.yml");
-	});
-
-	it("writes the remote file when routers/services are present", async () => {
-		mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						"with-domain-app-router-1": {
-							rule: "Host(`x`)",
-							service: "with-domain-app-service",
-						},
-					},
-					services: {},
-				},
-			},
-			"with-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		const [, command] = mocks.execAsyncRemote.mock.calls[0] ?? [];
-		expect(command).toMatch(/^echo /);
-	});
-});

apps/dokploy/__test__/wss/authorize.test.ts

@@ -95,35 +95,10 @@ describe("canAccessTerminalOverWss", () => {
 	});
 
 	it("gates a remote server terminal on server access", async () => {
-		mockHasPermission.mockResolvedValue(true);
 		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// the remote path must never fall through to the owner/admin local branch
+		// role lookup must not be needed for the remote path
 		expect(mockFindMember).not.toHaveBeenCalled();
 	});
-
-	it("denies a remote server terminal without the server.terminal permission", async () => {
-		// Reaching a server (to deploy on it) must not imply a root shell on it.
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(false);
-		expect(mockHasPermission).toHaveBeenCalledWith(
-			{ user: { id: USER.id }, session: { activeOrganizationId: "org-1" } },
-			{ server: ["terminal"] },
-		);
-	});
-
-	it("allows a remote server terminal with the server.terminal permission", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("does not check permissions for a server the caller cannot access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		expect(mockHasPermission).not.toHaveBeenCalled();
-	});
 });

apps/dokploy/__test__/wss/readValidDirectory.test.ts

@@ -94,32 +94,4 @@ describe("readValidDirectory (path traversal)", () => {
 			),
 		).toBe(true);
 	});
-
-	it("returns true for SvelteKit routes with + prefix and @ symbols", () => {
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+page.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+layout.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+server.ts`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+error.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/node_modules/@types/node/index.d.ts`,
-			),
-		).toBe(true);
-	});
 });

apps/dokploy/components/dashboard/application/domains/show-domains.tsx

@@ -191,7 +191,8 @@ export const ShowDomains = ({ id, type }: Props) => {
 		try {
 			const result = await validateDomain({
 				domain: host,
-				serverId: application?.serverId ?? undefined,
+				serverIp:
+					application?.server?.ipAddress?.toString() || ip?.toString() || "",
 			});
 
 			setValidationStates((prev) => ({

apps/dokploy/components/dashboard/application/logs/show.tsx

@@ -1,7 +1,6 @@
 import { Loader2 } from "lucide-react";
 import dynamic from "next/dynamic";
 import { useEffect, useState } from "react";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
 import { Badge } from "@/components/ui/badge";
 import {
 	Card,
@@ -80,13 +79,17 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 			},
 		);
 
-	const availableContainers = option === "native" ? containers : services;
-
 	useEffect(() => {
-		setContainerId((currentContainerId) =>
-			resolveContainerSelection(currentContainerId, availableContainers),
-		);
-	}, [availableContainers]);
+		if (option === "native") {
+			if (containers && containers?.length > 0) {
+				setContainerId(containers[0]?.containerId);
+			}
+		} else {
+			if (services && services?.length > 0) {
+				setContainerId(services[0]?.containerId);
+			}
+		}
+	}, [option, services, containers]);
 
 	const isLoading = option === "native" ? containersLoading : servicesLoading;
 	const containersLength =
@@ -111,7 +114,6 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 						<Switch
 							checked={option === "native"}
 							onCheckedChange={(checked) => {
-								setContainerId(undefined);
 								setOption(checked ? "native" : "swarm");
 							}}
 						/>

apps/dokploy/components/dashboard/compose/logs/show-stack.tsx

@@ -2,7 +2,6 @@ import { Loader2 } from "lucide-react";
 import dynamic from "next/dynamic";
 import { useEffect, useState } from "react";
 import { badgeStateColor } from "@/components/dashboard/application/logs/show";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
 import { Badge } from "@/components/ui/badge";
 import {
 	Card,
@@ -55,7 +54,6 @@ export const ShowDockerLogsStack = ({
 			},
 			{
 				enabled: !!appName && option === "swarm",
-				refetchInterval: 5000,
 			},
 		);
 
@@ -68,18 +66,22 @@ export const ShowDockerLogsStack = ({
 			},
 			{
 				enabled: !!appName && option === "native",
-				refetchInterval: 5000,
 			},
 		);
 
 	const containers = data?.filter((container) => container.containerId);
-	const availableContainers = option === "native" ? containers : services;
 
 	useEffect(() => {
-		setContainerId((currentContainerId) =>
-			resolveContainerSelection(currentContainerId, availableContainers),
-		);
-	}, [availableContainers]);
+		if (option === "native") {
+			if (containers && containers?.length > 0) {
+				setContainerId(containers[0]?.containerId);
+			}
+		} else {
+			if (services && services?.length > 0) {
+				setContainerId(services[0]?.containerId);
+			}
+		}
+	}, [option, services, containers]);
 
 	const isLoading = option === "native" ? containersLoading : servicesLoading;
 	const containersLength =
@@ -104,7 +106,6 @@ export const ShowDockerLogsStack = ({
 						<Switch
 							checked={option === "native"}
 							onCheckedChange={(checked) => {
-								setContainerId(undefined);
 								setOption(checked ? "native" : "swarm");
 							}}
 						/>

apps/dokploy/components/dashboard/compose/logs/show.tsx

@@ -2,7 +2,6 @@ import { Loader2 } from "lucide-react";
 import dynamic from "next/dynamic";
 import { useEffect, useState } from "react";
 import { badgeStateColor } from "@/components/dashboard/application/logs/show";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
 import { Badge } from "@/components/ui/badge";
 import {
 	Card,
@@ -53,15 +52,14 @@ export const ShowDockerLogsCompose = ({
 		},
 		{
 			enabled: !!appName,
-			refetchInterval: 5000,
 		},
 	);
 	const [containerId, setContainerId] = useState<string | undefined>();
 
 	useEffect(() => {
-		setContainerId((currentContainerId) =>
-			resolveContainerSelection(currentContainerId, data),
-		);
+		if (data && data?.length > 0) {
+			setContainerId(data[0]?.containerId);
+		}
 	}, [data]);
 
 	return (

apps/dokploy/components/dashboard/docker/logs/utils.ts

@@ -7,28 +7,6 @@ export interface LogLine {
 	message: string;
 }
 
-interface ContainerOption {
-	containerId: string;
-}
-
-export const resolveContainerSelection = (
-	currentContainerId: string | undefined,
-	containers: readonly ContainerOption[] | undefined,
-) => {
-	if (!containers) {
-		return currentContainerId;
-	}
-
-	if (
-		currentContainerId &&
-		containers.some(({ containerId }) => containerId === currentContainerId)
-	) {
-		return currentContainerId;
-	}
-
-	return containers[0]?.containerId;
-};
-
 interface LogStyle {
 	type: LogType;
 	variant: LogVariant;

apps/dokploy/components/dashboard/monitoring/free/container/show-free-container-monitoring.tsx

@@ -1,6 +1,5 @@
 import { formatMb } from "@dokploy/server/monitoring/units";
 import { useEffect, useState } from "react";
-import { toast } from "sonner";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Progress } from "@/components/ui/progress";
 import { api } from "@/utils/api";
@@ -168,8 +167,6 @@ export const ContainerFreeMonitoring = ({
 	}, [data]);
 
 	useEffect(() => {
-		if (!appName) return;
-
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
 		const wsUrl = `${protocol}//${window.location.host}/listen-docker-stats-monitoring?appName=${appName}&appType=${appType}`;
 		const ws = new WebSocket(wsUrl);
@@ -199,9 +196,7 @@ export const ContainerFreeMonitoring = ({
 		};
 
 		ws.onclose = (e) => {
-			if (e.reason) {
-				toast.error(e.reason);
-			}
+			console.log(e.reason);
 		};
 
 		return () => ws.close();

