feat(schedules): auto-update stacks by Stack Label (#1717)

* feat(schedules): auto-update stacks by Stack Label Add a reusable selector_type/selector_value on scheduled tasks so admins can schedule image updates against live Stack Label membership across the fleet or one node, reusing fleet label resolution and the existing auto-update orchestrator. * fix(image-updates): sanitize auto-update execute failure logs Use a static format string and sanitizeForLog so CodeQL no longer flags user-controlled stack names and error text in the execute catch. * fix(ui): space Scope label from fleet/node segmented control Match the Schedule row layout so the inline SegmentedControl no longer sits flush against the Scope label. * fix(ui): remove redundant wrapper around Scope segmented control
2026-08-07 01:14:14 +00:00 · 2026-07-28 13:00:47 -04:00
parent fa503ddf27
commit 72cdbb0eaa
18 changed files with 883 additions and 72 deletions
@@ -41,8 +41,25 @@ import {
  RISK_DOT_CLASSES,
  RISK_LABEL,
 } from '@/lib/scheduledActions';
+import { LabelNameAutocomplete, type LabelNameSuggestion } from '@/components/labels/LabelNameAutocomplete';

 const DEFAULT_PRUNE_TARGETS = ['containers', 'images', 'networks', 'volumes'];
+
+interface LabelMatchPreviewNode {
+  nodeId: number;
+  nodeName: string;
+  reachable: boolean;
+  labelExists: boolean;
+  stackCount: number;
+  stackNames: string[];
+  error?: string;
+}
+interface LabelMatchPreview {
+  matchedNodes: number;
+  matchedStacks: number;
+  unreachableNodes: number;
+  perNode: LabelMatchPreviewNode[];
+}
 const DEFAULT_SIMPLE_SCHEDULE: SimpleSchedule = {
  frequency: 'daily', minute: 0, hour: 3, weekdays: [], dayOfMonth: 1, date: null,
 };
@@ -114,6 +131,12 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
  const [formPruneTargets, setFormPruneTargets] = useState<string[]>(DEFAULT_PRUNE_TARGETS);
  const [formTargetServices, setFormTargetServices] = useState<string[]>([]);
  const [formPruneLabelFilter, setFormPruneLabelFilter] = useState('');
+  const [formSelectorValue, setFormSelectorValue] = useState('');
+  const [formLabelScope, setFormLabelScope] = useState<'fleet' | 'node'>('fleet');
+  const [labelSuggestions, setLabelSuggestions] = useState<LabelNameSuggestion[]>([]);
+  const [labelPreview, setLabelPreview] = useState<
+    { kind: 'idle' } | { kind: 'loading' } | { kind: 'unavailable' } | { kind: 'ready'; data: LabelMatchPreview }
+  >({ kind: 'idle' });
  const [availableServices, setAvailableServices] = useState<string[]>([]);
  const [saving, setSaving] = useState(false);
  const [runningTaskId, setRunningTaskId] = useState<number | null>(null);
@@ -236,6 +259,65 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
    return () => { cancelled = true; };
  }, [formAction, formTargetId, formNodeId]);

