docs: trim block comment on shellWord helper

.github/workflows/dokploy.yml

@@ -164,7 +164,6 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
-          target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
           generate_release_notes: true
           draft: false

apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts

@@ -1,106 +0,0 @@
-import { execSync } from "node:child_process";
-import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
-import {
-	getLibsqlBackupCommand,
-	getMariadbBackupCommand,
-	getMongoBackupCommand,
-	getMysqlBackupCommand,
-	getPostgresBackupCommand,
-} from "@dokploy/server/utils/backups/utils";
-import {
-	getMariadbRestoreCommand,
-	getMongoRestoreCommand,
-	getMysqlRestoreCommand,
-	getPostgresRestoreCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-
-// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
-// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
-// test exercises BOTH shell layers (outer /bin/sh building the docker command,
-// and the inner shell) the way production does, without needing a container.
-const stub = `/tmp/docker_stub_${process.pid}`;
-const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
-
-beforeAll(() => {
-	writeFileSync(
-		stub,
-		`#!/bin/bash
-shift # exec
-envs=()
-while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
-shift 2 # -i CONTAINER
-shell="$1"; shift # bash|sh
-shift # -c
-env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
-`,
-	);
-	chmodSync(stub, 0o755);
-});
-
-afterAll(() => {
-	if (existsSync(stub)) rmSync(stub);
-	if (existsSync(MARK)) rmSync(MARK);
-});
-
-// Run a builder-produced command with `docker` pointed at the stub; return true
-// if no injected command fired.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	const withStub = command.replace(/^docker /, `${stub} `);
-	try {
-		execSync(withStub, {
-			shell: "/bin/bash",
-			stdio: "ignore",
-			env: { ...process.env, CONTAINER_ID: "test" },
-		});
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-// Payloads that try to break out of every quoting style used in the builders.
-const p = (mark: string) => [
-	`$(touch ${mark})`,
-	"`touch " + mark + "`",
-	`x'; touch ${mark}; '`,
-	`x"; touch ${mark}; echo "`,
-	`x; touch ${mark}`,
-];
-
-describe("database backup/restore command injection", () => {
-	const cases: Array<[string, (v: string) => string]> = [
-		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
-		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
-		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
-		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
-		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
-		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
-		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
-		[
-			"mariadb restore (password)",
-			(v) => getMariadbRestoreCommand("db", "u", v),
-		],
-		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
-		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
-	];
-
-	for (const [label, build] of cases) {
-		it(`${label} is not injectable`, () => {
-			for (const payload of p(MARK)) {
-				expect(runsSafely(build(payload))).toBe(true);
-			}
-		});
-	}
-
-	it("preserves a legitimate database name (passed through as env var)", () => {
-		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
-		// Values live in -e assignments, never inline in the pg_dump text.
-		expect(cmd).toContain("-e DB_NAME=my-db_prod");
-		expect(cmd).toContain("-e DB_USER=app_user");
-		expect(cmd).toContain(
-			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
-		);
-	});
-});

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -1,70 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
-
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = (m: string) => [
-	`$(touch ${m})`,
-	"`touch " + m + "`",
-	`x; touch ${m}`,
-	`x | touch ${m}`,
-];
-
-describe("cluster removeWorker nodeId injection", () => {
-	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
-	it("escapes nodeId in drain/remove commands", () => {
-		for (const nodeId of PAYLOADS(MARK)) {
-			const drain = `: node update --availability drain ${quote([nodeId])}`;
-			const remove = `: node rm ${quote([nodeId])} --force`;
-			expect(runsSafely(drain)).toBe(true);
-			expect(runsSafely(remove)).toBe(true);
-		}
-	});
-});
-
-describe("swarm upload registry tag/push injection", () => {
-	// registryTag is built from registryUrl/username/imagePrefix (username and
-	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
-	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
-		for (const payload of PAYLOADS(MARK)) {
-			const registryTag = getRegistryTag(
-				{
-					registryUrl: "registry.example.com",
-					imagePrefix: payload,
-					username: "user",
-				} as any,
-				"app:latest",
-			);
-			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
-			const pushCmd = `: push ${quote([registryTag])}`;
-			expect(runsSafely(tagCmd)).toBe(true);
-			expect(runsSafely(pushCmd)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate registry tag intact", () => {
-		const tag = getRegistryTag(
-			{
-				registryUrl: "registry.example.com",
-				imagePrefix: "team",
-				username: "user",
-			} as any,
-			"myapp:1.2.3",
-		);
-		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
-		expect(parse(quote([tag]))).toEqual([tag]);
-	});
-});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -1,104 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "raw" as const,
-	command: "",
-	composePath: "docker-compose.yml",
-};
-
-// createCommand output is interpolated as `docker ${command}` at the deploy
-// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	`$(touch ${MARK})`,
-	"`touch " + MARK + "`",
-	`x; touch ${MARK}`,
-	`x | touch ${MARK}`,
-];
-
-describe("compose createCommand injection", () => {
-	it("escapes composePath (docker-compose)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes composePath (stack deploy)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				composeType: "stack",
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes appName", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				appName: p,
-				composePath: "docker-compose.yml",
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("rejects a custom command containing shell control characters", () => {
-		for (const bad of [
-			"up -d; rm -rf /",
-			"up && curl evil | sh",
-			"up $(touch x)",
-			"up `id`",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("allows a legitimate custom command", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -f docker-compose.yml -p app up -d --build",
-		} as any);
-		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
-	});
-
-	it("keeps a legitimate composePath intact", () => {
-		const cmd = createCommand({
-			...base,
-			sourceType: "github",
-			composePath: "deploy/docker-compose.prod.yml",
-		} as any);
-		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
-		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
-			"deploy/docker-compose.prod.yml",
-		);
-	});
-});

apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
-// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
-// path. `docker` is replaced by `:` so only the injection surface is exercised.
-const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"redis:7; touch %MARK%",
-	"redis:7 && touch %MARK%",
-	"redis:7 | touch %MARK%",
-];
-
-describe("database service dockerImage command injection", () => {
-	it("does not execute injected commands from dockerImage", () => {
-		for (const template of PAYLOADS) {
-			if (existsSync(MARK)) rmSync(MARK);
-			const dockerImage = template.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}`;
-			try {
-				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-			} catch {}
-			expect(existsSync(MARK)).toBe(false);
-		}
-		if (existsSync(MARK)) rmSync(MARK);
-	});
-
-	it("keeps a legitimate image tag intact", () => {
-		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
-			"postgres:16.4-alpine",
-		]);
-		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
-			"ghcr.io/org/db:latest",
-		]);
-	});
-});

apps/dokploy/__test__/deploy/docker-build-injection.test.ts

@@ -1,66 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Reproduces the escaping applied at the docker build/pull sinks and asserts no
-// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
-// test exercises only the injection surface, not real docker.
-const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
-
-const runAndCheckSafe = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {
-		// no-op stand-ins may exit non-zero; only the marker matters.
-	}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"x; touch %MARK%",
-	"x && touch %MARK%",
-	"x | touch %MARK%",
-];
-
-describe("docker build/pull command injection", () => {
-	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerImage = p.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("dockerContextPath (docker-file: cd) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerContextPath = p.replace("%MARK%", MARK);
-			const command = `: cd ${quote([dockerContextPath])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const publishDirectory = p.replace("%MARK%", MARK);
-			const containerId = "buildabc";
-			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate image / path intact as a single token", () => {
-		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
-		// the result back to exactly the original single token.
-		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
-		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
-			"registry.io/team/app:tag",
-		]);
-		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
-	});
-});

apps/dokploy/__test__/deploy/railpack.command.test.ts

@@ -1,104 +0,0 @@
-import type { ApplicationNested } from "@dokploy/server/utils/builders";
-import { getRailpackCommand } from "@dokploy/server/utils/builders/railpack";
-import { describe, expect, it } from "vitest";
-
-const createApplication = (
-	overrides: Partial<ApplicationNested> = {},
-): ApplicationNested =>
-	({
-		appName: "test-app",
-		buildType: "railpack",
-		sourceType: "git",
-		buildPath: "/",
-		railpackVersion: "0.15.4",
-		env: "TEST_VAR=one",
-		cleanCache: false,
-		environment: {
-			project: {
-				env: "",
-			},
-			env: "",
-		},
-		...overrides,
-	}) as unknown as ApplicationNested;
-
-const getSecretsHash = (command: string) => {
-	const match = command.match(/secrets-hash=([a-f0-9]{64})/);
-	if (!match?.[1]) {
-		throw new Error("secrets-hash build arg was not found");
-	}
-
-	return match[1];
-};
-
-describe("getRailpackCommand", () => {
-	it("includes secrets-hash without clean cache", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).not.toContain("cache-key=");
-	});
-
-	it("includes cache-key only when clean cache is enabled", () => {
-		const command = getRailpackCommand(
-			createApplication({
-				cleanCache: true,
-			}),
-		);
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).toContain("--build-arg cache-key=");
-	});
-
-	it("changes secrets-hash when an environment value changes", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=one",
-			}),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=two",
-			}),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-
-	it("changes secrets-hash when referenced project or environment values change", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=one",
-					},
-					env: "SHARED_VALUE=alpha",
-				},
-			} as Partial<ApplicationNested>),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=two",
-					},
-					env: "SHARED_VALUE=beta",
-				},
-			} as Partial<ApplicationNested>),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-});

apps/dokploy/__test__/env/rollback-environment.test.ts

@@ -1,108 +0,0 @@
-import { prepareEnvironmentVariables } from "@dokploy/server/index";
-import { describe, expect, it } from "vitest";
-
-const projectEnv = `
-ENVIRONMENT=staging
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db
-`;
-
-const environmentEnv = `
-NODE_ENV=production
-POSTGRES_HOST=postgres.internal
-POSTGRES_PORT=5432
-REDIS_URL=redis://redis.internal:6379
-`;
-
-const serviceEnv = `
-NODE_ENV=\${{environment.NODE_ENV}}
-REDIS_URL=\${{environment.REDIS_URL}}
-PORT=3000
-`;
-
-/**
- * A rollback replays the snapshot stored in `rollbacks.fullContext`, which keeps
- * the service env, the environment env and the project env captured at deploy time.
- */
-const fullContext = {
-	env: serviceEnv,
-	environment: {
-		env: environmentEnv,
-		project: {
-			env: projectEnv,
-		},
-	},
-};
-
-describe("prepareEnvironmentVariables for application rollback", () => {
-	it("resolves environment variables from the rollback snapshot", () => {
-		const result = prepareEnvironmentVariables(
-			fullContext.env,
-			fullContext.environment.project.env,
-			fullContext.environment.env,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=production",
-			"REDIS_URL=redis://redis.internal:6379",
-			"PORT=3000",
-		]);
-	});
-
-	it("resolves project and environment variables together on rollback", () => {
-		const rollbackEnv = `
-DATABASE_URL=\${{project.DATABASE_URL}}
-POSTGRES_URL=postgres://\${{environment.POSTGRES_HOST}}:\${{environment.POSTGRES_PORT}}/app
-ENVIRONMENT=\${{project.ENVIRONMENT}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			projectEnv,
-			environmentEnv,
-		);
-
-		expect(result).toEqual([
-			"DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db",
-			"POSTGRES_URL=postgres://postgres.internal:5432/app",
-			"ENVIRONMENT=staging",
-		]);
-	});
-
-	it("throws when the environment env of the snapshot is not passed", () => {
-		expect(() =>
-			prepareEnvironmentVariables(fullContext.env, projectEnv),
-		).toThrow("Invalid environment variable: environment.NODE_ENV");
-	});
-
-	it("maintains precedence: service > environment > project on rollback", () => {
-		const conflictingProjectEnv = `
-NODE_ENV=project
-API_URL=https://project.api.com
-`;
-
-		const conflictingEnvironmentEnv = `
-NODE_ENV=environment
-API_URL=https://environment.api.com
-`;
-
-		const rollbackEnv = `
-NODE_ENV=service
-PROJECT_API_URL=\${{project.API_URL}}
-ENVIRONMENT_API_URL=\${{environment.API_URL}}
-SELF_REFERENCE=\${{NODE_ENV}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			conflictingProjectEnv,
-			conflictingEnvironmentEnv,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=service",
-			"PROJECT_API_URL=https://project.api.com",
-			"ENVIRONMENT_API_URL=https://environment.api.com",
-			"SELF_REFERENCE=service",
-		]);
-	});
-});