apps/dokploy/components/dashboard/monitoring/paid/servers/network-chart.tsx

@@ -19,11 +19,6 @@ interface NetworkChartProps {
 	data: any[];
 }
 
-function formatNetworkGB(valueInMB: number) {
-	if (Number.isNaN(valueInMB)) return "0";
-	return (valueInMB / 1024).toFixed(1);
-}
-
 const chartConfig = {
 	networkIn: {
 		label: "Network In",
@@ -43,8 +38,8 @@ export function NetworkChart({ data }: NetworkChartProps) {
 			<CardHeader className="border-b py-5">
 				<CardTitle>Network</CardTitle>
 				<CardDescription>
-					Network Total: ↑ {formatNetworkGB(latestData.networkOut)} GB ↓{" "}
-					{formatNetworkGB(latestData.networkIn)} GB (since Boot)
+					Network Traffic: ↑ {latestData.networkOut} KB/s ↓{" "}
+					{latestData.networkIn} KB/s
 				</CardDescription>
 			</CardHeader>
 			<CardContent className="px-2 pt-4 sm:px-6 sm:pt-6">
@@ -88,7 +83,7 @@ export function NetworkChart({ data }: NetworkChartProps) {
 							minTickGap={32}
 							tickFormatter={(value) => formatTimestamp(value)}
 						/>
-						<YAxis tickFormatter={(value) => `${formatNetworkGB(value)} GB`} />
+						<YAxis tickFormatter={(value) => `${value} KB/s`} />
 						<ChartTooltip
 							cursor={false}
 							content={({ active, payload, label }) => {
@@ -110,8 +105,8 @@ export function NetworkChart({ data }: NetworkChartProps) {
 														Network
 													</span>
 													<span className="font-bold">
-														↑ {formatNetworkGB(data.networkOut)} GB
-														<br />↓ {formatNetworkGB(data.networkIn)} GB
+														↑ {data.networkOut} KB/s
+														<br />↓ {data.networkIn} KB/s
 													</span>
 												</div>
 											</div>

apps/dokploy/components/dashboard/networks/sync-networks.tsx

@@ -34,7 +34,6 @@ export const SyncNetworks = ({ serverId }: Props) => {
 	const importMutation = api.network.import.useMutation();
 	const removeMutation = api.network.remove.useMutation();
 	const recreateMutation = api.network.recreate.useMutation();
-	const resyncMutation = api.network.resync.useMutation();
 
 	const toggleSelected = (name: string) => {
 		setSelected((prev) => {
@@ -103,20 +102,6 @@ export const SyncNetworks = ({ serverId }: Props) => {
 		}
 	};
 
-	const onResync = async (networkId: string, name: string) => {
-		try {
-			await resyncMutation.mutateAsync({ networkId });
-			toast.success(`Network "${name}" updated from Docker`);
-			await utils.network.all.invalidate();
-			await utils.network.networksToSync.invalidate();
-			await refetch();
-		} catch (error) {
-			toast.error("Error updating network", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
 	return (
 		<Dialog
 			open={open}
@@ -192,45 +177,6 @@ export const SyncNetworks = ({ serverId }: Props) => {
 							)}
 						</div>
 
-						{!!data?.changed.length && (
-							<>
-								<Separator />
-								<div className="flex flex-col gap-2">
-									<span className="text-sm font-medium">
-										Changed ({data.changed.length})
-									</span>
-									<span className="text-xs text-muted-foreground">
-										These networks were deleted and recreated in Docker under
-										the same name — attributes in Dokploy are outdated.
-									</span>
-									{data.changed.map((changed) => (
-										<div
-											key={changed.networkId}
-											className="flex items-center justify-between gap-3 rounded-lg border border-dashed p-3"
-										>
-											<div className="flex items-center gap-3">
-												<span className="text-sm">{changed.name}</span>
-												{changed.driver && (
-													<Badge variant="outline">{changed.driver}</Badge>
-												)}
-											</div>
-											<Button
-												variant="outline"
-												size="xs"
-												isLoading={resyncMutation.isPending}
-												onClick={() =>
-													onResync(changed.networkId, changed.name)
-												}
-											>
-												<RotateCcw className="size-3.5" />
-												Update
-											</Button>
-										</div>
-									))}
-								</div>
-							</>
-						)}
-
 						{!!data?.missing.length && (
 							<>
 								<Separator />

apps/dokploy/components/dashboard/organization/handle-organization.tsx

@@ -48,7 +48,6 @@ export function AddOrganization({ organizationId }: Props) {
 		},
 		{
 			enabled: !!organizationId,
-			refetchOnWindowFocus: false,
 		},
 	);
 	const { mutateAsync, isPending } = organizationId

apps/dokploy/components/dashboard/settings/servers/show-servers.tsx

@@ -250,30 +250,29 @@ export const ShowServers = () => {
 																			</div>
 
 																			<TooltipProvider>
-																				{server.sshKeyId &&
-																					permissions?.server.terminal && (
-																						<Tooltip>
-																							<TooltipTrigger asChild>
-																								<div>
-																									<TerminalModal
-																										serverId={server.serverId}
-																										asButton={true}
+																				{server.sshKeyId && (
+																					<Tooltip>
+																						<TooltipTrigger asChild>
+																							<div>
+																								<TerminalModal
+																									serverId={server.serverId}
+																									asButton={true}
+																								>
+																									<Button
+																										variant="outline"
+																										size="icon"
+																										className="h-9 w-9"
 																									>
-																										<Button
-																											variant="outline"
-																											size="icon"
-																											className="h-9 w-9"
-																										>
-																											<Terminal className="h-4 w-4" />
-																										</Button>
-																									</TerminalModal>
-																								</div>
-																							</TooltipTrigger>
-																							<TooltipContent>
-																								<p>Terminal</p>
-																							</TooltipContent>
-																						</Tooltip>
-																					)}
+																										<Terminal className="h-4 w-4" />
+																									</Button>
+																								</TerminalModal>
+																							</div>
+																						</TooltipTrigger>
+																						<TooltipContent>
+																							<p>Terminal</p>
+																						</TooltipContent>
+																					</Tooltip>
+																				)}
 
 																				<Tooltip>
 																					<TooltipTrigger asChild>

apps/dokploy/components/dashboard/settings/users/show-users.tsx

@@ -35,7 +35,7 @@ import { ChangeRole } from "./change-role";
 export const ShowUsers = () => {
 	const { data: isCloud } = api.settings.isCloud.useQuery();
 	const { data, isPending, refetch } = api.user.all.useQuery();
-	const { mutateAsync, isPending: isRemoving } = api.user.remove.useMutation();
+	const { mutateAsync } = api.user.remove.useMutation();
 	const { data: permissions } = api.user.getPermissions.useQuery();
 	const { data: hasValidLicense } =
 		api.licenseKey.haveValidLicenseKey.useQuery();
@@ -237,7 +237,6 @@ export const ShowUsers = () => {
 																					title="Delete User"
 																					description="Are you sure you want to delete this user?"
 																					type="destructive"
-																					disabled={isRemoving}
 																					onClick={async () => {
 																						await mutateAsync({
 																							userId: member.user.id,
@@ -270,7 +269,6 @@ export const ShowUsers = () => {
 																					title="Unlink User"
 																					description="Are you sure you want to unlink this user?"
 																					type="destructive"
-																					disabled={isRemoving}
 																					onClick={async () => {
 																						if (!isCloud) {
 																							const orgCount =

apps/dokploy/components/proprietary/roles/manage-custom-roles.tsx

@@ -328,10 +328,6 @@ const ACTION_META: Record<
 			label: "Delete",
 			description: "Remove servers from the organization",
 		},
-		terminal: {
-			label: "Terminal",
-			description: "Open an SSH root shell on remote servers",
-		},
 	},
 	registry: {
 		read: { label: "Read", description: "View configured Docker registries" },
@@ -573,7 +569,7 @@ const ROLE_PRESETS: {
 			envVars: ["read", "write"],
 			projectEnvVars: ["read", "write"],
 			environmentEnvVars: ["read", "write"],
-			server: ["read", "create", "delete", "terminal"],
+			server: ["read", "create", "delete"],
 			registry: ["read", "create", "delete"],
 			certificate: ["read", "create", "delete"],
 			backup: ["read", "create", "delete", "restore"],

apps/dokploy/drizzle/0186_tearful_dragon_man.sql

@@ -1 +0,0 @@
-ALTER TABLE "network" ADD COLUMN "dockerId" text;

apps/dokploy/drizzle/0187_grant_terminal_permission_to_read_roles.sql

@@ -1,13 +0,0 @@
--- Grant the new "server.terminal" permission to existing custom roles that already have
--- "server.read", which is the permission that surfaces the terminal in the UI today.
--- Roles without a "server" entry are deliberately left alone: they never saw the terminal in the
--- UI, so from now on they are denied at the websocket too.
-UPDATE "organization_role" AS r
-SET "permission" = jsonb_set(
-	r."permission"::jsonb,
-	'{server}',
-	(r."permission"::jsonb->'server') || '["terminal"]'::jsonb
-)::text
-WHERE jsonb_typeof(r."permission"::jsonb->'server') = 'array'
-AND r."permission"::jsonb->'server' @> '["read"]'::jsonb
-AND NOT r."permission"::jsonb->'server' @> '["terminal"]'::jsonb;

apps/dokploy/drizzle/meta/_journal.json

@@ -1303,20 +1303,6 @@
       "when": 1786526512677,
       "tag": "0185_needy_kingpin",
       "breakpoints": true
-    },
-    {
-      "idx": 186,
-      "version": "7",
-      "when": 1787813846067,
-      "tag": "0186_tearful_dragon_man",
-      "breakpoints": true
-    },
-    {
-      "idx": 187,
-      "version": "7",
-      "when": 1787937580323,
-      "tag": "0187_grant_terminal_permission_to_read_roles",
-      "breakpoints": true
     }
   ]
 }