+  useEffect(() => {
+    if (!dialogOpen || formAction !== 'update-by-label') return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await apiFetch('/fleet/labels/suggestions', { localOnly: true });
+        if (!res.ok || cancelled) return;
+        const body = await res.json() as { suggestions?: LabelNameSuggestion[] };
+        const list = Array.isArray(body.suggestions)
+          ? body.suggestions.filter(s => s && typeof s.name === 'string' && s.scope === 'stack')
+          : [];
+        if (!cancelled) setLabelSuggestions(list);
+      } catch {
+        if (!cancelled) setLabelSuggestions([]);
+      }
+    })();
+    return () => { cancelled = true; };
+  }, [dialogOpen, formAction]);
+
+  useEffect(() => {
+    if (!dialogOpen || formAction !== 'update-by-label') {
+      setLabelPreview({ kind: 'idle' });
+      return;
+    }
+    const trimmed = formSelectorValue.trim();
+    if (!trimmed) {
+      setLabelPreview({ kind: 'idle' });
+      return;
+    }
+    let cancelled = false;
+    setLabelPreview({ kind: 'loading' });
+    const timer = window.setTimeout(async () => {
+      try {
+        const res = await apiFetch('/fleet/labels/match-preview', {
+          method: 'POST',
+          body: JSON.stringify({ labelName: trimmed }),
+          localOnly: true,
+        });
+        if (cancelled) return;
+        if (!res.ok) {
+          setLabelPreview({ kind: 'unavailable' });
+          return;
+        }
+        const data = await res.json() as LabelMatchPreview;
+        if (!data || !Array.isArray(data.perNode)) {
+          setLabelPreview({ kind: 'unavailable' });
+          return;
+        }
+        setLabelPreview({ kind: 'ready', data });
+      } catch {
+        if (!cancelled) setLabelPreview({ kind: 'unavailable' });
+      }
+    }, 500);
+    return () => {
+      cancelled = true;
+      window.clearTimeout(timer);
+    };
+  }, [dialogOpen, formAction, formSelectorValue]);
+
  useEffect(() => {
    if (!dialogOpen) return;
    const actionDef = getActionById(formAction);
@@ -267,6 +349,9 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
    setFormPruneTargets(DEFAULT_PRUNE_TARGETS);
    setFormTargetServices([]);
    setFormPruneLabelFilter('');
+    setFormSelectorValue('');
+    setFormLabelScope('fleet');
+    setLabelPreview({ kind: 'idle' });
    setDialogOpen(true);
    if (nodeId) fetchStacks(nodeId);
  };
@@ -299,6 +384,13 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
      task.target_services ? JSON.parse(task.target_services) : []
    );
    setFormPruneLabelFilter(task.prune_label_filter || '');
+    setFormSelectorValue(task.selector_value || '');
+    setFormLabelScope(
+      task.selector_type === 'stack-label'
+        ? (task.node_id == null ? 'fleet' : 'node')
+        : 'fleet',
+    );
+    setLabelPreview({ kind: 'idle' });
    setDialogOpen(true);
  };

@@ -328,6 +420,7 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
    // every recurring shape and for Advanced mode, where the cron is authoritative.
    const runAt = scheduleMode === 'simple' ? getOnceRunAt(simpleSchedule) : null;

+    const isLabelUpdate = formAction === 'update-by-label';
    const body: Record<string, unknown> = {
      name: formName,
      target_type: actionDef.targetType,
@@ -337,10 +430,14 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
      delete_after_run: formDeleteAfterRun,
      run_at: runAt,
      target_id: (actionDef.requiresStack || actionDef.requiresContainer) ? formTargetId : null,
-      node_id: actionDef.requiresNode && formNodeId ? parseInt(formNodeId, 10) : null,
+      node_id: isLabelUpdate
+        ? (formLabelScope === 'node' && formNodeId ? parseInt(formNodeId, 10) : null)
+        : (actionDef.requiresNode && formNodeId ? parseInt(formNodeId, 10) : null),
      prune_targets: formAction === 'prune' && formPruneTargets.length > 0 ? formPruneTargets : null,
      target_services: actionDef.supportsServiceSelection && formTargetServices.length > 0 ? formTargetServices : null,
      prune_label_filter: formAction === 'prune' && formPruneLabelFilter.trim() ? formPruneLabelFilter.trim() : null,
+      selector_type: isLabelUpdate ? 'stack-label' : null,
+      selector_value: isLabelUpdate ? formSelectorValue.trim() : null,
    };