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -1,10 +1,8 @@
 import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
+import { shellWord } from "@dokploy/server/utils/providers/utils";
+import { parse } from "shell-quote";
 import { describe, expect, it } from "vitest";
 
-// How git-provider commands escape a single user value before it reaches the shell.
-const shellArg = (value: string) => quote([String(value ?? "")]);
-
 // Payloads that, if reached a shell unescaped, would execute commands.
 const INJECTION_PAYLOADS = [
 	"$(touch /tmp/pwned)",
@@ -26,10 +24,10 @@ const LEGIT_VALUES = [
 	"https://gitlab.example.com/group/sub/project.git",
 ];
 
-describe("git provider shell escaping (quote)", () => {
+describe("shellWord (git provider shell escaping)", () => {
 	it("collapses every injection payload into a single literal token (no shell operators)", () => {
 		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
+			const parsed = parse(shellWord(payload));
 			// A safely escaped value parses back to exactly the original string,
 			// as ONE token. If escaping failed, parse() would emit operator
 			// objects such as { op: ";" } or { op: "$(" } instead.
@@ -39,7 +37,7 @@ describe("git provider shell escaping (quote)", () => {
 
 	it("leaves legitimate URLs and branch names intact", () => {
 		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
+			expect(parse(shellWord(value))).toEqual([value]);
 		}
 	});
 });

apps/dokploy/__test__/git-provider/git-provider-idor.test.ts

@@ -1,91 +0,0 @@
-import { TRPCError } from "@trpc/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
-// assertGitProviderAccess) runs against controlled data. Mocking the exported
-// function would NOT intercept the intra-module call, so we mock one layer down.
-const mockDb = vi.hoisted(() => ({
-	query: {
-		gitProvider: {
-			findMany: vi.fn(),
-		},
-		member: {
-			findFirst: vi.fn(),
-		},
-	},
-}));
-vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
-
-const mockHasValidLicense = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: mockHasValidLicense,
-}));
-
-import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
-
-const ORG = "org-1";
-const USER = "user-member";
-const session = { userId: USER, activeOrganizationId: ORG };
-
-// Provider owned by USER within ORG -> should be accessible.
-const providerMine = {
-	gitProviderId: "gp-mine",
-	userId: USER,
-	sharedWithOrganization: false,
-};
-// Provider owned by someone else within ORG, not shared, not assigned.
-const providerOther = {
-	gitProviderId: "gp-other",
-	userId: "user-2",
-	sharedWithOrganization: false,
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	mockHasValidLicense.mockResolvedValue(false);
-	mockDb.query.gitProvider.findMany.mockResolvedValue([
-		providerMine,
-		providerOther,
-	]);
-	mockDb.query.member.findFirst.mockResolvedValue({
-		role: "member",
-		accessedGitProviders: [],
-	});
-});
-
-describe("assertGitProviderAccess (git provider IDOR guard)", () => {
-	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: "org-2",
-			}),
-		).rejects.toMatchObject({ code: "NOT_FOUND" });
-	});
-
-	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-other",
-				organizationId: ORG,
-			}),
-		).rejects.toMatchObject({ code: "FORBIDDEN" });
-	});
-
-	it("allows a same-org provider the caller owns", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: ORG,
-			}),
-		).resolves.toBeUndefined();
-	});
-
-	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
-		const err = await assertGitProviderAccess(session, {
-			gitProviderId: "gp-mine",
-			organizationId: "org-2",
-		}).catch((e) => e);
-		expect(err).toBeInstanceOf(TRPCError);
-	});
-});

apps/dokploy/__test__/requests/request.test.ts

@@ -55,28 +55,6 @@ describe("processLogs", () => {
 		expect(result.data).toHaveLength(2);
 	});
 
-	it("should not throw when filtering by hostname and an entry has no RequestHost", () => {
-		const entryWithoutRequestHost = sampleLogEntry.replace(
-			/"RequestHost":"[^"]*",/,
-			"",
-		);
-
-		const mixedEntries = `${sampleLogEntry}\n${entryWithoutRequestHost}`;
-
-		expect(() =>
-			parseRawConfig(mixedEntries, undefined, undefined, "traefik.me"),
-		).not.toThrow();
-
-		const result = parseRawConfig(
-			mixedEntries,
-			undefined,
-			undefined,
-			"traefik.me",
-		);
-		expect(result.totalCount).toBe(1);
-		expect(result.data[0]?.RequestHost).toBe("s222-umami-c381af.traefik.me");
-	});
-
 	it("should filter out Dokploy dashboard requests", () => {
 		const dokployDashboardEntry = `{"ClientAddr":"172.71.187.131:9485","ClientHost":"172.71.187.131","ClientPort":"9485","ClientUsername":"-","DownstreamContentSize":14550,"DownstreamStatus":200,"Duration":57681682,"OriginContentSize":14550,"OriginDuration":57612242,"OriginStatus":200,"Overhead":69440,"RequestAddr":"hostinger.dokploy.com","RequestContentSize":0,"RequestCount":20142,"RequestHost":"hostinger.dokploy.com","RequestMethod":"GET","RequestPath":"/_next/data/cb_zzI4Rp9G7Q7djrFKh0/en/dashboard/traefik.json","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"dokploy-router-app-secure@file","ServiceAddr":"dokploy:3000","ServiceName":"dokploy-service-app@file","ServiceURL":"http://dokploy:3000","StartLocal":"2025-12-10T05:10:41.957755949Z","StartUTC":"2025-12-10T05:10:41.957755949Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2025-12-10T05:10:42Z"}`;
 

apps/dokploy/__test__/server/server-sshkey-redaction.test.ts

@@ -1,44 +0,0 @@
-import { redactServerSshKey } from "@dokploy/server/services/server";
-import { describe, expect, it } from "vitest";
-
-describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
-	it("blanks the private key while keeping the rest of the ssh key intact", () => {
-		const server = {
-			serverId: "srv-1",
-			name: "prod",
-			sshKey: {
-				sshKeyId: "key-1",
-				publicKey: "ssh-ed25519 AAAA...",
-				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
-			},
-		};
-
-		const redacted = redactServerSshKey(server);
-
-		expect(redacted.sshKey.privateKey).toBe("");
-		// Non-secret fields and the surrounding record must survive untouched.
-		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
-		expect(redacted.serverId).toBe("srv-1");
-		expect(redacted.name).toBe("prod");
-	});
-
-	it("does not mutate the original record", () => {
-		const server = {
-			serverId: "srv-1",
-			sshKey: { privateKey: "top-secret" },
-		};
-		redactServerSshKey(server);
-		expect(server.sshKey.privateKey).toBe("top-secret");
-	});
-
-	it("is a no-op when the server has no ssh key", () => {
-		const server = { serverId: "srv-2", sshKey: null };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-
-	it("handles a record without a loaded sshKey relation", () => {
-		// e.g. server.update returns the plain row where sshKey is not populated.
-		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-});

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Mirrors how getNodeInfo builds its command in services/docker.ts:
-//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
-// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
-// whether the nodeId payload can break out of the command, not real docker.
-const buildCommand = (nodeId: string) =>
-	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
-
-const INJECTION_NODE_IDS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"; touch %MARK%",
-	"abc | touch %MARK%",
-	"&& touch %MARK%",
-];
-
-describe("getNodeInfo nodeId command injection", () => {
-	it("does not execute injected commands from the nodeId", () => {
-		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
-		for (const template of INJECTION_NODE_IDS) {
-			if (existsSync(mark)) rmSync(mark);
-			const nodeId = template.replace("%MARK%", mark);
-			try {
-				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
-			} catch {
-				// A non-zero exit from the no-op is fine; we only care about the marker.
-			}
-			expect(existsSync(mark)).toBe(false);
-		}
-		if (existsSync(mark)) rmSync(mark);
-	});
-
-	it("keeps a legitimate node id intact as a single literal token", () => {
-		const nodeId = "abc123def456";
-		expect(quote([nodeId])).toBe(nodeId);
-	});
-});

apps/dokploy/__test__/utils/hostname-validation.test.ts

@@ -9,9 +9,6 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"a.b.c.example.co",
 		"xn--80ak6aa92e.com",
 		"123.example.com",
-		"example",
-		"dokploy-server",
-		"localhost",
 	])("accepts valid hostname %s", (host) => {
 		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
 	});
@@ -20,6 +17,7 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"bbn_client.example.com",
 		"-example.com",
 		"example-.com",
+		"example",
 		"exa mple.com",
 		"example..com",
 		"",

apps/dokploy/__test__/wss/authorize.test.ts

@@ -1,104 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the permission + server helpers the wss authorizer composes.
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockFindMember = vi.hoisted(() => vi.fn());
-const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-	findMemberByUserId: mockFindMember,
-	checkServiceAccess: mockCheckServiceAccess,
-}));
-
-const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	getAccessibleServerIds: mockGetAccessibleServerIds,
-}));
-
-import {
-	canAccessDockerOverWss,
-	canAccessTerminalOverWss,
-} from "@/server/wss/authorize";
-
-const USER = { id: "user-1" };
-const SESSION = { activeOrganizationId: "org-1" };
-
-beforeEach(() => {
-	vi.clearAllMocks();
-});
-
-describe("canAccessDockerOverWss", () => {
-	it("denies when there is no user or session", async () => {
-		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
-		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
-	});
-
-	it("denies a member without docker permission", async () => {
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
-	});
-
-	it("allows when the caller has docker permission (no server)", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
-	});
-
-	it("denies a remote server the caller cannot access, even with docker permission", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
-	});
-
-	it("allows a remote server the caller can access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("denies when the container belongs to a service the caller cannot access", async () => {
-		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
-		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
-			false,
-		);
-	});
-
-	it("allows service access even without docker permission or server access", async () => {
-		// A member granted the service but without canAccessToDocker, whose
-		// service runs on a server they were not individually granted, must still
-		// read its logs — matches application.readLogs (service access only).
-		mockHasPermission.mockResolvedValue(false);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set());
-		mockCheckServiceAccess.mockResolvedValue(undefined);
-		expect(
-			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
-		).toBe(true);
-		// Service path is authoritative — it must not fall through to docker/server.
-		expect(mockHasPermission).not.toHaveBeenCalled();
-		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
-	});
-});
-
-describe("canAccessTerminalOverWss", () => {
-	it("denies the local host terminal to a plain member", async () => {
-		mockFindMember.mockResolvedValue({ role: "member" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
-	});
-
-	it("allows the local host terminal to an owner", async () => {
-		mockFindMember.mockResolvedValue({ role: "owner" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("allows the local host terminal to an admin", async () => {
-		mockFindMember.mockResolvedValue({ role: "admin" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("gates a remote server terminal on server access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// role lookup must not be needed for the remote path
-		expect(mockFindMember).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/components/dashboard/application/deployments/show-deployments.tsx