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.30.2",
+	"version": "v0.30.1",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",

apps/dokploy/pages/api/[...trpc].ts

@@ -1,8 +1,4 @@
-import {
-	OPENAPI_MAX_JSON_BODY_SIZE,
-	OPENAPI_MAX_UPLOAD_SIZE,
-	validateRequest,
-} from "@dokploy/server";
+import { validateRequest } from "@dokploy/server";
 import { createOpenApiNextHandler } from "@dokploy/trpc-openapi";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { appRouter } from "@/server/api/root";
@@ -16,31 +12,10 @@ const handler = async (req: NextApiRequest, res: NextApiResponse) => {
 		return;
 	}
 
-	// getMultipartBody doesn't accept maxBodySize, so we cap it here instead.
-	const contentLength = Number(req.headers["content-length"]);
-	const isMultipart = req.headers["content-type"]?.startsWith(
-		"multipart/form-data",
-	);
-
-	if (isMultipart && !Number.isFinite(contentLength)) {
-		res.status(411).json({ message: "Content-Length required" });
-		return;
-	}
-
-	const limit = isMultipart
-		? OPENAPI_MAX_UPLOAD_SIZE
-		: OPENAPI_MAX_JSON_BODY_SIZE;
-
-	if (Number.isFinite(contentLength) && contentLength > limit) {
-		res.status(413).json({ message: "Payload too large" });
-		return;
-	}
-
 	// @ts-ignore
 	return createOpenApiNextHandler({
 		router: appRouter,
 		createContext: createTRPCContext,
-		maxBodySize: OPENAPI_MAX_JSON_BODY_SIZE,
 		onError:
 			process.env.NODE_ENV === "development"
 				? ({ path, error }: { path: string | undefined; error: Error }) => {
@@ -53,9 +28,3 @@ const handler = async (req: NextApiRequest, res: NextApiResponse) => {
 };
 
 export default handler;
-
-export const config = {
-	api: {
-		bodyParser: false,
-	},
-};

apps/dokploy/server/api/routers/compose.ts

@@ -1,4 +1,3 @@
-import { join } from "node:path";
 import {
 	addDomainToCompose,
 	clearOldDeployments,
@@ -33,7 +32,6 @@ import {
 	updateCompose,
 	updateDeploymentStatus,
 } from "@dokploy/server";
-import { paths } from "@dokploy/server/constants";
 import { db } from "@dokploy/server/db";
 import { canEditDeployGitSource } from "@dokploy/server/services/git-provider";
 import {
@@ -549,9 +547,7 @@ export const composeRouter = createTRPCRouter({
 				service: ["create"],
 			});
 			const compose = await findComposeById(input.composeId);
-			const { COMPOSE_PATH } = paths(!!compose.serverId);
-			const projectPath = join(COMPOSE_PATH, compose.appName, "code");
-			const command = createCommand(compose, projectPath);
+			const command = createCommand(compose);
 			return `docker ${command}`;
 		}),
 	refreshToken: protectedProcedure

apps/dokploy/server/api/routers/domain.ts

@@ -7,7 +7,6 @@ import {
 	findPreviewDeploymentById,
 	findServerById,
 	generateTraefikMeDomain,
-	getServerIpCandidates,
 	getWebServerSettings,
 	manageDomain,
 	removeDomain,
@@ -249,21 +248,10 @@ export const domainRouter = createTRPCRouter({
 		.input(
 			z.object({
 				domain: z.string(),
-				serverId: z.string().optional(),
+				serverIp: z.string().optional(),
 			}),
 		)
-		.mutation(async ({ input, ctx }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
-
-			const expectedIps = await getServerIpCandidates(input.serverId);
-			return validateDomain(input.domain, expectedIps);
+		.mutation(async ({ input }) => {
+			return validateDomain(input.domain, input.serverIp);
 		}),
 });

apps/dokploy/server/api/routers/network.ts

@@ -6,7 +6,6 @@ import {
 	inspectNetwork,
 	recreateNetwork,
 	removeNetwork,
-	resyncNetwork,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
 import { and, desc, eq, isNull } from "drizzle-orm";
@@ -130,29 +129,6 @@ export const networkRouter = createTRPCRouter({
 			return recreated;
 		}),
 
-	resync: protectedProcedure
-		.input(apiFindOneNetwork)
-		.mutation(async ({ ctx, input }) => {
-			const network = await findNetworkById(input.networkId);
-			if (network.organizationId !== ctx.session.activeOrganizationId) {
-				throw new TRPCError({
-					code: "NOT_FOUND",
-					message: "Network not found",
-				});
-			}
-			const resynced = await resyncNetwork(
-				input.networkId,
-				ctx.session.activeOrganizationId,
-			);
-			await audit(ctx, {
-				action: "update",
-				resourceType: "network",
-				resourceId: resynced.networkId,
-				resourceName: resynced.name,
-			});
-			return resynced;
-		}),
-
 	remove: protectedProcedure
 		.input(apiRemoveNetwork)
 		.mutation(async ({ ctx, input }) => {

apps/dokploy/server/wss/authorize.ts

@@ -62,8 +62,7 @@ export const canAccessDockerOverWss = async (
 
 // Authorizes the host/server SSH terminal opened over a WebSocket. The local
 // host terminal is a root shell on the control-plane host, so it is restricted
-// to owner/admin. A remote server terminal needs server access plus
-// server.terminal.
+// to owner/admin. A remote server terminal is gated on server access.
 export const canAccessTerminalOverWss = async (
 	user: WssUser,
 	session: WssSession,
@@ -76,11 +75,7 @@ export const canAccessTerminalOverWss = async (
 			userId: user.id,
 			activeOrganizationId: session.activeOrganizationId,
 		});
-		if (!accessible.has(serverId)) return false;
-
-		return await hasPermission(buildCtx(user, session.activeOrganizationId), {
-			server: ["terminal"],
-		});
+		return accessible.has(serverId);
 	}
 
 	try {

apps/dokploy/server/wss/docker-container-terminal.ts

@@ -182,10 +182,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 				ptyProcess.onData((data) => {
 					ws.send(data);
 				});
-				ptyProcess.onExit(({ exitCode }) => {
-					ws.send(`\nContainer closed with code: ${exitCode}\n`);
-					ws.close();
-				});
 				ws.on("close", () => {
 					ptyProcess.kill();
 				});

apps/dokploy/server/wss/docker-stats.ts

@@ -8,57 +8,9 @@ import {
 	recordAdvancedStats,
 	validateRequest,
 } from "@dokploy/server";
-import { quote } from "shell-quote";
 import { WebSocketServer } from "ws";
 import { canAccessDockerOverWss } from "./authorize";
 