    setSaving(true);
@@ -515,7 +612,11 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
    || (!!currentAction?.requiresStack && (!formTargetId || !formNodeId))
    || (!!currentAction?.requiresContainer && (!formTargetId || !formNodeId))
    || (!!currentAction?.requiresNode && !currentAction.requiresStack && !currentAction.requiresContainer && !formNodeId)
-    || (formAction === 'prune' && formPruneTargets.length === 0);
+    || (formAction === 'prune' && formPruneTargets.length === 0)
+    || (formAction === 'update-by-label' && (
+      !formSelectorValue.trim()
+      || (formLabelScope === 'node' && !formNodeId)
+    ));

  const windowEnd = now + TIMELINE_WINDOW_MS;
  const timelinePills = filteredTasks
@@ -738,15 +839,20 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
                      </Badge>
                    </TableCell>
                    <TableCell className="text-sm text-muted-foreground">
-                      {task.target_type === 'stack'
-                        ? task.target_services
-                          ? `${task.target_id} (${(JSON.parse(task.target_services) as string[]).join(', ')})`
-                          : task.target_id
-                        : task.target_type === 'container'
-                          ? task.target_id
-                        : task.action === 'update'
-                          ? 'All eligible stacks'
-                          : task.target_type}
+                      {task.selector_type === 'stack-label' && task.selector_value
+                        ? scheduleTargetDescriptor(
+                          task,
+                          task.node_id != null ? nodes.find(n => n.id === task.node_id)?.name : undefined,
+                        )
+                        : task.target_type === 'stack'
+                          ? task.target_services
+                            ? `${task.target_id} (${(JSON.parse(task.target_services) as string[]).join(', ')})`
+                            : task.target_id
+                          : task.target_type === 'container'
+                            ? task.target_id
+                            : task.action === 'update'
+                              ? 'All eligible stacks'
+                              : task.target_type}
                    </TableCell>
                    <TableCell>
                      <div className="text-sm">{getCronDescription(task.cron_expression)}</div>
@@ -855,7 +961,16 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
              <Combobox
                options={actionOptions}
                value={formAction}
-                onValueChange={(val) => { setFormAction(val); setFormTargetId(''); setFormNodeId(''); setFormTargetServices([]); setFormPruneLabelFilter(''); }}
+                onValueChange={(val) => {
+                  setFormAction(val);
+                  setFormTargetId('');
+                  setFormNodeId('');
+                  setFormTargetServices([]);
+                  setFormPruneLabelFilter('');
+                  setFormSelectorValue('');
+                  setFormLabelScope('fleet');
+                  setLabelPreview({ kind: 'idle' });
+                }}
                placeholder="Select action..."
              />
              {currentAction && (
@@ -960,6 +1075,94 @@ export default function ScheduledOperationsView({ filterNodeId, onClearFilter, p
              </div>
            )}