@@ -63,9 +63,6 @@ export const ShowDeployments = ({
 	const [activeLog, setActiveLog] = useState<
 		RouterOutputs["deployment"]["all"][number] | null
 	>(null);
-	const [removingDeploymentIds, setRemovingDeploymentIds] = useState<
-		Set<string>
-	>(new Set());
 	const { data: deployments, isPending: isLoadingDeployments } =
 		api.deployment.allByType.useQuery(
 			{
@@ -84,7 +81,7 @@ export const ShowDeployments = ({
 		api.rollback.rollback.useMutation();
 	const { mutateAsync: killProcess, isPending: isKillingProcess } =
 		api.deployment.killProcess.useMutation();
-	const { mutateAsync: removeDeployment } =
+	const { mutateAsync: removeDeployment, isPending: isRemovingDeployment } =
 		api.deployment.removeDeployment.useMutation();
 
 	// Cancel deployment mutations
@@ -411,11 +408,6 @@ export const ShowDeployments = ({
 													description="Are you sure you want to delete this deployment? This action cannot be undone."
 													type="default"
 													onClick={async () => {
-														setRemovingDeploymentIds((deploymentIds) => {
-															const nextDeploymentIds = new Set(deploymentIds);
-															nextDeploymentIds.add(deployment.deploymentId);
-															return nextDeploymentIds;
-														});
 														try {
 															await removeDeployment({
 																deploymentId: deployment.deploymentId,
@@ -423,25 +415,13 @@ export const ShowDeployments = ({
 															toast.success("Deployment deleted successfully");
 														} catch (error) {
 															toast.error("Error deleting deployment");
-														} finally {
-															setRemovingDeploymentIds((deploymentIds) => {
-																const nextDeploymentIds = new Set(
-																	deploymentIds,
-																);
-																nextDeploymentIds.delete(
-																	deployment.deploymentId,
-																);
-																return nextDeploymentIds;
-															});
 														}
 													}}
 												>
 													<Button
 														variant="destructive"
 														size="sm"
-														isLoading={removingDeploymentIds.has(
-															deployment.deploymentId,
-														)}
+														isLoading={isRemovingDeployment}
 													>
 														Delete
 														<Trash2 className="size-4" />

apps/dokploy/components/dashboard/application/domains/columns.tsx

@@ -209,9 +209,7 @@ export const createColumns = ({
 									</Badge>
 								</TooltipTrigger>
 								<TooltipContent className="max-w-xs">
-									{validationState?.isValid && validationState?.message ? (
-										<p>{validationState.message}</p>
-									) : validationState?.error ? (
+									{validationState?.error ? (
 										<div className="flex flex-col gap-1">
 											<p className="font-medium text-red-500">Error:</p>
 											<p>{validationState.error}</p>

apps/dokploy/components/dashboard/application/domains/show-domains.tsx

@@ -626,10 +626,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 																</Badge>
 															</TooltipTrigger>
 															<TooltipContent className="max-w-xs">
-																{validationState?.isValid &&
-																validationState?.message ? (
-																	<p>{validationState.message}</p>
-																) : validationState?.error ? (
+																{validationState?.error ? (
 																	<div className="flex flex-col gap-1">
 																		<p className="font-medium text-red-500">
 																			Error:

apps/dokploy/components/dashboard/application/environment/show.tsx

@@ -60,16 +60,14 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 	const currentBuildArgs = form.watch("buildArgs");
 	const currentBuildSecrets = form.watch("buildSecrets");
 	const currentCreateEnvFile = form.watch("createEnvFile");
-	const { isDirty } = form.formState;
 	const hasChanges =
 		currentEnv !== (data?.env || "") ||
 		currentBuildArgs !== (data?.buildArgs || "") ||
 		currentBuildSecrets !== (data?.buildSecrets || "") ||
 		currentCreateEnvFile !== (data?.createEnvFile ?? true);
 
-	// Skip reset while editing so background refetches don't wipe edits
 	useEffect(() => {
-		if (data && !isDirty) {
+		if (data) {
 			form.reset({
 				env: data.env || "",
 				buildArgs: data.buildArgs || "",
@@ -77,7 +75,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 				createEnvFile: data.createEnvFile ?? true,
 			});
 		}
-	}, [data, isDirty, form]);
+	}, [data, form]);
 
 	const onSubmit = async (formData: EnvironmentSchema) => {
 		mutateAsync({
@@ -89,7 +87,6 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 		})
 			.then(async () => {
 				toast.success("Environments Added");
-				form.reset(formData);
 				await refetch();
 			})
 			.catch(() => {

apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx

@@ -447,18 +447,14 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="ml-1 size-3 cursor-pointer"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												>
-													<X className="ml-1 size-3 cursor-pointer" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -506,14 +502,14 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-git-provider.tsx

@@ -242,18 +242,14 @@ export const SaveGitProvider = ({ applicationId }: Props) => {
 									{field.value?.map((path, index) => (
 										<Badge key={index} variant="secondary">
 											{path}
-											<button
-												type="button"
-												aria-label="Remove watch path"
-												className="inline-flex items-center focus-visible:ring-2"
+											<X
+												className="ml-1 size-3 cursor-pointer"
 												onClick={() => {
 													const newPaths = [...(field.value || [])];
 													newPaths.splice(index, 1);
 													form.setValue("watchPaths", newPaths);
 												}}
-											>
-												<X className="ml-1 size-3 cursor-pointer" />
-											</button>
+											/>
 										</Badge>
 									))}
 								</div>
@@ -302,14 +298,14 @@ export const SaveGitProvider = ({ applicationId }: Props) => {
 						control={form.control}
 						name="enableSubmodules"
 						render={({ field }) => (
-							<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+							<FormItem className="flex items-center space-x-2">
 								<FormControl>
 									<Switch
 										checked={field.value}
 										onCheckedChange={field.onChange}
 									/>
 								</FormControl>
-								<FormLabel>Enable Submodules</FormLabel>
+								<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 							</FormItem>
 						)}
 					/>

apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx

@@ -477,18 +477,14 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 												className="flex items-center gap-1"
 											>
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="size-3 cursor-pointer hover:text-destructive"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														field.onChange(newPaths);
 													}}
-												>
-													<X className="size-3 cursor-pointer hover:text-destructive" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -535,14 +531,14 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx

@@ -438,12 +438,8 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 										</TooltipProvider>
 									</div>
 									<Select
-										onValueChange={(value) => {
-											if (!value) {
-												return;
-											}
-											field.onChange(value);
-										}}
+										onValueChange={field.onChange}
+										defaultValue={field.value}
 										value={field.value}
 									>
 										<FormControl>
@@ -491,18 +487,14 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 													className="flex items-center gap-1"
 												>
 													{path}
-													<button
-														type="button"
-														aria-label="Remove watch path"
-														className="inline-flex items-center focus-visible:ring-2"
+													<X
+														className="size-3 cursor-pointer hover:text-destructive"
 														onClick={() => {
 															const newPaths = [...(field.value || [])];
 															newPaths.splice(index, 1);
 															field.onChange(newPaths);
 														}}
-													>
-														<X className="size-3 cursor-pointer hover:text-destructive" />
-													</button>
+													/>
 												</Badge>
 											))}
 										</div>
@@ -551,14 +543,14 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx

@@ -467,18 +467,14 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												className="flex items-center gap-1"
 											>
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="size-3 cursor-pointer hover:text-destructive"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														field.onChange(newPaths);
 													}}
-												>
-													<X className="size-3 cursor-pointer hover:text-destructive" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -525,14 +521,14 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/show.tsx

@@ -271,7 +271,6 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
-						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"

apps/dokploy/components/dashboard/application/logs/show.tsx

@@ -50,10 +50,9 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
 
@@ -183,7 +182,6 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/application/schedules/show-schedules.tsx

@@ -58,12 +58,8 @@ export const ShowSchedules = ({ id, scheduleType = "application" }: Props) => {
 	const handleRunManually = async (scheduleId: string) => {
 		setRunningSchedules((prev) => new Set(prev).add(scheduleId));
 		try {
-			const result = await runManually({ scheduleId });
-			if (result.status === "error") {
-				toast.error("Schedule run failed, check the deployment logs");
-			} else {
-				toast.success("Schedule run successfully");
-			}
+			await runManually({ scheduleId });
+			toast.success("Schedule run successfully");
 			await refetchSchedules();
 		} catch {
 			toast.error("Error running schedule");

apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx

@@ -55,14 +55,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -124,7 +122,6 @@ export const ShowComposeContainers = ({
 										key={container.containerId}
 										container={container}
 										serverId={serverId}
-										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -145,14 +142,12 @@ interface ContainerRowProps {
 		status: string;
 	};
 	serverId?: string;
-	serviceId?: string;
 	onActionComplete: () => void;
 }
 
 const ContainerRow = ({
 	container,
 	serverId,
-	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -241,7 +236,6 @@ const ContainerRow = ({
 							<DockerTerminalModal
 								containerId={container.containerId}
 								serverId={serverId || ""}
-								serviceId={serviceId}
 							>
 								Terminal
 							</DockerTerminalModal>
@@ -286,7 +280,6 @@ const ContainerRow = ({
 								containerId={container.containerId}
 								serverId={serverId}
 								runType="native"
-								serviceId={serviceId}
 							/>
 						</div>
 					</DialogContent>

apps/dokploy/components/dashboard/compose/general/actions.tsx

@@ -84,19 +84,19 @@ export const ComposeActions = ({ composeId }: Props) => {
 				)}
 				{canDeploy && (
 					<DialogAction
-						title="Rebuild Compose"
-						description="Are you sure you want to rebuild this compose?"
+						title="Reload Compose"
+						description="Are you sure you want to reload this compose?"
 						type="default"
 						onClick={async () => {
 							await redeploy({
 								composeId: composeId,
 							})
 								.then(() => {
-									toast.success("Compose rebuilt successfully");
+									toast.success("Compose reloaded successfully");
 									refetch();
 								})
 								.catch(() => {
-									toast.error("Error rebuilding compose");
+									toast.error("Error reloading compose");
 								});
 						}}
 					>
@@ -109,14 +109,12 @@ export const ComposeActions = ({ composeId }: Props) => {
 								<TooltipTrigger asChild>
 									<div className="flex items-center">
 										<RefreshCcw className="size-4 mr-1" />
-										Rebuild
+										Reload
 									</div>
 								</TooltipTrigger>
 								<TooltipPrimitive.Portal>
 									<TooltipContent sideOffset={5} className="z-60">
-										<p>
-											Rebuilds the compose without downloading the source code
-										</p>
+										<p>Reload the compose without rebuilding it</p>
 									</TooltipContent>
 								</TooltipPrimitive.Portal>
 							</Tooltip>
@@ -208,7 +206,6 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
-				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"

apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx

@@ -451,18 +451,14 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="ml-1 size-3 cursor-pointer"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												>
-													<X className="ml-1 size-3 cursor-pointer" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -510,14 +506,14 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/compose/general/generic/save-git-provider-compose.tsx