-type AppType = "application" | "stack" | "docker-compose";
-
-// Swarm task names are "<service>.<slot>.<taskId>"; the manager's local
-// `docker ps` only sees containers scheduled on this host, so a task running
-// on another node looks identical to a stopped one. `docker service ps` is
-// swarm-aggregated and answers from the manager regardless of which node the
-// task landed on, so we use it here to tell the two cases apart.
-const findRemoteSwarmNode = async (
-	appName: string,
-	appType: AppType,
-): Promise<string | null> => {
-	if (appType === "docker-compose") {
-		return null;
-	}
-
-	// `docker service ps --format {{.Name}}` only prints "<service>.<slot>",
-	// never the taskId, so we match on the task ID instead — the last segment
-	// of the stack task name — rather than trying to reconstruct the full name.
-	const [serviceName, taskId] =
-		appType === "stack"
-			? [appName.split(".").slice(0, -2).join("."), appName.split(".").pop()]
-			: [appName, null];
-
-	if (!serviceName) {
-		return null;
-	}
-
-	try {
-		const { stdout } = await execAsync(
-			`docker service ps ${quote([serviceName])} --filter "desired-state=running" --no-trunc --format '{"ID":"{{.ID}}","Node":"{{.Node}}","CurrentState":"{{.CurrentState}}"}'`,
-		);
-
-		for (const line of stdout.trim().split("\n")) {
-			if (!line) continue;
-			const task = JSON.parse(line);
-			const isMatch = taskId ? task.ID === taskId : true;
-			if (isMatch && task.CurrentState?.startsWith("Running")) {
-				return task.Node;
-			}
-		}
-	} catch {
-		// Not a swarm service (or the swarm CLI isn't available) — fall back to "not running".
-	}
-
-	return null;
-};
-
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
 ) => {
@@ -146,13 +98,7 @@ export const setupDockerStatsMonitoringSocketServer = (
 
 				const container = containers[0];
 				if (!container || container?.State !== "running") {
-					const remoteNode = await findRemoteSwarmNode(appName, appType);
-					ws.close(
-						4000,
-						remoteNode
-							? `Container running on remote node "${remoteNode}"`.slice(0, 123)
-							: "Container not running",
-					);
+					ws.close(4000, "Container not running");
 					return;
 				}
 				const { stdout, stderr } = await execAsync(

packages/server/src/constants/index.ts

@@ -13,28 +13,6 @@ export const DOKPLOY_DOCKER_PORT = process.env.DOKPLOY_DOCKER_PORT
 
 export const CLEANUP_CRON_JOB = "50 23 * * *";
 
-// Body size limits for the OpenAPI catch-all route (pages/api/[...trpc].ts).
-const parseByteSize = (envVar: string, fallback: number): number => {
-	const raw = process.env[envVar];
-	if (!raw) return fallback;
-	const parsed = Number(raw);
-	if (!Number.isInteger(parsed) || parsed <= 0) {
-		console.warn(`Invalid ${envVar}="${raw}", using default ${fallback}`);
-		return fallback;
-	}
-	return parsed;
-};
-
-export const OPENAPI_MAX_JSON_BODY_SIZE = parseByteSize(
-	"OPENAPI_MAX_JSON_BODY_SIZE",
-	10 * 1024 * 1024, // 10mb
-);
-
-export const OPENAPI_MAX_UPLOAD_SIZE = parseByteSize(
-	"OPENAPI_MAX_UPLOAD_SIZE",
-	1024 * 1024 * 1024, // 1gb
-);
-
 type DockerSocketCandidate = {
 	label: string;
 	path: string;

packages/server/src/db/schema/network.ts

@@ -21,7 +21,6 @@ export const network = pgTable("network", {
 		.primaryKey()
 		.$defaultFn(() => nanoid()),
 	name: text("name").notNull(),
-	dockerId: text("dockerId"),
 	driver: networkDriver("driver").notNull().default("bridge"),
 	internal: boolean("internal").notNull().default(false),
 	attachable: boolean("attachable").notNull().default(false),

packages/server/src/lib/access-control.ts

@@ -35,7 +35,7 @@ export const statements = {
 	envVars: ["read", "write"],
 	projectEnvVars: ["read", "write"],
 	environmentEnvVars: ["read", "write"],
-	server: ["read", "create", "delete", "terminal"],
+	server: ["read", "create", "delete"],
 	registry: ["read", "create", "delete"],
 	certificate: ["read", "create", "update", "delete"],
 	backup: ["read", "create", "update", "delete", "restore"],
@@ -104,7 +104,7 @@ export const ownerRole = ac.newRole({
 	envVars: ["read", "write"],
 	projectEnvVars: ["read", "write"],
 	environmentEnvVars: ["read", "write"],
-	server: ["read", "create", "delete", "terminal"],
+	server: ["read", "create", "delete"],
 	registry: ["read", "create", "delete"],
 	certificate: ["read", "create", "update", "delete"],
 	backup: ["read", "create", "update", "delete", "restore"],
@@ -143,7 +143,7 @@ export const adminRole = ac.newRole({
 	envVars: ["read", "write"],
 	projectEnvVars: ["read", "write"],
 	environmentEnvVars: ["read", "write"],
-	server: ["read", "create", "delete", "terminal"],
+	server: ["read", "create", "delete"],
 	registry: ["read", "create", "delete"],
 	certificate: ["read", "create", "update", "delete"],
 	backup: ["read", "create", "update", "delete", "restore"],

packages/server/src/services/domain.ts

@@ -3,9 +3,7 @@ import { promisify } from "node:util";
 import { db } from "@dokploy/server/db";
 import { getWebServerSettings } from "@dokploy/server/services/web-server-settings";
 import { generateRandomDomain } from "@dokploy/server/templates";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { manageDomain } from "@dokploy/server/utils/traefik/domain";
-import { getPublicIpWithFallback } from "@dokploy/server/wss/utils";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import type { z } from "zod";
@@ -156,7 +154,7 @@ const resolveDns = promisify(dns.resolve4);
 
 export const validateDomain = async (
 	domain: string,
-	expectedIps?: string[],
+	expectedIp?: string,
 ): Promise<{
 	isValid: boolean;
 	resolvedIp?: string;
@@ -188,13 +186,13 @@ export const validateDomain = async (
 			};
 		}
 
-		if (expectedIps && expectedIps.length > 0) {
-			const isValid = resolvedIps.some((ip) => expectedIps.includes(ip));
+		// If we have an expected IP, validate against it
+		if (expectedIp) {
 			return {
-				isValid,
+				isValid: resolvedIps.includes(expectedIp),
 				resolvedIp: resolvedIps.join(", "),
-				error: !isValid
-					? `Domain resolves to ${resolvedIps.join(", ")} but should point to ${expectedIps.join(" or ")}`
+				error: !resolvedIps.includes(expectedIp)
+					? `Domain resolves to ${resolvedIps.join(", ")} but should point to ${expectedIp}`
 					: undefined,
 			};
 		}
@@ -212,47 +210,3 @@ export const validateDomain = async (
 		};
 	}
 };
-
-export const getServerIpCandidates = async (
-	serverId?: string | null,
-): Promise<string[]> => {
-	const candidates = new Set<string>();
-
-	if (serverId) {
-		const server = await findServerById(serverId);
-		if (server.ipAddress) {
-			candidates.add(server.ipAddress);
-		}
-
-		const publicIp = await withTimeout(
-			execAsyncRemote(
-				serverId,
-				"curl -s -m 5 https://ifconfig.me || curl -s -m 5 https://icanhazip.com",
-			),
-			7000,
-		);
-		const detectedIp = publicIp?.stdout?.trim();
-		if (detectedIp) {
-			candidates.add(detectedIp);
-		}
-	} else {
-		const settings = await getWebServerSettings();
-		if (settings?.serverIp) {
-			candidates.add(settings.serverIp);
-		}
-
-		const publicIp = await withTimeout(getPublicIpWithFallback(), 7000);
-		if (publicIp) {
-			candidates.add(publicIp);
-		}
-	}
-
-	return Array.from(candidates);
-};
-
-const withTimeout = <T>(promise: Promise<T>, ms: number): Promise<T | null> => {
-	return Promise.race([
-		promise,
-		new Promise<null>((resolve) => setTimeout(() => resolve(null), ms)),
-	]).catch(() => null);
-};

packages/server/src/services/mount.ts

@@ -262,28 +262,18 @@ export const updateFileMount = async (mountId: string) => {
 	if (!mount || !mount.filePath) return;
 	const basePath = await getBaseFilesPath(mountId);
 	const fullPath = path.join(basePath, mount.filePath);
-	const directory = path.dirname(fullPath);
 
 	try {
 		const serverId = await getServerId(mount);
 		const encodedContent = encodeBase64(mount.content || "");
-		const command = `
-			mkdir -p ${quote([directory])};
-			if [ -d ${quote([fullPath])} ]; then rm -rf ${quote([fullPath])}; fi;
-			echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
-		`;
+		const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`;
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
 		} else {
 			await execAsync(command);
 		}
-	} catch (error) {
-		console.log(`Error updating the file mount: ${error}`);
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message: `Error updating the mount ${error instanceof Error ? error.message : error}`,
-			cause: error,
-		});
+	} catch {
+		console.log("Error updating file mount");
 	}
 };
 

packages/server/src/services/network.ts

@@ -1,7 +1,6 @@
 import { db } from "@dokploy/server/db";
 import { type apiCreateNetwork, network } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
-import type Dockerode from "dockerode";
 import { and, eq, inArray, isNull } from "drizzle-orm";
 import type { z } from "zod";
 import { IS_CLOUD } from "../constants";
@@ -18,7 +17,6 @@ const RESERVED_NETWORKS = [
 ];
 
 type DockerNetworkInfo = {
-	Id?: string;
 	Name: string;
 	Driver: string;
 	Internal?: boolean;
@@ -37,12 +35,6 @@ type DockerNetworkInfo = {
 	};
 };
 