+            {formAction === 'update-by-label' && (
+              <>
+                <div className="space-y-2">
+                  <Label>Stack Label</Label>
+                  <LabelNameAutocomplete
+                    id="schedule-label-input"
+                    value={formSelectorValue}
+                    onChange={setFormSelectorValue}
+                    suggestions={labelSuggestions}
+                    placeholder="Select or type a label name..."
+                  />
+                </div>
+                <div className="flex items-center justify-between gap-3">
+                  <Label>Scope</Label>
+                  <SegmentedControl<'fleet' | 'node'>
+                    value={formLabelScope}
+                    options={[
+                      { value: 'fleet', label: 'Entire fleet' },
+                      { value: 'node', label: 'Selected node' },
+                    ]}
+                    onChange={(v) => {
+                      setFormLabelScope(v);
+                      if (v === 'fleet') setFormNodeId('');
+                    }}
+                    ariaLabel="Label update scope"
+                  />
+                </div>
+                {formLabelScope === 'node' && (
+                  <div className="space-y-2">
+                    <Label>Node</Label>
+                    <Combobox
+                      options={nodeOptions}
+                      value={formNodeId}
+                      onValueChange={setFormNodeId}
+                      placeholder="Select node..."
+                    />
+                  </div>
+                )}
+                <div className="rounded-md border border-glass-border bg-input/40 px-3 py-2 space-y-1.5">
+                  <div className="text-[10px] font-mono uppercase tracking-[0.18em] text-stat-subtitle">Current matches</div>
+                  {labelPreview.kind === 'idle' && (
+                    <p className="text-xs text-muted-foreground">Enter a label name to preview matching stacks.</p>
+                  )}
+                  {labelPreview.kind === 'loading' && (
+                    <p className="text-xs text-muted-foreground">Resolving label membership...</p>
+                  )}
+                  {labelPreview.kind === 'unavailable' && (
+                    <p className="text-xs text-warning">Preview unavailable. You can still save; membership is resolved at run time.</p>
+                  )}
+                  {labelPreview.kind === 'ready' && (() => {
+                    const scoped = formLabelScope === 'node' && formNodeId
+                      ? {
+                          ...labelPreview.data,
+                          perNode: labelPreview.data.perNode.filter(n => String(n.nodeId) === formNodeId),
+                        }
+                      : labelPreview.data;
+                    const matchedStacks = scoped.perNode
+                      .filter(n => n.reachable)
+                      .reduce((sum, n) => sum + n.stackCount, 0);
+                    const reachableNodes = scoped.perNode.filter(n => n.reachable && n.stackCount > 0).length;
+                    const unreachable = scoped.perNode.filter(n => !n.reachable);
+                    return (
+                      <div className="space-y-1.5">
+                        <p className="text-xs text-foreground">
+                          {matchedStacks} stack{matchedStacks === 1 ? '' : 's'} on {reachableNodes} node{reachableNodes === 1 ? '' : 's'}
+                          {unreachable.length > 0 ? ` · ${unreachable.length} unreachable` : ''}
+                        </p>
+                        {matchedStacks === 0 && (
+                          <p className="text-xs text-warning">
+                            No stacks currently match this label. You can still save; membership is resolved at each run.
+                          </p>
+                        )}
+                        <ul className="space-y-1 max-h-28 overflow-y-auto">
+                          {scoped.perNode.map(n => (
+                            <li key={n.nodeId} className="text-[11px] font-mono text-stat-subtitle">
+                              {n.nodeName}: {n.reachable
+                                ? (n.stackCount > 0 ? n.stackNames.slice(0, 8).join(', ') + (n.stackNames.length > 8 ? '…' : '') : 'no match')
+                                : `unreachable${n.error ? ` (${n.error})` : ''}`}
+                            </li>
+                          ))}
+                        </ul>
+                      </div>
+                    );
+                  })()}
+                </div>
+              </>
+            )}
+
            {currentAction?.requiresNode && !currentAction.requiresStack && !currentAction.requiresContainer && (
              <div className="space-y-2">
                <Label>Node</Label>
@@ -0,0 +1,111 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { Input } from '@/components/ui/input';
+
+export interface LabelNameSuggestion {
+  name: string;
+  scope: 'stack';
+  nodeCount: number;
+  stackCount: number;
+  nodes?: string[];
+}
+
+interface LabelNameAutocompleteProps {
+  value: string;
+  onChange: (next: string) => void;
+  suggestions: LabelNameSuggestion[];
+  disabled?: boolean;
+  placeholder?: string;
+  id?: string;
+}
+
+/**
+ * Free-form label-name input with a suggestion popover. Used by Scheduled
+ * Operations label targeting; the operator may type a name that is not
+ * suggested (membership is resolved at preview/run time).
+ */
+export function LabelNameAutocomplete({
+  value,
+  onChange,
+  suggestions,
+  disabled,
+  placeholder,
+  id = 'label-name-input',
+}: LabelNameAutocompleteProps) {
+  const [open, setOpen] = useState(false);
+  const wrapperRef = useRef<HTMLDivElement>(null);
+
+  const filtered = useMemo(() => {
+    const q = value.trim().toLowerCase();
+    if (q.length === 0) return suggestions;
+    return suggestions.filter(s => s.name.toLowerCase().includes(q));
+  }, [value, suggestions]);
+
+  useEffect(() => {
+    if (!open) return;
+    const onClick = (e: MouseEvent) => {
+      if (wrapperRef.current && !wrapperRef.current.contains(e.target as Node)) {
+        setOpen(false);
+      }
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        e.stopPropagation();
+        setOpen(false);
+      }
+    };
+    document.addEventListener('mousedown', onClick);
+    document.addEventListener('keydown', onKey, true);
+    return () => {
+      document.removeEventListener('mousedown', onClick);
+      document.removeEventListener('keydown', onKey, true);
+    };
+  }, [open]);
+
+  return (
+    <div ref={wrapperRef} className="relative">
+      <Input
+        id={id}
+        value={value}
+        onChange={(e) => {
+          onChange(e.target.value);
+          if (!open) setOpen(true);
+        }}
+        onFocus={() => { if (!disabled) setOpen(true); }}
+        placeholder={placeholder}
+        className="h-9 text-sm"
+        disabled={disabled}
+        autoComplete="off"
+        spellCheck={false}
+      />
+      {open && filtered.length > 0 && (
+        <div className="absolute left-0 top-full mt-1 z-50 w-full rounded-md border border-glass-border bg-popover text-popover-foreground shadow-md backdrop-blur-[10px] backdrop-saturate-[1.15]">
+          <ul className="max-h-[200px] overflow-y-auto overflow-x-hidden p-1">
+            {filtered.map((s) => {
+              const nodes = s.nodes ?? [];
+              return (
+                <li key={s.name}>
+                  <button
+                    type="button"
+                    onMouseDown={(e) => { e.preventDefault(); onChange(s.name); setOpen(false); }}
+                    title={nodes.join(', ')}
+                    className="flex w-full flex-col gap-0.5 rounded-sm px-2 py-1.5 font-mono text-xs text-stat-value hover:bg-accent hover:text-accent-foreground"
+                  >
+                    <span className="flex w-full items-center gap-2">
+                      <span className="flex-1 min-w-0 truncate text-left">{s.name}</span>
+                      <span className="shrink-0 text-[10px] text-stat-subtitle">
+                        {s.stackCount} stack{s.stackCount === 1 ? '' : 's'} · {s.nodeCount} node{s.nodeCount === 1 ? '' : 's'}
+                      </span>
+                    </span>
+                    {nodes.length > 0 && (
+                      <span className="w-full truncate text-left text-[10px] text-stat-icon">{nodes.join(', ')}</span>
+                    )}
+                  </button>
+                </li>
+              );
+            })}
+          </ul>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -79,6 +79,21 @@ describe('scheduledActions registry', () => {
  });