@@ -251,18 +251,14 @@ export const SaveGitProviderCompose = ({ composeId }: Props) => {
 									{field.value?.map((path, index) => (
 										<Badge key={index} variant="secondary">
 											{path}
-											<button
-												type="button"
-												aria-label="Remove watch path"
-												className="inline-flex items-center focus-visible:ring-2"
+											<X
+												className="ml-1 size-3 cursor-pointer"
 												onClick={() => {
 													const newPaths = [...(field.value || [])];
 													newPaths.splice(index, 1);
 													form.setValue("watchPaths", newPaths);
 												}}
-											>
-												<X className="ml-1 size-3 cursor-pointer" />
-											</button>
+											/>
 										</Badge>
 									))}
 								</div>
@@ -310,14 +306,14 @@ export const SaveGitProviderCompose = ({ composeId }: Props) => {
 						control={form.control}
 						name="enableSubmodules"
 						render={({ field }) => (
-							<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+							<FormItem className="flex items-center space-x-2">
 								<FormControl>
 									<Switch
 										checked={field.value}
 										onCheckedChange={field.onChange}
 									/>
 								</FormControl>
-								<FormLabel>Enable Submodules</FormLabel>
+								<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 							</FormItem>
 						)}
 					/>

apps/dokploy/components/dashboard/compose/general/generic/save-gitea-provider-compose.tsx

@@ -442,18 +442,14 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="ml-1 size-3 cursor-pointer"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												>
-													<X className="ml-1 size-3 cursor-pointer" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -501,14 +497,14 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx

@@ -432,12 +432,8 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 										</TooltipProvider>
 									</div>
 									<Select
-										onValueChange={(value) => {
-											if (!value) {
-												return;
-											}
-											field.onChange(value);
-										}}
+										onValueChange={field.onChange}
+										defaultValue={field.value}
 										value={field.value}
 									>
 										<FormControl>
@@ -483,18 +479,14 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 											{field.value?.map((path, index) => (
 												<Badge key={index} variant="secondary">
 													{path}
-													<button
-														type="button"
-														aria-label="Remove watch path"
-														className="inline-flex items-center focus-visible:ring-2"
+													<X
+														className="ml-1 size-3 cursor-pointer"
 														onClick={() => {
 															const newPaths = [...(field.value || [])];
 															newPaths.splice(index, 1);
 															form.setValue("watchPaths", newPaths);
 														}}
-													>
-														<X className="ml-1 size-3 cursor-pointer" />
-													</button>
+													/>
 												</Badge>
 											))}
 										</div>
@@ -546,14 +538,14 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/compose/general/generic/save-gitlab-provider-compose.tsx

@@ -468,18 +468,14 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<button
-													type="button"
-													aria-label="Remove watch path"
-													className="inline-flex items-center focus-visible:ring-2"
+												<X
+													className="ml-1 size-3 cursor-pointer"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												>
-													<X className="ml-1 size-3 cursor-pointer" />
-												</button>
+												/>
 											</Badge>
 										))}
 									</div>
@@ -527,14 +523,14 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
+								<FormItem className="flex items-center space-x-2">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel>Enable Submodules</FormLabel>
+									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/compose/logs/show-stack.tsx

@@ -35,14 +35,9 @@ export const DockerLogs = dynamic(
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogsStack = ({
-	appName,
-	serverId,
-	serviceId,
-}: Props) => {
+export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
 	const [option, setOption] = useState<"swarm" | "native">("native");
 	const [containerId, setContainerId] = useState<string | undefined>();
 
@@ -172,7 +167,6 @@ export const ShowDockerLogsStack = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/compose/logs/show.tsx

@@ -35,14 +35,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowDockerLogsCompose = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -106,7 +104,6 @@ export const ShowDockerLogsCompose = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType="native"
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/database/backups/restore-backup.tsx

@@ -316,7 +316,7 @@ export const RestoreBackup = ({
 					Restore Backup
 				</Button>
 			</DialogTrigger>
-			<DialogContent className="sm:max-w-2xl">
+			<DialogContent className="sm:max-w-lg">
 				<DialogHeader>
 					<DialogTitle className="flex items-center">
 						<RotateCcw className="mr-2 size-4" />

apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx

@@ -23,7 +23,6 @@ interface Props {
 	containerId: string;
 	serverId?: string | null;
 	runType: "swarm" | "native";
-	serviceId?: string;
 }
 
 export const priorities = [
@@ -53,7 +52,6 @@ export const DockerLogsId: React.FC<Props> = ({
 	containerId,
 	serverId,
 	runType,
-	serviceId,
 }) => {
 	const { data } = api.docker.getConfig.useQuery(
 		{
@@ -159,10 +157,6 @@ export const DockerLogsId: React.FC<Props> = ({
 			params.append("serverId", serverId);
 		}
 
-		if (serviceId) {
-			params.append("serviceId", serviceId);
-		}
-
 		const wsUrl = `${protocol}//${
 			window.location.host
 		}/docker-container-logs?${params.toString()}`;
@@ -228,7 +222,7 @@ export const DockerLogsId: React.FC<Props> = ({
 				ws.close();
 			}
 		};
-	}, [containerId, serverId, serviceId, lines, search, since]);
+	}, [containerId, serverId, lines, search, since]);
 
 	const handleDownload = () => {
 		const logContent = filteredLogs

apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx

@@ -23,14 +23,12 @@ interface Props {
 	containerId: string;
 	serverId?: string;
 	children?: React.ReactNode;
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
 	children,
 	containerId,
 	serverId,
-	serviceId,
 }: Props) => {
 	const [mainDialogOpen, setMainDialogOpen] = useState(false);
 	const [confirmDialogOpen, setConfirmDialogOpen] = useState(false);
@@ -76,7 +74,6 @@ export const DockerTerminalModal = ({
 					id="terminal"
 					containerId={containerId}
 					serverId={serverId || ""}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx

@@ -10,14 +10,12 @@ interface Props {
 	id: string;
 	containerId?: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
 export const DockerTerminal: React.FC<Props> = ({
 	id,
 	containerId,
 	serverId,
-	serviceId,
 }) => {
 	const termRef = useRef(null);
 	const [activeWay, setActiveWay] = React.useState<string | undefined>("bash");
@@ -40,7 +38,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const addonFit = new FitAddon();
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
 
-		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}${serviceId ? `&serviceId=${serviceId}` : ""}`;
+		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}`;
 
 		const ws = new WebSocket(wsUrl);
 

apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralLibsql = ({ libsqlId }: Props) => {
 						)}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.libsqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx

@@ -236,7 +236,6 @@ export const ShowGeneralMariadb = ({ mariadbId }: Props) => {
 							))}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mariadbId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx

@@ -230,7 +230,6 @@ export const ShowGeneralMongo = ({ mongoId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mongoId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx

@@ -228,7 +228,6 @@ export const ShowGeneralMysql = ({ mysqlId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mysqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx

@@ -234,7 +234,6 @@ export const ShowGeneralPostgres = ({ postgresId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.postgresId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralRedis = ({ redisId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.redisId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/settings/ai-form.tsx

@@ -13,14 +13,10 @@ import {
 } from "@/components/ui/card";
 import { api } from "@/utils/api";
 import { HandleAi } from "./handle-ai";
-import { HandleAiProviders } from "./handle-ai-providers";
 
 export const AiForm = () => {
 	const { data: aiConfigs, refetch, isPending } = api.ai.getAll.useQuery();
 	const { mutateAsync, isPending: isRemoving } = api.ai.delete.useMutation();
-	const { data: currentUser } = api.user.get.useQuery();
-	const isOrgAdmin =
-		currentUser?.role === "owner" || currentUser?.role === "admin";
 
 	return (
 		<div className="w-full">
@@ -34,10 +30,7 @@ export const AiForm = () => {
 							</CardTitle>
 							<CardDescription>Manage your AI configurations</CardDescription>
 						</div>
-						<div className="flex flex-row gap-2">
-							{isOrgAdmin && <HandleAiProviders />}
-							{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
-						</div>
+						{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
 					</CardHeader>
 					<CardContent className="space-y-2 py-8 border-t">
 						{isPending ? (

apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx

@@ -1,158 +0,0 @@
-"use client";
-import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import { PlusIcon, ServerIcon, Trash2 } from "lucide-react";
-import { useEffect, useState } from "react";
-import { useFieldArray, useForm } from "react-hook-form";
-import { toast } from "sonner";
-import { z } from "zod";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import {
-	Form,
-	FormControl,
-	FormField,
-	FormItem,
-	FormMessage,
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-import { api } from "@/utils/api";
-
-const Schema = z.object({
-	providers: z.array(
-		z.object({
-			name: z.string().min(1, { message: "Name is required" }),
-			apiUrl: z.string().url({ message: "Please enter a valid URL" }),
-		}),
-	),
-});
-
-type Schema = z.infer<typeof Schema>;
-
-export const HandleAiProviders = () => {
-	const utils = api.useUtils();
-	const [open, setOpen] = useState(false);
-	const { data: providers } = api.ai.getCustomProviders.useQuery();
-	const { mutateAsync, isPending } = api.ai.saveCustomProviders.useMutation();
-
-	const form = useForm<Schema>({
-		resolver: zodResolver(Schema),
-		defaultValues: {
-			providers: [],
-		},
-	});
-
-	const { fields, append, remove } = useFieldArray({
-		control: form.control,
-		name: "providers",
-	});
-
-	useEffect(() => {
-		if (open) {
-			form.reset({ providers: providers ?? [] });
-		}
-	}, [open, providers, form]);
-
-	const onSubmit = async (data: Schema) => {
-		try {
-			await mutateAsync({ providers: data.providers });
-			await utils.ai.getCustomProviders.invalidate();
-			toast.success("Custom providers saved successfully");
-			setOpen(false);
-		} catch (error) {
-			toast.error("Failed to save custom providers", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	return (
-		<Dialog open={open} onOpenChange={setOpen}>
-			<DialogTrigger asChild>
-				<Button variant="outline" className="cursor-pointer space-x-3">
-					<ServerIcon className="h-4 w-4" />
-					Custom Presets
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="sm:max-w-xl">
-				<DialogHeader>
-					<DialogTitle>Custom AI Providers</DialogTitle>
-					<DialogDescription>
-						Define your own AI providers, like an internal LLM platform. When at
-						least one is defined, only these providers can be used in AI
-						configurations.
-					</DialogDescription>
-				</DialogHeader>
-				<Form {...form}>
-					<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
-						{fields.length === 0 && (
-							<p className="text-sm text-muted-foreground">
-								No custom providers defined. The built-in provider list will be
-								used.
-							</p>
-						)}
-						{fields.map((fieldItem, index) => (
-							<div key={fieldItem.id} className="flex gap-2 items-start">
-								<FormField
-									control={form.control}
-									name={`providers.${index}.name`}
-									render={({ field }) => (
-										<FormItem className="flex-1">
-											<FormControl>
-												<Input placeholder="Internal LLM" {...field} />
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name={`providers.${index}.apiUrl`}
-									render={({ field }) => (
-										<FormItem className="flex-[2]">
-											<FormControl>
-												<Input
-													placeholder="https://llm.internal.company/v1"
-													{...field}
-												/>
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<Button
-									type="button"
-									variant="ghost"
-									size="icon"
-									className="group hover:bg-red-500/10"
-									onClick={() => remove(index)}
-								>
-									<Trash2 className="size-4 text-primary group-hover:text-red-500" />
-								</Button>
-							</div>
-						))}
-						<div className="flex justify-between">
-							<Button
-								type="button"
-								variant="outline"
-								onClick={() => append({ name: "", apiUrl: "" })}
-							>
-								<PlusIcon className="h-4 w-4" />
-								Add Provider
-							</Button>
-							<Button type="submit" isLoading={isPending}>
-								Save
-							</Button>
-						</div>
-					</form>
-				</Form>
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/settings/handle-ai.tsx