-// EnableIPv4 is missing from dockerode's NetworkCreateOptions but supported
-// by the daemon (API >= 1.47); the body is sent as-is
-type NetworkCreateOptions = Dockerode.NetworkCreateOptions & {
-	EnableIPv4?: boolean;
-};
-
 const parseMtu = (value: string | undefined) => {
 	const mtu = Number.parseInt(value ?? "", 10);
 	return Number.isNaN(mtu) ? null : mtu;
@@ -59,7 +51,6 @@ const mapDockerNetworkToRow = (
 	serverId: string | null,
 ) => ({
 	name: dockerNetwork.Name,
-	dockerId: dockerNetwork.Id ?? null,
 	driver: dockerNetwork.Driver as "bridge" | "overlay",
 	internal: dockerNetwork.Internal ?? false,
 	attachable: dockerNetwork.Attachable ?? false,
@@ -119,7 +110,7 @@ export const findNetworksToSync = async (
 
 	const existing = await findNetworksByServer(organizationId, serverId);
 	const existingNames = new Set(existing.map((row) => row.name));
-	const dockerByName = new Map(dockerNetworks.map((d) => [d.Name, d] as const));
+	const dockerNames = new Set(dockerNetworks.map((d) => d.Name));
 
 	const importable = dockerNetworks
 		.filter(
@@ -137,28 +128,12 @@ export const findNetworksToSync = async (
 				.filter((s): s is string => !!s),
 		}));
 
+	// Rows in Dokploy whose network no longer exists in Docker
 	const missing = existing
-		.filter((row) => !dockerByName.has(row.name))
+		.filter((row) => !dockerNames.has(row.name))
 		.map((row) => ({ networkId: row.networkId, name: row.name }));
 
-	const changed = existing
-		.filter((row) => {
-			if (!row.dockerId) return false;
-			const dockerNetwork = dockerByName.get(row.name);
-			return !!dockerNetwork?.Id && dockerNetwork.Id !== row.dockerId;
-		})
-		.map((row) => {
-			const dockerNetwork = dockerByName.get(row.name);
-			return {
-				networkId: row.networkId,
-				name: row.name,
-				driver: dockerNetwork?.Driver,
-				internal: dockerNetwork?.Internal ?? false,
-				attachable: dockerNetwork?.Attachable ?? false,
-			};
-		});
-
-	return { importable, missing, changed };
+	return { importable, missing };
 };
 
 export const importDockerNetworks = async (
@@ -209,49 +184,6 @@ export const importDockerNetworks = async (
 	return { imported, errors };
 };
 
-export const resyncNetwork = async (
-	networkId: string,
-	organizationId: string,
-) => {
-	const row = await findNetworkById(networkId);
-	if (row.organizationId !== organizationId) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Network not found",
-		});
-	}
-
-	const docker = await getRemoteDocker(row.serverId ?? null);
-	let info: DockerNetworkInfo;
-	try {
-		info = (await docker.getNetwork(row.name).inspect()) as DockerNetworkInfo;
-	} catch (error) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message:
-				error instanceof Error
-					? error.message
-					: "Failed to inspect Docker network",
-			cause: error,
-		});
-	}
-
-	const [updated] = await db
-		.update(network)
-		.set(mapDockerNetworkToRow(info, organizationId, row.serverId))
-		.where(eq(network.networkId, networkId))
-		.returning();
-
-	if (!updated) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Network not found",
-		});
-	}
-
-	return updated;
-};
-
 export const findNetworkById = async (networkId: string) => {
 	const [row] = await db
 		.select()
@@ -320,12 +252,14 @@ const createDockerNetworkFromRow = async (row: typeof network.$inferSelect) => {
 
 	const docker = await getRemoteDocker(row.serverId ?? null);
 	try {
-		const createOptions: NetworkCreateOptions = {
+		await docker.createNetwork({
 			Name: row.name,
 			Driver: row.driver,
 			CheckDuplicate: true,
 			Internal: row.internal,
 			Attachable: row.attachable,
+			// EnableIPv4 is missing from dockerode's types but supported by
+			// the daemon (API >= 1.47); the body is sent as-is
 			EnableIPv4: row.enableIPv4,
 			EnableIPv6: row.enableIPv6,
 			Options: row.mtu
@@ -335,13 +269,7 @@ const createDockerNetworkFromRow = async (row: typeof network.$inferSelect) => {
 				Driver: ipam.driver || "default",
 				Config: ipamConfig.length > 0 ? ipamConfig : undefined,
 			},
-		};
-		const created = await docker.createNetwork(createOptions);
-
-		await db
-			.update(network)
-			.set({ dockerId: created.id })
-			.where(eq(network.networkId, row.networkId));
+		} as Parameters<typeof docker.createNetwork>[0]);
 	} catch (error) {
 		throw new TRPCError({
 			code: "BAD_REQUEST",

packages/server/src/services/settings.ts

@@ -485,7 +485,7 @@ export const reconnectServicesToTraefik = async (serverId?: string) => {
 		),
 	});
 
-	if (composeResult.length === 0) {
+	if (!composeResult) {
 		return;
 	}
 	let commands = "";

packages/server/src/setup/monitoring-setup.ts

@@ -21,31 +21,11 @@ const getMonitoringImage = () => {
 	return imageName;
 };
 
-// Swarm tasks are dokploy-monitoring.<slot>.<id>, so this only matches the
-// pre-v0.30.0 standalone container. A cleanup failure must not block the deploy.
-const removeLegacyContainer = async (
-	docker: Awaited<ReturnType<typeof getRemoteDocker>>,
-	serviceName: string,
-) => {
-	try {
-		await docker.getContainer(serviceName).remove({ force: true });
-		console.log("Removed legacy monitoring container ✅");
-	} catch (error: any) {
-		if (error?.statusCode !== 404) {
-			console.warn(
-				`Could not remove legacy monitoring container: ${error?.message ?? error}`,
-			);
-		}
-	}
-};
-
 const deployMonitoringService = async (
 	docker: Awaited<ReturnType<typeof getRemoteDocker>>,
 	serviceName: string,
 	settings: CreateServiceOptions,
 ) => {
-	await removeLegacyContainer(docker, serviceName);
-
 	try {
 		const service = docker.getService(serviceName);
 		const inspect = await service.inspect();

packages/server/src/setup/server-audit.ts

@@ -6,7 +6,7 @@ const validateUfw = () => `
   if command -v ufw >/dev/null 2>&1; then
     isInstalled=true
     isActive=$(sudo ufw status | grep -q "Status: active" && echo true || echo false)
-    defaultIncoming=$(sudo ufw status verbose | grep "Default:" | grep "incoming" | awk '{print $2}' | head -n1 | tr -d '\\r')
+    defaultIncoming=$(sudo ufw status verbose | grep "Default:" | grep "incoming" | awk '{print $2}')
     echo "{\\"installed\\": $isInstalled, \\"active\\": $isActive, \\"defaultIncoming\\": \\"$defaultIncoming\\"}"
   else
     echo "{\\"installed\\": false, \\"active\\": false, \\"defaultIncoming\\": \\"unknown\\"}"
@@ -27,7 +27,7 @@ const validateSsh = () => `
     