  describe('resolveTaskAction', () => {
+    it('maps update + fleet + stack-label selector to update-by-label', () => {
+      const def = resolveTaskAction({
+        action: 'update',
+        target_type: 'fleet',
+        selector_type: 'stack-label',
+      });
+      expect(def?.id).toBe('update-by-label');
+      expect(def?.backendAction).toBe('update');
+    });
+
+    it('maps update + fleet without selector to update-fleet', () => {
+      const def = resolveTaskAction({ action: 'update', target_type: 'fleet', selector_type: null });
+      expect(def?.id).toBe('update-fleet');
+    });
+
    it('maps update + fleet to the update-fleet UI entry', () => {
      const def = resolveTaskAction({ action: 'update', target_type: 'fleet' });
      expect(def?.id).toBe('update-fleet');
@@ -116,7 +131,7 @@ describe('scheduledActions registry', () => {
    expect(ids).toEqual([
      'auto_backup', 'auto_start', 'restart', 'auto_stop', 'auto_down',
      'container-restart', 'container-stop', 'container-start',
-      'update', 'update-fleet',
+      'update', 'update-fleet', 'update-by-label',
      'scan',
      'prune',
      'snapshot',
@@ -130,6 +145,14 @@ describe('scheduledActions registry', () => {
    expect(fleetUpdate!.targetType).toBe('fleet');
  });

