This commit addresses 6 critical security and UX issues in Docker agent
token handling identified through code review:
**High Priority Fixes:**
1. Fix stale token in command preview - Changed DockerAgents to use
getInstallCommandTemplate() that always returns placeholder, allowing
CommandBuilder to handle all token substitution reactively. Command
preview now updates live as user types.
2. Fix misleading "multiple tokens" messaging - Updated token generation
modal to accurately reflect single-token backend model with red warning:
"This will immediately invalidate your existing token". Prevents operators
from unknowingly breaking active Docker agents.
3. Close proxy auth bypass vulnerability - Both HandleRegenerateAPIToken
and HandleValidateAPIToken now explicitly reject requests when proxy auth
is configured but validation fails (returns 401). Prevents unauthenticated
access when proxy auth is enabled.
**Medium Priority Fixes:**
4. Disable buttons when no stored token - "Use This Token" and "Copy" buttons
now properly disabled with contextual tooltips when browser hasn't saved
a token, eliminating confusing silent no-ops.
5. Improve frontend error handling - Token validation now distinguishes
between authentication errors (401/403), rate limiting (429), network
failures, and actual invalid tokens. No longer mislabels auth failures
as "invalid token".
**Low Priority Fixes:**
6. Add authentication to validate-token endpoint - Endpoint now requires
admin authentication (same as regenerate-token), preventing unauthenticated
token guessing oracle despite rate limiting.
**New Component:**
- CommandBuilder.tsx: Interactive command builder with live preview,
state-based visual cues, inline token generation, and validation
**Security Impact:**
- Closes unauthenticated validation surface
- Enforces proper proxy auth gating
- Prevents accidental exposure of security model
- Rate limiting maintained (10 attempts/min)
**UX Impact:**
- Clear, accurate error messages
- Live-updating command preview
- Contextual token management
- Disabled states prevent confusion
Reviewed and verified by both Claude Code and Codex with no regressions found.
PVE polling is hardcoded to 10s since Proxmox cluster/resources endpoint only updates every 10s internally. Setting faster polling intervals was wasteful and provided no benefit.
Removed:
- POLLING_INTERVAL env variable and all references
- pollingInterval from config structs and API responses
- UI settings for polling interval (already removed)
- Dynamic polling interval updates via SIGHUP
- Legacy persistence code for saving polling settings
The monitoring loop now uses a hardcoded 10s interval matching Proxmox's update frequency.
- API tokens now work even when DISABLE_AUTH is set
- Added API token section back to Security tab in settings
- API tokens can protect API access for automation while keeping UI open
- Invalid tokens are rejected even with auth disabled
- Export/import endpoints still require valid API token
- API tokens now hashed before storage (never stored in plain text)
- Raw token shown only once during generation
- Backward compatible with existing plain text tokens
- Added migration warnings for users with plain tokens
- Updated documentation to reflect security improvements
- Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox
- Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle)
- Remove polling interval settings from UI (no longer user-configurable)
- Implement efficient VM/container polling using single cluster/resources API call
- Remove 'Remove Password' feature (auth is now mandatory)
- Fix CSRF validation for Basic Auth (exempt from CSRF checks)
- Fix Generate API Token modal and authentication
- Remove redundant 'Active' status from Authentication section
- Remove Connection Timeout setting from frontend (backend-only)
- Clean up frontend console logging (reduce verbosity)
- Remove PBS polling interval setting (fixed at 10s)
- Add frontend rebuild detection to backend-watch script
- Improve first-run setup flow and error handling
- Add backend endpoint to regenerate API tokens without resetting auth
- Updates .env file with new token while preserving other settings
- Frontend component with clear UX for token generation
- Shows new token once with copy functionality
- Indicates restart required to activate new token
- Works across all deployment types (Docker, LXC, native)
Much better UX than telling users to 'reconfigure security' just for a new token
- Add pending restart detection when .env exists but not loaded
- Update frontend to show pending state instead of re-showing setup
- Fix QuickSecuritySetup to refresh security status after configuration
- Remove auto-restart attempts from security setup
- Show deployment-appropriate restart instructions
- Update documentation to reflect new update mechanism
Related to security setup issues after removing sudo/auto-restart capabilities
rcourtman