@@ -99,11 +99,6 @@ export const HandleAi = ({ aiId }: Props) => {
 			enabled: !!aiId,
 		},
 	);
-	const { data: customProviders } = api.ai.getCustomProviders.useQuery();
-	const hasCustomProviders = (customProviders?.length ?? 0) > 0;
-	const providerOptions: { name: string; apiUrl: string }[] = hasCustomProviders
-		? (customProviders ?? [])
-		: [...AI_PROVIDERS];
 	const { mutateAsync, isPending } = aiId
 		? api.ai.update.useMutation()
 		: api.ai.create.useMutation();
@@ -215,9 +210,7 @@ export const HandleAi = ({ aiId }: Props) => {
 							<FormLabel>Provider</FormLabel>
 							<Select
 								onValueChange={(value) => {
-									const provider = providerOptions.find(
-										(p) => p.apiUrl === value,
-									);
+									const provider = AI_PROVIDERS.find((p) => p.apiUrl === value);
 									if (provider) {
 										form.setValue("name", provider.name);
 										form.setValue("apiUrl", provider.apiUrl);
@@ -229,20 +222,15 @@ export const HandleAi = ({ aiId }: Props) => {
 									<SelectValue placeholder="Select a provider preset..." />
 								</SelectTrigger>
 								<SelectContent>
-									{providerOptions.map((provider) => (
-										<SelectItem
-											key={`${provider.name}-${provider.apiUrl}`}
-											value={provider.apiUrl}
-										>
+									{AI_PROVIDERS.map((provider) => (
+										<SelectItem key={provider.apiUrl} value={provider.apiUrl}>
 											{provider.name}
 										</SelectItem>
 									))}
 								</SelectContent>
 							</Select>
 							<p className="text-[0.8rem] text-muted-foreground">
-								{hasCustomProviders
-									? "Select one of the providers defined by your organization"
-									: "Quick-fill provider name and URL, or configure manually below"}
+								Quick-fill provider name and URL, or configure manually below
 							</p>
 						</div>
 
@@ -272,7 +260,6 @@ export const HandleAi = ({ aiId }: Props) => {
 									<FormControl>
 										<Input
 											placeholder="https://api.openai.com/v1"
-											disabled={hasCustomProviders}
 											{...field}
 											onChange={(e) => {
 												field.onChange(e);
@@ -284,9 +271,7 @@ export const HandleAi = ({ aiId }: Props) => {
 										/>
 									</FormControl>
 									<FormDescription>
-										{hasCustomProviders
-											? "The API URL is defined by your organization's providers"
-											: "The base URL for your AI provider's API"}
+										The base URL for your AI provider's API
 									</FormDescription>
 									<FormMessage />
 								</FormItem>

apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx

@@ -100,7 +100,7 @@ export const Enable2FA = () => {
 			});
 
 			if (result.error) {
-				if (result.error.code === "INVALID_CODE") {
+				if (result.error.code === "INVALID_TWO_FACTOR_AUTHENTICATION") {
 					toast.error("Invalid verification code");
 					return;
 				}

apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx

@@ -40,7 +40,6 @@ interface Props {
 	children?: React.ReactNode;
 	serverId?: string;
 	appType?: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
@@ -48,7 +47,6 @@ export const DockerTerminalModal = ({
 	appName,
 	serverId,
 	appType,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -133,7 +131,6 @@ export const DockerTerminalModal = ({
 					serverId={serverId || ""}
 					id="terminal"
 					containerId={containerId || "select-a-container"}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/layouts/side.tsx

@@ -648,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}

apps/dokploy/components/ui/badge.tsx

@@ -5,7 +5,7 @@ import type * as React from "react";
 import { cn } from "@/lib/utils";
 
 const badgeVariants = cva(
-	"group/badge inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-4xl border border-transparent px-2.5 py-0.5 text-xs font-medium whitespace-nowrap transition-all focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&>svg:not(.cursor-pointer)]:pointer-events-none [&>svg]:size-3!",
+	"group/badge inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-4xl border border-transparent px-2.5 py-0.5 text-xs font-medium whitespace-nowrap transition-all focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&>svg]:pointer-events-none [&>svg]:size-3!",
 	{
 		variants: {
 			variant: {

apps/dokploy/components/ui/dropdown-menu.tsx

@@ -1,37 +1,21 @@
 import { CheckIcon, ChevronRightIcon } from "lucide-react";
 import { DropdownMenu as DropdownMenuPrimitive } from "radix-ui";
-import * as React from "react";
+import type * as React from "react";
 import { markNestedPopupClosed } from "@/components/ui/nested-popup-context";
 import { cn } from "@/lib/utils";
 
 function DropdownMenu({
-	open,
-	defaultOpen,
 	onOpenChange,
 	...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
-	const [uncontrolledOpen, setUncontrolledOpen] = React.useState(
-		defaultOpen ?? false,
-	);
-	const isControlled = open !== undefined;
-	const isOpen = isControlled ? open : uncontrolledOpen;
-
 	return (
 		<DropdownMenuPrimitive.Root
 			data-slot="dropdown-menu"
-			open={isOpen}
-			onOpenChange={(nextOpen) => {
-				// Radix closes menus on window blur, unmounting any dialog rendered inside
-				if (!nextOpen && !document.hasFocus()) {
-					return;
-				}
-				if (!isControlled) {
-					setUncontrolledOpen(nextOpen);
-				}
-				if (!nextOpen) {
+			onOpenChange={(open) => {
+				if (!open) {
 					markNestedPopupClosed();
 				}
-				onOpenChange?.(nextOpen);
+				onOpenChange?.(open);
 			}}
 			{...props}
 		/>

apps/dokploy/components/ui/sidebar.tsx

@@ -464,7 +464,7 @@ function SidebarMenuItem({ className, ...props }: React.ComponentProps<"li">) {
 }
 
 const sidebarMenuButtonVariants = cva(
-	"peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-md p-2 text-left text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pr-8 group-data-[collapsible=icon]:size-8! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:font-medium data-active:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
+	"peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-md p-2 text-left text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pr-8 group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:font-medium data-active:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
 	{
 		variants: {
 			variant: {
@@ -473,8 +473,8 @@ const sidebarMenuButtonVariants = cva(
 					"bg-background shadow-[0_0_0_1px_var(--sidebar-border)] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground hover:shadow-[0_0_0_1px_var(--sidebar-accent)]",
 			},
 			size: {
-				default: "h-8 text-sm group-data-[collapsible=icon]:p-2!",
-				sm: "h-7 text-xs group-data-[collapsible=icon]:p-2!",
+				default: "h-8 text-sm",
+				sm: "h-7 text-xs",
 				lg: "h-12 text-sm group-data-[collapsible=icon]:p-0!",
 			},
 		},

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.14",
+	"version": "v0.29.12",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",

apps/dokploy/pages/_error.tsx

@@ -5,11 +5,12 @@ import { buttonVariants } from "@/components/ui/button";
 import { useWhitelabelingPublic } from "@/utils/hooks/use-whitelabeling";
 
 interface Props {
-	statusCode?: number;
+	statusCode: number;
+	error?: Error;
 }
 
-export default function ErrorPage({ statusCode }: Props) {
-	const displayStatusCode = statusCode || 500;
+export default function Custom404({ statusCode, error }: Props) {
+	const displayStatusCode = statusCode || 400;
 	const { config: whitelabeling } = useWhitelabelingPublic();
 	const appName = whitelabeling?.appName || "Dokploy";
 	const logoUrl = whitelabeling?.logoUrl || undefined;
@@ -44,6 +45,12 @@ export default function ErrorPage({ statusCode }: Props) {
 								{errorDescription}
 							</p>
 						)}
+						{error && (
+							<div className="mt-3 text-red-500">
+								<p>{error.message}</p>
+							</div>
+						)}
+
 						<div className="mt-5 flex flex-col justify-center items-center gap-2 sm:flex-row sm:gap-3">
 							<Link
 								href="/dashboard/home"
@@ -94,7 +101,8 @@ export default function ErrorPage({ statusCode }: Props) {
 	);
 }
 
-ErrorPage.getInitialProps = ({ res, err }: NextPageContext) => {
-	const statusCode = res ? res.statusCode : err ? (err.statusCode ?? 500) : 404;
-	return { statusCode };
+// @ts-ignore
+Error.getInitialProps = ({ res, err }: NextPageContext) => {
+	const statusCode = res ? res.statusCode : err ? err.statusCode : 404;
+	return { statusCode, error: err };
 };

apps/dokploy/pages/api/deploy/[refreshToken].ts

@@ -119,11 +119,9 @@ export default async function handler(
 			}
 			// If webhook doesn't provide image info, we'll use the configured image (old behavior)
 		} else if (sourceType === "github") {
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,
@@ -152,29 +150,21 @@ export default async function handler(
 			let normalizedCommits: string[] = [];
 
 			if (provider === "github") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			} else if (provider === "gitlab") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			} else if (provider === "gitea") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			} else if (provider === "soft-serve") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			}
 
 			const shouldDeployPaths = shouldDeploy(
@@ -189,11 +179,9 @@ export default async function handler(
 		} else if (sourceType === "gitlab") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,
@@ -237,11 +225,9 @@ export default async function handler(
 		} else if (sourceType === "gitea") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,

apps/dokploy/pages/api/deploy/compose/[refreshToken].ts

@@ -54,11 +54,9 @@ export default async function handler(
 
 		if (sourceType === "github") {
 			const branchName = extractBranchName(req.headers, req.body);
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,
@@ -76,11 +74,9 @@ export default async function handler(
 			}
 		} else if (sourceType === "gitlab") {
 			const branchName = extractBranchName(req.headers, req.body);
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,
@@ -129,23 +125,17 @@ export default async function handler(
 			let normalizedCommits: string[] = [];
 
 			if (provider === "github") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			} else if (provider === "gitlab") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			} else if (provider === "gitea") {
-				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-					...(commit.added || []),
-					...(commit.modified || []),
-					...(commit.removed || []),
-				]);
+				normalizedCommits = req.body?.commits?.flatMap(
+					(commit: any) => commit.modified,
+				);
 			}
 
 			const shouldDeployPaths = shouldDeploy(
@@ -160,11 +150,9 @@ export default async function handler(
 		} else if (sourceType === "gitea") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = req.body?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,

apps/dokploy/pages/api/deploy/github.ts

@@ -223,11 +223,9 @@ export default async function handler(
 			const deploymentTitle = extractCommitMessage(req.headers, req.body);
 			const deploymentHash = extractHash(req.headers, req.body);
 			const owner = getGithubRepositoryOwner(githubBody);
-			const normalizedCommits = githubBody?.commits?.flatMap((commit: any) => [
-				...(commit.added || []),
-				...(commit.modified || []),
-				...(commit.removed || []),
-			]);
+			const normalizedCommits = githubBody?.commits?.flatMap(
+				(commit: any) => commit.modified,
+			);
 