+  it('preserves the update-by-label alias', () => {
+    const byLabel = SCHEDULED_ACTIONS.find(a => a.id === 'update-by-label');
+    expect(byLabel).toBeDefined();
+    expect(byLabel!.backendAction).toBe('update');
+    expect(byLabel!.targetType).toBe('fleet');
+    expect(byLabel!.requiresNode).toBe(false);
+  });
+
  describe('helperText', () => {
    const expected: Record<string, string> = {
      'auto_backup': 'Backs up compose and env files only. This does not back up application volumes.',
@@ -142,6 +165,7 @@ describe('scheduledActions registry', () => {
      'container-start': 'Starts a stopped container by name on the selected node.',
      'update': "Checks this stack's images and recreates the stack only when newer images are available.",
      'update-fleet': 'Checks every stack on the selected node and updates stacks with newer images.',
+      'update-by-label': 'Resolves stacks that currently carry a Stack Label at each run, across the entire fleet or one node, and updates those with newer images.',
      'scan': 'Runs Trivy against images on the selected local node and records the findings.',
      'prune': 'Removes unused Docker resources on the selected node. Be careful when pruning volumes.',
      'snapshot': 'Creates a versioned snapshot of compose and env files across the fleet.',
@@ -166,6 +190,7 @@ describe('scheduledActions registry', () => {
      'container-start': 'runtime-change',
      'update': 'runtime-change',
      'update-fleet': 'runtime-change',
+      'update-by-label': 'runtime-change',
      'scan': 'read-only',
      'prune': 'destructive',
      'snapshot': 'safe',
@@ -238,6 +263,22 @@ describe('scheduledActions registry', () => {
      expect(scheduleTargetDescriptor(task)).toBe('All stacks');
    });

+    it('shows Label: name · Entire fleet or node for stack-label selectors', () => {
+      const fleet = {
+        action: 'update' as const,
+        target_type: 'fleet' as const,
+        target_id: null,
+        name: 'Label update',
+        selector_type: 'stack-label',
+        selector_value: 'Production',
+        node_id: null as number | null,
+      };
+      expect(scheduleTargetDescriptor(fleet)).toBe('Label: Production · Entire fleet');
+      const scoped = { ...fleet, node_id: 7 };
+      expect(scheduleTargetDescriptor(scoped, 'Node A')).toBe('Label: Production · Node A');
+      expect(scheduleTargetDescriptor(scoped)).toBe('Label: Production · node 7');
+    });
+
    it('shows Entire fleet for a fleet snapshot regardless of node', () => {
      const task: TargetTask = { action: 'snapshot', target_type: 'fleet', target_id: null, name: 'Nightly Snapshot' };
      expect(scheduleTargetDescriptor(task, 'edge-1')).toBe('Entire fleet');
@@ -19,7 +19,7 @@ export type BackendAction = ScheduledTask['action'];
 * UI action ids. `update-fleet` is a frontend-only alias for `update` with
 * `target_type: 'fleet'`; it never reaches the backend.
 */
-export type ScheduledActionId = BackendAction | 'update-fleet' | 'container-restart' | 'container-stop' | 'container-start';
+export type ScheduledActionId = BackendAction | 'update-fleet' | 'update-by-label' | 'container-restart' | 'container-stop' | 'container-start';