     # Check for key authentication
     # SSH key auth is enabled by default unless explicitly disabled
-    pubkey_line=$(sudo grep -i "^PubkeyAuthentication" "$sshd_config" 2>/dev/null | grep -v "#" | head -n1)
+    pubkey_line=$(sudo grep -i "^PubkeyAuthentication" "$sshd_config" 2>/dev/null | grep -v "#")
     if [ -z "$pubkey_line" ] || echo "$pubkey_line" | grep -q -i "yes"; then
       keyAuth=true
     else
@@ -36,21 +36,21 @@ const validateSsh = () => `
     
     # Get the exact PermitRootLogin value from config
     # This preserves values like "prohibit-password" without normalization
-    permitRootLogin=$(sudo grep -i "^PermitRootLogin" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}' | head -n1 | tr -d '\\r')
+    permitRootLogin=$(sudo grep -i "^PermitRootLogin" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}')
     if [ -z "$permitRootLogin" ]; then
       # Default is prohibit-password in newer versions
       permitRootLogin="prohibit-password"
     fi
     
     # Get the exact PasswordAuthentication value from config
-    passwordAuth=$(sudo grep -i "^PasswordAuthentication" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}' | head -n1 | tr -d '\\r')
+    passwordAuth=$(sudo grep -i "^PasswordAuthentication" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}')
     if [ -z "$passwordAuth" ]; then
       # Default is yes
       passwordAuth="yes"
     fi
     
     # Get the exact UsePAM value from config
-    usePam=$(sudo grep -i "^UsePAM" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}' | head -n1 | tr -d '\\r')
+    usePam=$(sudo grep -i "^UsePAM" "$sshd_config" 2>/dev/null | grep -v "#" | awk '{print $2}')
     if [ -z "$usePam" ]; then
       # Default is yes in most distros
       usePam="yes"

packages/server/src/setup/server-setup.ts

@@ -86,7 +86,6 @@ export const serverSetup = async (
 						...server.metricsConfig.server,
 						token: token,
 						urlCallback: urlCallback,
-						cronJob: server.metricsConfig.server.cronJob || "0 0 * * *",
 					},
 					containers: server.metricsConfig.containers,
 				},

packages/server/src/utils/builders/compose.ts

@@ -21,11 +21,11 @@ export const getBuildComposeCommand = async (rawCompose: ComposeNested) => {
 	const compose = await withResolvedVaultRefs(rawCompose);
 	const { COMPOSE_PATH } = paths(!!compose.serverId);
 	const { sourceType, appName, mounts, composeType, domains } = compose;
-	const projectPath = join(COMPOSE_PATH, compose.appName, "code");
-	const command = createCommand(compose, projectPath);
+	const command = createCommand(compose);
 	const envCommand = compose.createEnvFile
 		? getCreateEnvFileCommand(compose)
 		: "";
+	const projectPath = join(COMPOSE_PATH, compose.appName, "code");
 	const exportEnvCommand = getExportEnvCommand(compose);
 
 	const newCompose = await writeDomainsToCompose(compose, domains);
@@ -119,7 +119,7 @@ const sanitizeCommand = (command: string) => {
 	return restCommand.join(" ");
 };
 
-export const createCommand = (compose: ComposeNested, projectPath?: string) => {
+export const createCommand = (compose: ComposeNested) => {
 	const { composeType, appName, sourceType } = compose;
 	if (compose.command) {
 		return `${sanitizeCommand(compose.command)}`;
@@ -130,10 +130,7 @@ export const createCommand = (compose: ComposeNested, projectPath?: string) => {
 	let command = "";
 
 	if (composeType === "docker-compose") {
-		const projectDirectoryFlag = projectPath
-			? `--project-directory ${quote([projectPath])} `
-			: "";
-		command = `compose -p ${quote([appName])} ${projectDirectoryFlag}-f ${quote([path])} up -d --build --remove-orphans`;
+		command = `compose -p ${quote([appName])} -f ${quote([path])} up -d --build --remove-orphans`;
 	} else if (composeType === "stack") {
 		command = `stack deploy -c ${quote([path])} ${quote([appName])} --prune --with-registry-auth`;
 	}

packages/server/src/utils/builders/railpack.ts

@@ -87,15 +87,7 @@ export const getRailpackCommand = (application: ApplicationNested) => {
 # Ensure we have a builder with containerd (isolated per build)
 
 export RAILPACK_VERSION=${application.railpackVersion}
-# use sudo for non-root so the install can write to /usr/local/bin
-if [ "$(id -u)" -eq 0 ]; then
-	SUDO_CMD=""
-elif sudo -n true 2>/dev/null; then
-	SUDO_CMD="sudo"
-else
-	SUDO_CMD=""
-fi
-$SUDO_CMD bash -c "$(curl -fsSL https://railpack.com/install.sh)"
+bash -c "$(curl -fsSL https://railpack.com/install.sh)"
 docker buildx create --name ${builderName} --driver docker-container || true
 
 echo "Preparing Railpack build plan..." ;

packages/server/src/utils/docker/utils.ts

@@ -548,7 +548,7 @@ export const prepareEnvironmentVariablesForFile = (
 		const escapedValue = value
 			.replace(/\\/g, "\\\\")
 			.replace(/"/g, '\\"')
-			.replace(/\$(?!\{[A-Za-z_][A-Za-z0-9_]*(?::?[-+?][^{}]*)?\})/g, "\\$");
+			.replace(/\$/g, "\\$");
 		return `${key}="${escapedValue}"`;
 	});
 };

packages/server/src/utils/traefik/application.ts

@@ -292,26 +292,6 @@ export const writeTraefikConfigRemote = async (
 	}
 };
 
-const isEmptyHttpRoutersAndServices = (traefikConfig: FileConfig) =>
-	Object.keys(traefikConfig.http?.routers || {}).length === 0 &&
-	Object.keys(traefikConfig.http?.services || {}).length === 0;
-
-export const writeAppTraefikConfig = async (
-	traefikConfig: FileConfig,
-	appName: string,
-	serverId?: string | null,
-) => {
-	if (isEmptyHttpRoutersAndServices(traefikConfig)) {
-		await removeTraefikConfig(appName, serverId);
-		return;
-	}
-	if (serverId) {
-		await writeTraefikConfigRemote(traefikConfig, appName, serverId);
-	} else {
-		writeTraefikConfig(traefikConfig, appName);
-	}
-};
-
 export const createServiceConfig = (
 	appName: string,
 	domain: Domain,

packages/server/src/utils/traefik/redirect.ts

@@ -3,7 +3,7 @@ import type { ApplicationNested } from "../builders";
 import {
 	loadOrCreateConfig,
 	loadOrCreateConfigRemote,
-	writeAppTraefikConfig,
+	writeTraefikConfig,
 	writeTraefikConfigRemote,
 } from "./application";
 import type { FileConfig } from "./file-types";
@@ -89,10 +89,11 @@ export const createRedirectMiddleware = async (
 
 	if (serverId) {
 		await writeTraefikConfigRemote(config, "middlewares", serverId);
+		await writeTraefikConfigRemote(appConfig, appName, serverId);
 	} else {
 		writeMiddleware(config);
+		writeTraefikConfig(appConfig, appName);
 	}
-	await writeAppTraefikConfig(appConfig, appName, serverId);
 };
 
 export const removeRedirectMiddleware = async (
@@ -123,8 +124,9 @@ export const removeRedirectMiddleware = async (
 
 	if (serverId) {
 		await writeTraefikConfigRemote(config, "middlewares", serverId);
+		await writeTraefikConfigRemote(appConfig, appName, serverId);
 	} else {
+		writeTraefikConfig(appConfig, appName);
 		writeMiddleware(config);
 	}
-	await writeAppTraefikConfig(appConfig, appName, serverId);
 };

packages/server/src/utils/traefik/security.ts

@@ -4,7 +4,7 @@ import type { ApplicationNested } from "../builders";
 import {
 	loadOrCreateConfig,
 	loadOrCreateConfigRemote,
-	writeAppTraefikConfig,
+	writeTraefikConfig,
 	writeTraefikConfigRemote,
 } from "./application";
 import type {
@@ -62,10 +62,11 @@ export const createSecurityMiddleware = async (
 	addMiddleware(appConfig, middlewareName);
 	if (serverId) {
 		await writeTraefikConfigRemote(config, "middlewares", serverId);
+		await writeTraefikConfigRemote(appConfig, appName, serverId);
 	} else {
+		writeTraefikConfig(appConfig, appName);
 		writeMiddleware(config);
 	}
-	await writeAppTraefikConfig(appConfig, appName, serverId);
 };
 