 			const apps = await db.query.applications.findMany({
 				where: and(

apps/dokploy/pages/api/providers/github/setup.ts

@@ -1,6 +1,5 @@
-import { createGithub, validateRequest } from "@dokploy/server";
+import { createGithub } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
-import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";
@@ -22,22 +21,18 @@ export default async function handler(
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
 	}
-
-	const { user, session } = await validateRequest(req);
-	if (!user || !session?.activeOrganizationId) {
-		return res.status(401).json({ error: "Unauthorized" });
-	}
-	const ctx = {
-		user: { id: user.id },
-		session: { activeOrganizationId: session.activeOrganizationId },
-	};
-
-	const [action] = state?.split(":") ?? [];
-	if (!(await hasPermission(ctx, { gitProviders: ["create"] }))) {
-		return res.status(403).json({ error: "Forbidden" });
-	}
+	const [action, ...rest] = state?.split(":");
+	// For gh_init: rest[0] = organizationId, rest[1] = userId
+	// For gh_setup: rest[0] = githubProviderId
 
 	if (action === "gh_init") {
+		const organizationId = rest[0];
+		const userId = rest[1] || (req.query.userId as string);
+
+		if (!userId) {
+			return res.status(400).json({ error: "Missing userId parameter" });
+		}
+
 		const octokit = new Octokit({});
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
@@ -56,32 +51,16 @@ export default async function handler(
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
 			},
-			session.activeOrganizationId,
-			user.id,
+			organizationId as string,
+			userId,
 		);
 	} else if (action === "gh_setup") {
-		const githubId = state?.split(":")[1];
-		if (!githubId) {
-			return res.status(400).json({ error: "Missing github provider id" });
-		}
-
-		const provider = await db.query.github.findFirst({
-			where: eq(github.githubId, githubId),
-			with: { gitProvider: true },
-		});
-		if (
-			!provider ||
-			provider.gitProvider.organizationId !== session.activeOrganizationId
-		) {
-			return res.status(404).json({ error: "Github provider not found" });
-		}
-
 		await db
 			.update(github)
 			.set({
 				githubInstallationId: installation_id,
 			})
-			.where(eq(github.githubId, githubId))
+			.where(eq(github.githubId, rest[0] as string))
 			.returning();
 	}
 

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx

@@ -347,7 +347,6 @@ const Service = (
 												<ShowDockerLogs
 													appName={data?.appName || ""}
 													serverId={data?.serverId || ""}
-													serviceId={data?.applicationId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx

@@ -312,7 +312,6 @@ const Service = (
 													serverId={data?.serverId || undefined}
 													appName={data?.appName || ""}
 													appType={data?.composeType || "docker-compose"}
-													serviceId={data?.composeId}
 												/>
 											</div>
 										</TabsContent>
@@ -381,13 +380,11 @@ const Service = (
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														appType={data?.composeType || "docker-compose"}
-														serviceId={data?.composeId}
 													/>
 												) : (
 													<ShowDockerLogsStack
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.composeId}
 													/>
 												)}
 											</div>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx

@@ -269,7 +269,6 @@ const Libsql = (
 											<ShowDockerLogs
 												serverId={data?.serverId || ""}
 												appName={data?.appName || ""}
-												serviceId={data?.libsqlId}
 											/>
 										</div>
 									</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx

@@ -299,7 +299,6 @@ const Mariadb = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mariadbId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx

@@ -299,7 +299,6 @@ const Mongo = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mongoId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx

@@ -276,7 +276,6 @@ const MySql = (
 													<ShowDockerLogs
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.mysqlId}
 													/>
 												</div>
 											</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx

@@ -284,7 +284,6 @@ const Postgresql = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.postgresId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx

@@ -297,7 +297,6 @@ const Redis = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.redisId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/server/api/routers/ai.ts

@@ -1,7 +1,6 @@
 import { IS_CLOUD } from "@dokploy/server/constants";
 import {
 	apiCreateAi,
-	apiSaveAiCustomProviders,
 	apiUpdateAi,
 	deploySuggestionSchema,
 } from "@dokploy/server/db/schema/ai";
@@ -14,9 +13,7 @@ import {
 	deleteAiSettings,
 	getAiSettingById,
 	getAiSettingsByOrganizationId,
-	getCustomAiProviders,
 	saveAiSettings,
-	saveCustomAiProviders,
 	suggestVariants,
 } from "@dokploy/server/services/ai";
 import { createComposeByTemplate } from "@dokploy/server/services/compose";
@@ -203,19 +200,6 @@ export const aiRouter = createTRPCRouter({
 			return await deleteAiSettings(input.aiId);
 		}),
 
-	getCustomProviders: protectedProcedure.query(async ({ ctx }) => {
-		return await getCustomAiProviders(ctx.session.activeOrganizationId);
-	}),
-
-	saveCustomProviders: adminProcedure
-		.input(apiSaveAiCustomProviders)
-		.mutation(async ({ ctx, input }) => {
-			return await saveCustomAiProviders(
-				ctx.session.activeOrganizationId,
-				input.providers,
-			);
-		}),
-
 	getEnabledProviders: protectedProcedure.query(async ({ ctx }) => {
 		const settings = await getAiSettingsByOrganizationId(
 			ctx.session.activeOrganizationId,

apps/dokploy/server/api/routers/application.ts

@@ -4,7 +4,6 @@ import {
 	deleteAllMiddlewares,
 	findApplicationById,
 	findEnvironmentById,
-	findPreviewDeploymentsByApplicationId,
 	findProjectById,
 	getAccessibleServerIds,
 	getApplicationStats,
@@ -17,7 +16,6 @@ import {
 	removeDeployments,
 	removeDirectoryCode,
 	removeMonitoringDirectory,
-	removePreviewDeployment,
 	removeService,
 	removeTraefikConfig,
 	startService,
@@ -236,15 +234,6 @@ export const applicationRouter = createTRPCRouter({
 				});
 			}
 
-			const previewDeploymentsList =
-				await findPreviewDeploymentsByApplicationId(input.applicationId);
-
-			for (const previewDeployment of previewDeploymentsList) {
-				try {
-					await removePreviewDeployment(previewDeployment.previewDeploymentId);
-				} catch (_) {}
-			}
-
 			const result = await db
 				.delete(applications)
 				.where(eq(applications.applicationId, input.applicationId))

apps/dokploy/server/api/routers/backup.ts

@@ -49,7 +49,6 @@ import {
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,
@@ -511,7 +510,7 @@ export const backupRouter = createTRPCRouter({
 						: input.search;
 
 				const searchPath = baseDir ? `${bucketPath}/${baseDir}` : bucketPath;
-				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} ${quote([searchPath])} --no-mimetype --no-modtime 2>/dev/null`;
+				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} "${searchPath}" --no-mimetype --no-modtime 2>/dev/null`;
 
 				let stdout = "";
 

apps/dokploy/server/api/routers/bitbucket.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createBitbucket,
 	findBitbucketById,
 	getAccessibleGitProviderIds,
@@ -52,10 +51,8 @@ export const bitbucketRouter = createTRPCRouter({
 		}),
 	one: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
-			const bitbucket = await findBitbucketById(input.bitbucketId);
-			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
-			return bitbucket;
+		.query(async ({ input }) => {
+			return await findBitbucketById(input.bitbucketId);
 		}),
 	bitbucketProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -81,26 +78,18 @@ export const bitbucketRouter = createTRPCRouter({
 
 	getBitbucketRepositories: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
-			const bitbucket = await findBitbucketById(input.bitbucketId);
-			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
+		.query(async ({ input }) => {
 			return await getBitbucketRepositories(input.bitbucketId);
 		}),
 	getBitbucketBranches: protectedProcedure
 		.input(apiFindBitbucketBranches)
-		.query(async ({ input, ctx }) => {
-			if (input.bitbucketId) {
-				const bitbucket = await findBitbucketById(input.bitbucketId);
-				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
-			}
+		.query(async ({ input }) => {
 			return await getBitbucketBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiBitbucketTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const bitbucket = await findBitbucketById(input.bitbucketId);
-				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 				const result = await testBitbucketConnection(input);
 
 				return `Found ${result} repositories`;

apps/dokploy/server/api/routers/cluster.ts

@@ -6,7 +6,6 @@ import {
 	getRemoteDocker,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { getLocalServerIp } from "@/server/wss/terminal";
@@ -52,8 +51,8 @@ export const clusterRouter = createTRPCRouter({
 				}
 			}
 			try {
-				const drainCommand = `docker node update --availability drain ${quote([input.nodeId])}`;
-				const removeCommand = `docker node rm ${quote([input.nodeId])} --force`;
+				const drainCommand = `docker node update --availability drain ${input.nodeId}`;
+				const removeCommand = `docker node rm ${input.nodeId} --force`;
 
 				if (input.serverId) {
 					await execAsyncRemote(input.serverId, drainCommand);

apps/dokploy/server/api/routers/destination.ts

@@ -10,7 +10,6 @@ import {
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {
@@ -59,10 +58,10 @@ export const destinationRouter = createTRPCRouter({
 			} = input;
 			try {
 				const rcloneFlags = [
-					`--s3-access-key-id=${quote([accessKey])}`,
-					`--s3-secret-access-key=${quote([secretAccessKey])}`,
-					`--s3-region=${quote([region])}`,
-					`--s3-endpoint=${quote([endpoint])}`,
+					`--s3-access-key-id="${accessKey}"`,
+					`--s3-secret-access-key="${secretAccessKey}"`,
+					`--s3-region="${region}"`,
+					`--s3-endpoint="${endpoint}"`,
 					"--s3-no-check-bucket",
 					"--s3-force-path-style",
 					"--retries 1",
@@ -71,13 +70,13 @@ export const destinationRouter = createTRPCRouter({
 					"--contimeout 5s",
 				];
 				if (provider) {
-					rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+					rcloneFlags.unshift(`--s3-provider="${provider}"`);
 				}
 				if (additionalFlags?.length) {
 					rcloneFlags.push(...additionalFlags);
 				}
 				const rcloneDestination = `:s3:${bucket}`;
-				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} ${quote([rcloneDestination])}`;
+				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} "${rcloneDestination}"`;
 
 				if (IS_CLOUD && !input.serverId) {
 					throw new TRPCError({

apps/dokploy/server/api/routers/gitea.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createGitea,
 	findGiteaById,
 	getAccessibleGitProviderIds,
@@ -54,13 +53,9 @@ export const giteaRouter = createTRPCRouter({
 			}
 		}),
 