 export type ScheduledActionCategory = 'lifecycle' | 'updates' | 'security' | 'maintenance' | 'backups';
 export type ScheduledActionTone = 'success' | 'warning' | 'destructive' | 'brand';
@@ -105,6 +105,7 @@ export const SCHEDULED_ACTIONS: ScheduledActionDefinition[] = [
  // Updates
  { id: 'update', backendAction: 'update', label: 'Auto-update Stack', shortLabel: 'update', category: 'updates', targetType: 'stack', tone: 'success', requiresNode: true, requiresStack: true, requiresContainer: false, supportsServiceSelection: false, helperText: 'Checks this stack\'s images and recreates the stack only when newer images are available.', riskLevel: 'runtime-change' },
  { id: 'update-fleet', backendAction: 'update', label: 'Auto-update All Stacks on Node', shortLabel: 'update node', category: 'updates', targetType: 'fleet', tone: 'success', requiresNode: true, requiresStack: false, requiresContainer: false, supportsServiceSelection: false, helperText: 'Checks every stack on the selected node and updates stacks with newer images.', riskLevel: 'runtime-change' },
+  { id: 'update-by-label', backendAction: 'update', label: 'Auto-update stacks by label', shortLabel: 'update label', category: 'updates', targetType: 'fleet', tone: 'success', requiresNode: false, requiresStack: false, requiresContainer: false, supportsServiceSelection: false, helperText: 'Resolves stacks that currently carry a Stack Label at each run, across the entire fleet or one node, and updates those with newer images.', riskLevel: 'runtime-change' },
  // Security
  { id: 'scan', backendAction: 'scan', label: 'Scan Node Images', shortLabel: 'scan', category: 'security', targetType: 'system', tone: 'success', requiresNode: true, requiresStack: false, requiresContainer: false, supportsServiceSelection: false, nodeScope: 'local', helperText: 'Runs Trivy against images on the selected local node and records the findings.', riskLevel: 'read-only' },
  // Maintenance
@@ -121,12 +122,15 @@ export function getActionById(id: string): ScheduledActionDefinition | undefined

 /**
 * Resolve a stored task to its action definition. A stored `update` task with a
- * `fleet` target maps to the `update-fleet` UI entry; everything else maps by
- * its backend action id.
+ * stack-label selector maps to `update-by-label`; a plain fleet update maps to
+ * `update-fleet`; everything else maps by its backend action id.
 */
 export function resolveTaskAction(
-  task: Pick<ScheduledTask, 'action' | 'target_type'>,
+  task: Pick<ScheduledTask, 'action' | 'target_type'> & { selector_type?: string | null },
 ): ScheduledActionDefinition | undefined {
+  if (task.action === 'update' && task.target_type === 'fleet' && task.selector_type === 'stack-label') {
+    return getActionById('update-by-label');
+  }
  if (task.action === 'update' && task.target_type === 'fleet') {
    return getActionById('update-fleet');
  }
@@ -147,12 +151,23 @@ export function stripComposeExt(name: string): string {
 * Category-aware label for what a scheduled run acts on, used by the Timeline
 * pills and the mobile schedule list. Stack actions show the stack, fleet
 * snapshots show the whole fleet, fleet updates and node-scoped actions
- * (prune / scan) show the selected node when its name is known.
+ * (prune / scan) show the selected node when its name is known. Label-targeted
+ * updates show the label name and fleet or node scope.
 */
 export function scheduleTargetDescriptor(
-  task: Pick<ScheduledTask, 'action' | 'target_type' | 'target_id' | 'name'>,
+  task: Pick<ScheduledTask, 'action' | 'target_type' | 'target_id' | 'name'> & {
+    selector_type?: string | null;
+    selector_value?: string | null;
+    node_id?: number | null;
+  },
  nodeName?: string,
 ): string {
+  if (task.selector_type === 'stack-label' && task.selector_value) {
+    if (task.node_id != null) {
+      return `Label: ${task.selector_value} · ${nodeName ?? `node ${task.node_id}`}`;
+    }
+    return `Label: ${task.selector_value} · Entire fleet`;
+  }
  switch (task.target_type) {
    case 'stack':
      return stripComposeExt(task.target_id ?? task.name);
@@ -17,6 +17,8 @@ export interface ScheduledTask {
  prune_targets: string | null;
  target_services: string | null;
  prune_label_filter: string | null;
+  selector_type?: string | null;
+  selector_value?: string | null;
  delete_after_run?: number;
  // Absolute epoch-ms fire time for a one-time ('once') schedule; null/absent for
  // recurring shapes. Persisted so the chosen instant (including year) survives