 export const removeSecurityMiddleware = async (
@@ -88,7 +89,6 @@ export const removeSecurityMiddleware = async (
 		appConfig = loadOrCreateConfig(appName);
 	}
 	const middlewareName = `auth-${appName}`;
-	let removedLastUser = false;
 
 	if (config.http?.middlewares) {
 		const currentMiddleware = config.http.middlewares[middlewareName];
@@ -106,7 +106,11 @@ export const removeSecurityMiddleware = async (
 					delete config.http.middlewares[middlewareName];
 				}
 				deleteMiddleware(appConfig, middlewareName);
-				removedLastUser = true;
+				if (serverId) {
+					await writeTraefikConfigRemote(appConfig, appName, serverId);
+				} else {
+					writeTraefikConfig(appConfig, appName);
+				}
 			}
 		}
 	}
@@ -116,9 +120,6 @@ export const removeSecurityMiddleware = async (
 	} else {
 		writeMiddleware(config);
 	}
-	if (removedLastUser) {
-		await writeAppTraefikConfig(appConfig, appName, serverId);
-	}
 };
 
 const isBasicAuthMiddleware = (

packages/server/src/utils/volume-backups/backup.ts

@@ -9,43 +9,6 @@ import {
 	normalizeS3Path,
 } from "../backups/utils";
 
-interface RestartSafeBackupCommandOptions {
-	stopCommand: string;
-	backupCommand: string;
-	startCommand: string;
-	uploadCommand: string;
-}
-
-export const createRestartSafeBackupCommand = ({
-	stopCommand,
-	backupCommand,
-	startCommand,
-	uploadCommand,
-}: RestartSafeBackupCommandOptions) => `
-	${stopCommand}
-	set +e
-	(
-		${backupCommand}
-	)
-	DOKPLOY_VOLUME_BACKUP_STATUS=$?
-	(
-		set -e
-		${startCommand}
-	)
-	DOKPLOY_VOLUME_RESTART_STATUS=$?
-	set -e
-	if [ "$DOKPLOY_VOLUME_BACKUP_STATUS" -ne 0 ]; then
-		if [ "$DOKPLOY_VOLUME_RESTART_STATUS" -ne 0 ]; then
-			echo "Service restart also failed with exit code $DOKPLOY_VOLUME_RESTART_STATUS"
-		fi
-		exit "$DOKPLOY_VOLUME_BACKUP_STATUS"
-	fi
-	if [ "$DOKPLOY_VOLUME_RESTART_STATUS" -ne 0 ]; then
-		exit "$DOKPLOY_VOLUME_RESTART_STATUS"
-	fi
-	${uploadCommand}
-`;
-
 export const getVolumeServiceAppName = (
 	volumeBackup: Awaited<ReturnType<typeof findVolumeBackupById>>,
 ): string => {
@@ -154,20 +117,16 @@ export const backupVolume = async (
 	);
 
 	if (serviceType === "application") {
-		return lockWrapper(
-			createRestartSafeBackupCommand({
-				stopCommand: `
-				echo "Stopping application to 0 replicas"
-				ACTUAL_REPLICAS=$(docker service inspect ${volumeBackup.application?.appName} --format "{{.Spec.Mode.Replicated.Replicas}}")
-				echo "Actual replicas: $ACTUAL_REPLICAS"
-				docker service update --replicas=0 ${volumeBackup.application?.appName}`,
-				backupCommand,
-				startCommand: `
-				echo "Starting application to $ACTUAL_REPLICAS replicas"
-				docker service update --replicas=$ACTUAL_REPLICAS --with-registry-auth ${volumeBackup.application?.appName}`,
-				uploadCommand,
-			}),
-		);
+		return lockWrapper(`
+		echo "Stopping application to 0 replicas"
+		ACTUAL_REPLICAS=$(docker service inspect ${volumeBackup.application?.appName} --format "{{.Spec.Mode.Replicated.Replicas}}")
+		echo "Actual replicas: $ACTUAL_REPLICAS"
+		docker service update --replicas=0 ${volumeBackup.application?.appName}
+        ${backupCommand}
+		echo "Starting application to $ACTUAL_REPLICAS replicas"
+        docker service update --replicas=$ACTUAL_REPLICAS --with-registry-auth ${volumeBackup.application?.appName}
+		${uploadCommand}
+  `);
 	}
 	if (serviceType === "compose") {
 		const compose = await findComposeById(
@@ -199,13 +158,11 @@ export const backupVolume = async (
 			echo "Compose container started"
 			`;
 		}
-		return lockWrapper(
-			createRestartSafeBackupCommand({
-				stopCommand,
-				backupCommand,
-				startCommand,
-				uploadCommand,
-			}),
-		);
+		return lockWrapper(`
+        ${stopCommand}
+        ${backupCommand}
+        ${startCommand}
+		${uploadCommand}
+  `);
 	}
 };

packages/server/src/utils/volume-backups/restore.ts

@@ -66,98 +66,38 @@ export const restoreVolume = async (
 			docker volume rm ${volumeName} --force
 			${baseRestoreCommand}
 		else
-			# Only "exited", "created" and "dead" are safe to remove. Anything else
-			# (running, restarting, paused, removing) is treated as still in use.
-			RUNNING_CONTAINERS=$(echo "$CONTAINERS_USING_VOLUME" | awk -F'|' '$3 != "exited" && $3 != "created" && $3 != "dead"')
-			STOPPED_CONTAINERS=$(echo "$CONTAINERS_USING_VOLUME" | awk -F'|' '$3 == "exited" || $3 == "created" || $3 == "dead"')
-
-			if [ -n "$RUNNING_CONTAINERS" ]; then
-				echo ""
-				echo "⚠️  WARNING: Cannot restore volume as it is currently in use!"
-				echo ""
-				echo "📋 The following containers are using volume '${volumeName}':"
-				echo ""
-
-				echo "$RUNNING_CONTAINERS" | while IFS='|' read container_id container_name container_state labels; do
-					echo "   🐳 Container: $container_name ($container_id)"
-					echo "      Status: $container_state"
-
-					# Determine container type
-					if echo "$labels" | grep -q "com.docker.swarm.service.name="; then
-						SERVICE_NAME=$(echo "$labels" | grep -o "com.docker.swarm.service.name=[^,]*" | cut -d'=' -f2)
-						echo "      Type: Docker Swarm Service ($SERVICE_NAME)"
-					elif echo "$labels" | grep -q "com.docker.compose.project="; then
-						PROJECT_NAME=$(echo "$labels" | grep -o "com.docker.compose.project=[^,]*" | cut -d'=' -f2)
-						echo "      Type: Docker Compose ($PROJECT_NAME)"
-					else
-						echo "      Type: Regular Container"
-					fi
-					echo ""
-				done
-
-				echo ""
-				echo "🔧 To restore this volume, please:"
-				echo "   1. Stop all containers/services using this volume"
-				echo "   2. Remove the existing volume: docker volume rm ${volumeName}"
-				echo "   3. Run the restore operation again"
-				echo ""
-				echo "❌ Volume restore aborted - volume is in use"
-
-				exit 1
-			fi
-
-			# Use a temp file instead of process substitution ("< <(...)") so this
-			# still works under a plain POSIX /bin/sh, not just bash.
-			STOPPED_CONTAINERS_FILE=$(mktemp)
-			printf '%s\\n' "$STOPPED_CONTAINERS" > "$STOPPED_CONTAINERS_FILE"
-
-			# Re-check each container's live state right before removing it: it may have
-			# started running again since the "docker ps -a" snapshot above.
-			ACTIVE_AGAIN=""
-			while IFS='|' read -r container_id container_name container_state labels; do
-				CURRENT_STATE=$(docker inspect -f '{{.State.Status}}' "$container_id" 2>/dev/null || echo "gone")
-				case "$CURRENT_STATE" in
-					running|restarting|paused|removing)
-						ACTIVE_AGAIN="$ACTIVE_AGAIN $container_name"
-						;;
-				esac
-			done < "$STOPPED_CONTAINERS_FILE"
-
-			if [ -n "$ACTIVE_AGAIN" ]; then
-				rm -f "$STOPPED_CONTAINERS_FILE"
-				echo ""
-				echo "⚠️  WARNING: Container(s)$ACTIVE_AGAIN became active again, aborting restore"
-				echo "❌ Volume restore aborted - volume is in use"
-				exit 1
-			fi
-
-			echo "Volume exists but is only referenced by stopped containers, removing them..."
 			echo ""
-
-			REMOVE_FAILED=""
-			while IFS='|' read -r container_id container_name container_state labels; do
-				echo "   🗑  Removing stopped container: $container_name ($container_id) [status: $container_state]"
-				if ! docker rm -f "$container_id" >/dev/null 2>&1; then
-					REMOVE_FAILED="$REMOVE_FAILED $container_name"
+			echo "⚠️  WARNING: Cannot restore volume as it is currently in use!"
+			echo ""
+			echo "📋 The following containers are using volume '${volumeName}':"
+			echo ""
+			
+			echo "$CONTAINERS_USING_VOLUME" | while IFS='|' read container_id container_name container_state labels; do
+				echo "   🐳 Container: $container_name ($container_id)"
+				echo "      Status: $container_state"
+				
+				# Determine container type
+				if echo "$labels" | grep -q "com.docker.swarm.service.name="; then
+					SERVICE_NAME=$(echo "$labels" | grep -o "com.docker.swarm.service.name=[^,]*" | cut -d'=' -f2)
+					echo "      Type: Docker Swarm Service ($SERVICE_NAME)"
+				elif echo "$labels" | grep -q "com.docker.compose.project="; then
+					PROJECT_NAME=$(echo "$labels" | grep -o "com.docker.compose.project=[^,]*" | cut -d'=' -f2)
+					echo "      Type: Docker Compose ($PROJECT_NAME)"
+				else
+					echo "      Type: Regular Container"
 				fi
-			done < "$STOPPED_CONTAINERS_FILE"
-
-			rm -f "$STOPPED_CONTAINERS_FILE"
-
-			if [ -n "$REMOVE_FAILED" ]; then
 				echo ""
-				echo "❌ Failed to remove container(s):$REMOVE_FAILED"
-				echo "❌ Volume restore aborted - could not free the volume"
-				exit 1
-			fi
-
+			done
+			
 			echo ""
-			echo "Removing existing volume and proceeding with restore"
-			if ! docker volume rm ${volumeName} --force; then
-				echo "❌ Volume restore aborted - failed to remove existing volume"
-				exit 1
-			fi
-			${baseRestoreCommand}
+			echo "🔧 To restore this volume, please:"
+			echo "   1. Stop all containers/services using this volume"
+			echo "   2. Remove the existing volume: docker volume rm ${volumeName}"
+			echo "   3. Run the restore operation again"
+			echo ""
+			echo "❌ Volume restore aborted - volume is in use"
+			
+			exit 1
 		fi
 	fi
 	`;