-	one: protectedProcedure
-		.input(apiFindOneGitea)
-		.query(async ({ input, ctx }) => {
-			const gitea = await findGiteaById(input.giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-			return gitea;
-		}),
+	one: protectedProcedure.input(apiFindOneGitea).query(async ({ input }) => {
+		return await findGiteaById(input.giteaId);
+	}),
 
 	giteaProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -94,7 +89,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaRepositories: protectedProcedure
 		.input(apiFindOneGitea)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId } = input;
 
 			if (!giteaId) {
@@ -104,9 +99,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				const repositories = await getGiteaRepositories(giteaId);
 				return repositories;
@@ -121,7 +113,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaBranches: protectedProcedure
 		.input(apiFindGiteaBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId, owner, repositoryName } = input;
 
 			if (!giteaId || !owner || !repositoryName) {
@@ -132,9 +124,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				return await getGiteaBranches({
 					giteaId,
@@ -152,12 +141,9 @@ export const giteaRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiGiteaTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			const giteaId = input.giteaId ?? "";
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				const result = await testGiteaConnection({
 					giteaId,

apps/dokploy/server/api/routers/github.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	findGithubById,
 	getAccessibleGitProviderIds,
 	getGithubBranches,
@@ -23,27 +22,17 @@ import {
 } from "@/server/db/schema";
 
 export const githubRouter = createTRPCRouter({
-	one: protectedProcedure
-		.input(apiFindOneGithub)
-		.query(async ({ input, ctx }) => {
-			const github = await findGithubById(input.githubId);
-			await assertGitProviderAccess(ctx.session, github.gitProvider);
-			return github;
-		}),
+	one: protectedProcedure.input(apiFindOneGithub).query(async ({ input }) => {
+		return await findGithubById(input.githubId);
+	}),
 	getGithubRepositories: protectedProcedure
 		.input(apiFindOneGithub)
-		.query(async ({ input, ctx }) => {
-			const github = await findGithubById(input.githubId);
-			await assertGitProviderAccess(ctx.session, github.gitProvider);
+		.query(async ({ input }) => {
 			return await getGithubRepositories(input.githubId);
 		}),
 	getGithubBranches: protectedProcedure
 		.input(apiFindGithubBranches)
-		.query(async ({ input, ctx }) => {
-			if (input.githubId) {
-				const github = await findGithubById(input.githubId);
-				await assertGitProviderAccess(ctx.session, github.gitProvider);
-			}
+		.query(async ({ input }) => {
 			return await getGithubBranches(input);
 		}),
 	githubProviders: protectedProcedure.query(async ({ ctx }) => {
@@ -78,10 +67,8 @@ export const githubRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiFindOneGithub)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const github = await findGithubById(input.githubId);
-				await assertGitProviderAccess(ctx.session, github.gitProvider);
 				const result = await getGithubRepositories(input.githubId);
 				return `Found ${result.length} repositories`;
 			} catch (err) {

apps/dokploy/server/api/routers/gitlab.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createGitlab,
 	findGitlabById,
 	getAccessibleGitProviderIds,
@@ -52,13 +51,9 @@ export const gitlabRouter = createTRPCRouter({
 				});
 			}
 		}),
-	one: protectedProcedure
-		.input(apiFindOneGitlab)
-		.query(async ({ input, ctx }) => {
-			const gitlab = await findGitlabById(input.gitlabId);
-			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
-			return gitlab;
-		}),
+	one: protectedProcedure.input(apiFindOneGitlab).query(async ({ input }) => {
+		return await findGitlabById(input.gitlabId);
+	}),
 	gitlabProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
 
@@ -91,27 +86,19 @@ export const gitlabRouter = createTRPCRouter({
 	}),
 	getGitlabRepositories: protectedProcedure
 		.input(apiFindOneGitlab)
-		.query(async ({ input, ctx }) => {
-			const gitlab = await findGitlabById(input.gitlabId);
-			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
+		.query(async ({ input }) => {
 			return await getGitlabRepositories(input.gitlabId);
 		}),
 
 	getGitlabBranches: protectedProcedure
 		.input(apiFindGitlabBranches)
-		.query(async ({ input, ctx }) => {
-			if (input.gitlabId) {
-				const gitlab = await findGitlabById(input.gitlabId);
-				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
-			}
+		.query(async ({ input }) => {
 			return await getGitlabBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiGitlabTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const gitlab = await findGitlabById(input.gitlabId);
-				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 				const result = await testGitlabConnection(input);
 
 				return `Found ${result} repositories`;

apps/dokploy/server/api/routers/registry.ts

@@ -5,7 +5,6 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
-	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -123,11 +122,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							input.registryUrl,
-							input.username,
-							input.password,
-						),
+						`echo ${input.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -187,11 +182,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							registryData.registryUrl,
-							registryData.username,
-							registryData.password,
-						),
+						`echo ${registryData.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {

apps/dokploy/server/api/routers/schedule.ts

@@ -13,7 +13,6 @@ import {
 	findMemberByUserId,
 } from "@dokploy/server/services/permission";
 import {
-	assertHostScheduleAccess,
 	createSchedule,
 	deleteSchedule,
 	findScheduleById,
@@ -32,8 +31,6 @@ export const scheduleRouter = createTRPCRouter({
 	create: protectedProcedure
 		.input(createScheduleSchema)
 		.mutation(async ({ input, ctx }) => {
-			await assertHostScheduleAccess(ctx, input.scheduleType, input.serverId);
-
 			const serviceId = input.applicationId || input.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
@@ -47,14 +44,51 @@ export const scheduleRouter = createTRPCRouter({
 					);
 				}
 			} else {
+				if (input.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
 
-				if (IS_CLOUD && input.scheduleType === "server" && input.serverId) {
-					await assertScheduledJobLimit(
+				if (
+					input.scheduleType === "server" ||
+					input.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
 						ctx.session.activeOrganizationId,
-						"server",
-						input.serverId,
 					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (input.scheduleType === "server" && input.serverId) {
+					const targetServer = await findServerById(input.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+
+					if (IS_CLOUD) {
+						await assertScheduledJobLimit(
+							ctx.session.activeOrganizationId,
+							"server",
+							input.serverId,
+						);
+					}
 				}
 			}
 			const newSchedule = await createSchedule({
@@ -101,22 +135,6 @@ export const scheduleRouter = createTRPCRouter({
 				});
 			}
 
-			await assertHostScheduleAccess(
-				ctx,
-				existingSchedule.scheduleType,
-				existingSchedule.serverId,
-			);
-			if (
-				input.scheduleType &&
-				input.scheduleType !== existingSchedule.scheduleType
-			) {
-				await assertHostScheduleAccess(
-					ctx,
-					input.scheduleType,
-					input.serverId ?? existingSchedule.serverId,
-				);
-			}
-
 			const serviceId =
 				existingSchedule.applicationId || existingSchedule.composeId;
 			if (serviceId) {
@@ -124,7 +142,47 @@ export const scheduleRouter = createTRPCRouter({
 					schedule: ["update"],
 				});
 			} else {
+				if (existingSchedule.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["update"] });
+
+				if (
+					existingSchedule.scheduleType === "server" ||
+					existingSchedule.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (
+					existingSchedule.scheduleType === "server" &&
+					existingSchedule.serverId
+				) {
+					const targetServer = await findServerById(existingSchedule.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			const updatedSchedule = await updateSchedule(input);
 
@@ -164,19 +222,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string() }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["delete"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["delete"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			await deleteSchedule(input.scheduleId);
 
@@ -300,32 +389,59 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string().min(1) }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["create"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			try {
-				const deployment = await runCommand(input.scheduleId);
+				await runCommand(input.scheduleId);
 				await audit(ctx, {
 					action: "run",
 					resourceType: "schedule",
 					resourceId: input.scheduleId,
 				});
-				return {
-					status: deployment.status,
-					deploymentId: deployment.deploymentId,
-					logPath: deployment.logPath,
-				};
+				return true;
 			} catch (error) {
 				throw new TRPCError({
 					code: "INTERNAL_SERVER_ERROR",

apps/dokploy/server/api/routers/server.ts

@@ -9,7 +9,6 @@ import {
 	getPublicIpWithFallback,
 	haveActiveServices,
 	IS_CLOUD,
-	redactServerSshKey,
 	removeDeploymentsByServerId,
 	serverAudit,
 	serverSetup,
@@ -106,7 +105,7 @@ export const serverRouter = createTRPCRouter({
 				});
 			}
 
-			return redactServerSshKey(server);
+			return server;
 		}),
 	getDefaultCommand: withPermission("server", "read")
 		.input(apiFindOneServer)
@@ -413,14 +412,6 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
-				const currentServer = await findServerById(input.serverId);
-				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to delete this server",
-					});
-				}
-
 				const activeServers = await haveActiveServices(input.serverId);
 
 				if (activeServers) {
@@ -429,6 +420,7 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
+				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",
@@ -444,7 +436,7 @@ export const serverRouter = createTRPCRouter({
 					await updateServersBasedOnQuantity(admin.id, admin.serversQuantity);
 				}
 
-				return redactServerSshKey(currentServer);
+				return currentServer;
 			} catch (error) {
 				throw error;
 			}

apps/dokploy/server/api/routers/swarm.ts

@@ -18,30 +18,12 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
+		.query(async ({ input }) => {
 			return await getSwarmNodes(input.serverId);
 		}),
 	getNodeInfo: withPermission("server", "read")
 		.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
-		.query(async ({ input, ctx }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
+		.query(async ({ input }) => {
 			return await getNodeInfo(input.nodeId, input.serverId);
 		}),
 	getNodeApps: withPermission("server", "read")
@@ -50,16 +32,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
+		.query(async ({ input }) => {
 			return getNodeApplications(input.serverId);
 		}),
 	getAppInfos: withPermission("server", "read")
@@ -81,16 +54,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
+		.query(async ({ input }) => {
 			return await getApplicationInfo(input.appName, input.serverId);
 		}),
 	getContainerStats: withPermission("server", "read")

apps/dokploy/server/api/routers/volume-backups.ts

@@ -13,8 +13,6 @@ import { db } from "@dokploy/server/db";
 import {
 	createVolumeBackupSchema,
 	updateVolumeBackupSchema,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
 	volumeBackups,
 } from "@dokploy/server/db/schema";
 import { findDestinationById } from "@dokploy/server/services/destination";
@@ -277,10 +275,7 @@ export const volumeBackupsRouter = createTRPCRouter({
 			z.object({
 				backupFileName: z.string().min(1),
 				destinationId: z.string().min(1),
-				volumeName: z
-					.string()
-					.min(1)
-					.regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
+				volumeName: z.string().min(1),
 				id: z.string().min(1),
 				serviceType: z.enum(["application", "compose"]),
 				serverId: z.string().optional(),

apps/dokploy/server/wss/authorize.ts

@@ -1,89 +0,0 @@
-import { getAccessibleServerIds } from "@dokploy/server";
-import {
-	checkServiceAccess,
-	findMemberByUserId,
-	hasPermission,
-} from "@dokploy/server/services/permission";
-
-type WssUser = { id: string } | null | undefined;
-type WssSession = { activeOrganizationId?: string | null } | null | undefined;
-
-const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
-	user: { id: user.id },
-	session: { activeOrganizationId },
-});
-
-// Authorizes docker/container operations opened over a WebSocket (container
-// terminal, container logs, container stats). Requires the docker permission
-// (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
-// remote server, that the server is accessible to the caller. Previously these
-// handlers only checked session + organization, so any member could reach a
-// root shell / logs of any container.
-export const canAccessDockerOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-	serviceId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	const ctx = buildCtx(user, session.activeOrganizationId);
-
-	// When the container belongs to a specific Dokploy service (opened from a
-	// service page, so serviceId is present), access to that service is the
-	// authoritative gate — matching the service tRPC endpoints (e.g.
-	// application.readLogs, which check service access only). A member granted
-	// the service can read its logs / open its terminal even without the broad
-	// "docker" permission or explicit access to the server it runs on.
-	if (serviceId) {
-		try {
-			await checkServiceAccess(ctx, serviceId, "read");
-			return true;
-		} catch {
-			return false;
-		}
-	}
-
-	// Generic Docker overview (no service context): mirror the docker tRPC router
-	// — require the docker permission and access to the target server.
-	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		if (!accessible.has(serverId)) return false;
-	}
-
-	return true;
-};
-
-// Authorizes the host/server SSH terminal opened over a WebSocket. The local
-// host terminal is a root shell on the control-plane host, so it is restricted
-// to owner/admin. A remote server terminal is gated on server access.
-export const canAccessTerminalOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		return accessible.has(serverId);
-	}
-
-	try {
-		const member = await findMemberByUserId(
-			user.id,
-			session.activeOrganizationId,
-		);
-		return member?.role === "owner" || member?.role === "admin";
-	} catch {
-		return false;
-	}
-};

apps/dokploy/server/wss/docker-container-logs.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import {
 	getShell,
 	isValidContainerId,
@@ -42,7 +41,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 		const since = url.searchParams.get("since") ?? "all";
 		const serverId = url.searchParams.get("serverId");
 		const runType = url.searchParams.get("runType");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -76,11 +74,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		// Set up keep-alive ping mechanism to prevent timeout
 		// Send ping every 45 seconds to keep connection alive
 		const pingInterval = setInterval(() => {

apps/dokploy/server/wss/docker-container-terminal.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import { isValidContainerId, isValidShell } from "./utils";
 
 export const setupDockerContainerTerminalWebSocketServer = (
@@ -33,7 +32,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 		const containerId = url.searchParams.get("containerId");
 		const activeWay = url.searchParams.get("activeWay");
 		const serverId = url.searchParams.get("serverId");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -60,11 +58,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		try {
 			if (serverId) {
 				const server = await findServerById(serverId);

apps/dokploy/server/wss/docker-stats.ts

@@ -9,7 +9,6 @@ import {
 	validateRequest,
 } from "@dokploy/server";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -45,7 +44,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			| "application"
 			| "stack"
 			| "docker-compose";
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!appName) {
@@ -57,11 +55,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, null, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		const intervalId = setInterval(async () => {
 			try {
 				// Special case: when monitoring "dokploy", get host system stats instead of container stats

apps/dokploy/server/wss/terminal.ts

@@ -9,7 +9,6 @@ import { publicIpv4, publicIpv6 } from "public-ip";
 import { Client, type ConnectConfig } from "ssh2";
 import { WebSocketServer } from "ws";
 import { getDockerHost } from "../utils/docker";
-import { canAccessTerminalOverWss } from "./authorize";
 import { setupLocalServerSSHKey } from "./utils";
 
 const COMMAND_TO_ALLOW_LOCAL_ACCESS = `
@@ -94,11 +93,6 @@ export const setupTerminalWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessTerminalOverWss(user, session, serverId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		let connectionDetails: ConnectConfig = {};
 
 		const isLocalServer = serverId === "local";

apps/dokploy/styles/globals.css

@@ -269,12 +269,6 @@
 		@apply bg-background text-foreground;
 	}
 
-	/* Cursor pointer on buttons */
-	button:not([disabled]),
-	[role="button"]:not([disabled]) {
-		cursor: pointer;
-	}
-
 	/* Custom scrollbar styling */
 	::-webkit-scrollbar {
 		width: 0.3125rem;

apps/schedules/src/utils.ts

@@ -180,9 +180,6 @@ export const initializeJobs = async () => {
 		where: eq(schedules.enabled, true),
 		with: {
 			application: {
-				columns: {
-					applicationId: true,
-				},
 				with: {
 					server: true,
 				},
@@ -230,9 +227,6 @@ export const initializeJobs = async () => {
 		where: eq(volumeBackups.enabled, true),
 		with: {
 			application: {
-				columns: {
-					applicationId: true,
-				},
 				with: {
 					server: true,
 				},

packages/server/src/db/schema/ai.ts

@@ -54,15 +54,6 @@ export const apiUpdateAi = createSchema
 	})
 	.omit({ organizationId: true });
 
-export const aiCustomProviderSchema = z.object({
-	name: z.string().min(1, { message: "Name is required" }),
-	apiUrl: z.string().url({ message: "Please enter a valid URL" }),
-});
-
-export const apiSaveAiCustomProviders = z.object({
-	providers: z.array(aiCustomProviderSchema),
-});
-
 export const deploySuggestionSchema = z.object({
 	environmentId: z.string().min(1),
 	id: z.string().min(1),

packages/server/src/db/schema/rollbacks.ts

@@ -1,5 +1,4 @@
 import type { Application } from "@dokploy/server/services/application";
-import type { Environment } from "@dokploy/server/services/environment";
 import type { Mount } from "@dokploy/server/services/mount";
 import type { Port } from "@dokploy/server/services/port";
 import type { Project } from "@dokploy/server/services/project";
@@ -28,7 +27,7 @@ export const rollbacks = pgTable("rollback", {
 		.$defaultFn(() => new Date().toISOString()),
 	fullContext: jsonb("fullContext").$type<
 		Application & {
-			environment: Environment & {
+			environment: {
 				project: Project;
 			};
 			mounts: Mount[];

packages/server/src/db/schema/schedule.ts

@@ -57,7 +57,6 @@ export const schedules = pgTable("schedule", {
 });
 
 export type Schedule = typeof schedules.$inferSelect;
-export type ScheduleType = Schedule["scheduleType"];
 
 export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	application: one(applications, {
@@ -79,9 +78,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	deployments: many(deployments),
 }));
 
-export const createScheduleSchema = createInsertSchema(schedules, {
-	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
-});
+export const createScheduleSchema = createInsertSchema(schedules);
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),

packages/server/src/db/schema/utils.ts

@@ -41,12 +41,6 @@ export const APP_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
 export const APP_NAME_MESSAGE =
 	"App name can only contain letters, numbers, dots, underscores and hyphens";
 
-/** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
-export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
-
-export const VOLUME_NAME_MESSAGE =
-	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";
-
 /** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
 export const DATABASE_PASSWORD_REGEX =
 	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;

packages/server/src/db/schema/volume-backups.ts

@@ -14,11 +14,7 @@ import { serviceType } from "./mount";
 import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
-import {
-	generateAppName,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
-} from "./utils";
+import { generateAppName } from "./utils";
 
 export const volumeBackups = pgTable("volume_backup", {
 	volumeBackupId: text("volumeBackupId")
@@ -117,9 +113,7 @@ export const volumeBackupsRelations = relations(
 	}),
 );
 
-export const createVolumeBackupSchema = createInsertSchema(volumeBackups, {
-	volumeName: z.string().regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
-}).omit({
+export const createVolumeBackupSchema = createInsertSchema(volumeBackups).omit({
 	volumeBackupId: true,
 });
 

packages/server/src/lib/auth.ts

@@ -419,7 +419,7 @@ const createBetterAuth = () =>
 				enableMetadata: true,
 				references: "user",
 			}),
-			sso({ trustEmailVerified: true }),
+			sso(),
 			scim({
 				beforeSCIMTokenGenerated: async ({ user }) => {
 					const dbUser = await db.query.user.findFirst({

packages/server/src/services/ai.ts

@@ -1,6 +1,5 @@
 import { db } from "@dokploy/server/db";
-import { ai, organization } from "@dokploy/server/db/schema";
-import { aiCustomProviderSchema } from "@dokploy/server/db/schema/ai";
+import { ai } from "@dokploy/server/db/schema";
 import { selectAIProvider } from "@dokploy/server/utils/ai/select-ai-provider";
 import { TRPCError } from "@trpc/server";
 import { generateText, Output } from "ai";
@@ -49,74 +48,9 @@ export const getAiSettingById = async (aiId: string) => {
 	return aiSetting;
 };
 
-type AiCustomProvider = z.infer<typeof aiCustomProviderSchema>;
-
-const parseOrgMetadata = (metadata: string | null) => {
-	try {
-		const parsed = JSON.parse(metadata || "{}");
-		return typeof parsed === "object" && parsed !== null
-			? (parsed as Record<string, unknown>)
-			: {};
-	} catch {
-		return {};
-	}
-};
-
-export const getCustomAiProviders = async (organizationId: string) => {
-	const org = await db.query.organization.findFirst({
-		where: eq(organization.id, organizationId),
-	});
-	const metadata = parseOrgMetadata(org?.metadata ?? null);
-	const result = z
-		.array(aiCustomProviderSchema)
-		.safeParse(metadata.aiProviders);
-	return result.success ? result.data : [];
-};
-
-export const saveCustomAiProviders = async (
-	organizationId: string,
-	providers: AiCustomProvider[],
-) => {
-	const org = await db.query.organization.findFirst({
-		where: eq(organization.id, organizationId),
-	});
-	if (!org) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Organization not found",
-		});
-	}
-	const metadata = parseOrgMetadata(org.metadata);
-	metadata.aiProviders = providers;
-	await db
-		.update(organization)
-		.set({ metadata: JSON.stringify(metadata) })
-		.where(eq(organization.id, organizationId));
-	return providers;
-};
-
-const normalizeApiUrl = (url: string) => url.trim().replace(/\/+$/, "");
-
 export const saveAiSettings = async (organizationId: string, settings: any) => {
 	const aiId = settings.aiId;
 
-	if (settings.apiUrl) {
-		const customProviders = await getCustomAiProviders(organizationId);
-		if (customProviders.length > 0) {
-			const isAllowed = customProviders.some(
-				(provider) =>
-					normalizeApiUrl(provider.apiUrl) === normalizeApiUrl(settings.apiUrl),
-			);
-			if (!isAllowed) {
-				throw new TRPCError({
-					code: "FORBIDDEN",
-					message:
-						"This API URL is not in your organization's allowed AI providers",
-				});
-			}
-		}
-	}
-
 	return db
 		.insert(ai)
 		.values({

packages/server/src/services/application.ts

@@ -102,24 +102,10 @@ export const findApplicationById = async (applicationId: string) => {
 			redirects: true,
 			security: true,
 			ports: true,
-			gitlab: {
-				columns: { secret: false, accessToken: false, refreshToken: false },
-			},
-			github: {
-				columns: {
-					githubClientSecret: false,
-					githubPrivateKey: false,
-					githubWebhookSecret: false,
-				},
-			},
-			bitbucket: { columns: { appPassword: false, apiToken: false } },
-			gitea: {
-				columns: {
-					clientSecret: false,
-					accessToken: false,
-					refreshToken: false,
-				},
-			},
+			gitlab: true,
+			github: true,
+			bitbucket: true,
+			gitea: true,
 			server: true,
 			previewDeployments: true,
 			registry: { columns: { password: false } },

packages/server/src/services/certificate.ts

@@ -9,7 +9,6 @@ import {
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
@@ -64,7 +63,7 @@ export const removeCertificateById = async (certificateId: string) => {
 	const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath);
 
 	if (certificate.serverId) {
-		await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`);
+		await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`);
 	} else {
 		await removeDirectoryIfExistsContent(certDir);
 	}
@@ -109,10 +108,10 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		const certificateData = encodeBase64(certificate.certificateData);
 		const privateKey = encodeBase64(certificate.privateKey);
 		const command = `
-			mkdir -p ${quote([certDir])};
-			echo "${certificateData}" | base64 -d > ${quote([crtPath])};
-			echo "${privateKey}" | base64 -d > ${quote([keyPath])};
-			echo "${yamlConfig}" > ${quote([configFile])};
+			mkdir -p ${certDir};
+			echo "${certificateData}" | base64 -d > "${crtPath}";
+			echo "${privateKey}" | base64 -d > "${keyPath}";
+			echo "${yamlConfig}" > "${configFile}";
 		`;
 
 		await execAsyncRemote(certificate.serverId, command);

packages/server/src/services/compose.ts

@@ -33,7 +33,6 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
@@ -473,7 +472,7 @@ export const startCompose = async (composeId: string) => {
 		const projectPath = join(COMPOSE_PATH, compose.appName, "code");
 		const path =
 			compose.sourceType === "raw" ? "docker-compose.yml" : compose.composePath;
-		const baseCommand = `env -i PATH="$PATH" docker compose -p ${quote([compose.appName])} -f ${quote([path])} up -d`;
+		const baseCommand = `env -i PATH="$PATH" docker compose -p ${compose.appName} -f ${path} up -d`;
 		if (compose.composeType === "docker-compose") {
 			if (compose.serverId) {
 				await execAsyncRemote(