packages/server/src/wss/utils.ts

@@ -40,7 +40,7 @@ export const readValidDirectory = (
 	directory: string,
 	serverId?: string | null,
 ) => {
-	if (!/^[\w/. :[\]+@~(),=%-]{1,500}$/.test(directory)) {
+	if (!/^[\w/. :[\]-]{1,500}$/.test(directory)) {
 		return false;
 	}
 

scripts/assign-worktree-port.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-PAYLOAD=$(cat)
-WORKTREE_PATH=$(echo "$PAYLOAD" | jq -r '.tool_response.worktreePath // empty')
-
-if [ -z "$WORKTREE_PATH" ]; then
-	exit 0
-fi
-
-ENV_FILE="$WORKTREE_PATH/apps/dokploy/.env"
-if [ ! -f "$ENV_FILE" ]; then
-	exit 0
-fi
-
-FREE_PORT=$(node "$CLAUDE_PROJECT_DIR/scripts/find-free-port.mjs")
-
-sed -i.bak "s/^PORT=.*/PORT=$FREE_PORT/" "$ENV_FILE"
-sed -i.bak -E "s#^(BETTER_AUTH_URL=https?://[^:/]+):[0-9]+#\1:$FREE_PORT#" "$ENV_FILE"
-rm -f "$ENV_FILE.bak"
-
-echo "Worktree $WORKTREE_PATH -> dokploy dev PORT=$FREE_PORT"

scripts/find-free-port.mjs

@@ -1,26 +0,0 @@
-import { createServer } from "node:net";
-
-function isFree(port) {
-	return new Promise((resolve) => {
-		const server = createServer();
-		server.once("error", () => resolve(false));
-		server.listen(port, "0.0.0.0", () => {
-			server.close(() => resolve(true));
-		});
-	});
-}
-
-async function findFreePort(start) {
-	let port = start;
-	while (!(await isFree(port))) {
-		port++;
-	}
-	return port;
-}
-
-const start = Number.parseInt(
-	process.argv[2] || process.env.PORT || "3000",
-	10,
-);
-const port = await findFreePort(start);
-process.stdout.write(String(port));

scripts/install-worktree-deps.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-PAYLOAD=$(cat)
-WORKTREE_PATH=$(echo "$PAYLOAD" | jq -r '.tool_response.worktreePath // empty')
-
-if [ -z "$WORKTREE_PATH" ]; then
-	exit 0
-fi
-
-# Turbopack refuses to resolve through anything outside its detected
-# workspace root, so a symlinked node_modules (whole dir or per-entry)
-# doesn't work for apps/dokploy. A real `pnpm install` is required, but
-# since pnpm's global content-addressable store is already warm, this
-# only links locally — no network fetch, a few seconds.
-cd "$WORKTREE_PATH"
-pnpm install --prefer-offline

scripts/spawn-agent-worktree.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-NAME="${1:?usage: spawn-agent-worktree.sh <name>}"
-# --show-toplevel would return the CURRENT worktree's own root if this is
-# run from inside one (e.g. another agent's worktree) instead of the main
-# checkout. --git-common-dir always points at the shared .git regardless of
-# which worktree you're standing in.
-REPO_ROOT="$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")"
-WORKTREE_PATH="$REPO_ROOT/.claude/worktrees/$NAME"
-BRANCH="worktree-$NAME"
-
-if [ -e "$WORKTREE_PATH" ]; then
-	echo "Worktree already exists: $WORKTREE_PATH" >&2
-	exit 1
-fi
-
-git -C "$REPO_ROOT" fetch origin canary --quiet
-git -C "$REPO_ROOT" worktree add -b "$BRANCH" "$WORKTREE_PATH" origin/canary >&2
-
-# .worktreeinclude lists gitignored files (.env, .env.local) that a plain
-# `git worktree add` won't check out on its own - copy them in.
-while IFS= read -r pattern; do
-	[ -z "$pattern" ] && continue
-	find "$REPO_ROOT" \( -path "$REPO_ROOT/.claude/worktrees" -o -path "$REPO_ROOT/node_modules" \) -prune -o -name "$pattern" -print 2>/dev/null
-done < "$REPO_ROOT/.worktreeinclude" | while read -r src; do
-	rel="${src#"$REPO_ROOT"/}"
-	dest="$WORKTREE_PATH/$rel"
-	mkdir -p "$(dirname "$dest")"
-	cp "$src" "$dest"
-done
-
-cd "$WORKTREE_PATH"
-pnpm install --prefer-offline >&2
-
-FREE_PORT=$(node "$REPO_ROOT/scripts/find-free-port.mjs")
-sed -i.bak "s/^PORT=.*/PORT=$FREE_PORT/" apps/dokploy/.env
-sed -i.bak -E "s#^(BETTER_AUTH_URL=https?://[^:/]+):[0-9]+#\1:$FREE_PORT#" apps/dokploy/.env
-rm -f apps/dokploy/.env.bak
-
-pnpm --filter=dokploy run dev > "$WORKTREE_PATH/dev-server.log" 2>&1 &
-echo $! > "$WORKTREE_PATH/dev-server.pid"
-
-BASE_URL="http://localhost:$FREE_PORT"
-for _ in $(seq 1 30); do
-	CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 1 "$BASE_URL/" || true)
-	if [ "$CODE" != "000" ]; then
-		break
-	fi
-	sleep 1
-done
-
-echo "export WORKTREE_PATH=$WORKTREE_PATH"
-echo "export DOKPLOY_BASE_URL=$BASE_URL"
-echo "export PORT=$FREE_PORT"