4 Commits

Author	SHA1	Message	Date
Anso	b1decbb32a	docs: v1 docs refresh (batch 7) (#1627) ... * docs(introduction): refresh screenshots and correct stale nav/tab coverage Replace all 5 screenshots with fresh 1920x1080 production captures. Document the shipped Take down stack action, the Compose Labels stack tab, and the Docker Labels Fleet tab, none of which were mentioned. Correct the Console nav item to note it is a limited-availability surface rather than a plain role/tier-gated view. * docs(quickstart): refresh screenshots and correct preflight, dashboard, and menu drift Replace all three quickstart screenshots with fresh captures and correct several claims that drifted from the current UI: - Document the environment preflight's 7th check (Sencho compose location), previously missing entirely from both the text and the screenshot alt text. - Add the Stack health table's Source and Port columns, and note that columns are sortable and default to load order. - Note the masthead's running-container count, live CPU/memory readout, and alert count. - Fix the profile menu list: replace the nonexistent "Feedback" entry with "Open New Issue", drop "Appearance" (it lives in Settings, not the profile menu), and add the conditional "Billing" entry. - Note that the sidebar groups stacks by Docker Compose label once labels are assigned, with pinned stacks first. * docs(configuration): document missing env vars and fix JWT secret wording Add SENCHO_UPLOAD_DIR, TRIVY_CACHE_DIR, SENCHO_MESH_RECONCILE_INTERVAL_MS, SENCHO_MESH_PROXY_TUNNEL_IDLE_MS, SENCHO_COMPOSE_COMMAND_TIMEOUT_MS, and SSO_OIDC_CUSTOM_ENABLED, all real environment variables that were missing from the reference tables. Clarify that the JWT signing secret has no environment variable at all, generated and stored in the database only, rather than implying an unused JWT_SECRET var exists. * docs(stack-management): refresh against current live app and source Rewrites the Stack Management page against the production node and frontend source: adds the Compose Labels anatomy tab (new since the last refresh), the Mute action on the stack header and sidebar context menu, corrects the update-available banner wording and the sidebar context menu's lifecycle ordering, notes the Doctor tab's severity dot and the scan-status banner, and replaces all 14 screenshots with fresh production captures. * docs(editor): refresh against current live app and source Replace all 8 screenshots with fresh 1920x1080 production captures (mobile shot at phone viewport). Document the self-stack protection dialog that blocks deploy/delete actions on the stack running the current Sencho instance, the multi-container summary strip and Compact/Detailed density toggle, the mutually exclusive Expand containers / Expand logs controls, the Files tab full-screen toggle, and the post-deploy scan-status banner on the Anatomy panel, none of which were previously covered. * docs(editor): recapture mobile compose screenshot without redaction The previous mobile screenshot used the plex stack, whose compose volume mount includes a real host path that had to be blacked out and overlaid with placeholder text, leaving a visible seam. Recapture against the dozzle stack instead, whose only volume is the Docker socket, so the screenshot needs no editing. * docs(stack-file-explorer): refresh page against current app and code Renames "Files & Volumes tab" references to the current "Files" tab label, documents the full-screen toggle and word-wrap control, expands the non-browsable-volume reasons to match the current containment logic (single-file binds, the full protected host-path list, and the Docker-unreachable named-volume case), documents the 100-item bulk selection cap and the 5000-file/1 GiB archive limits, corrects the non-existent DISK_FULL error code, notes that override compose files are unprotected, and scopes the atomic-write claim to fs-backed roots. Replaces all 9 screenshots with fresh production captures taken in the Files tab's full-screen mode, so no other stack UI (health metrics, logs) appears in the background. * docs(resources): refresh against current live app and source * docs(dashboard): refresh against current live app and source * docs(app-store): refresh against current live app and source Replaces all 6 screenshots with fresh production captures and corrects the Environment Variables and About-panel metadata claims to match what the bundled LinuxServer.io registry actually returns today. * fix(docs): recapture app-store advanced-tab screenshot without scroll cut-off The prior capture was taken mid-scroll to reveal the Security checkbox, leaving the template logo and About text cropped awkwardly at the top. * docs(global-search): refresh against current live app and source * docs(deep-links): refresh against current live app and source - Add App Store, Logs, Update, Console, and Audit to the URL table (previously undocumented) - Document hub-only URL redirect behavior and cross-link to Multi-Node Fleet - Note Fleet tab URL segments do not always match their on-screen label (Status/configuration, Map/dependencies) - Document the no-env-files edge case (Env tab absent, falls back to compose) - Clarify Settings section-list state is phone-only; desktop always normalizes to /settings/appearance - Note which top-level views share identical URLs between desktop and phone - Remove greenfield-violating temporal phrasing ("now has", "as today") - Replace em dashes in touched bullet list * docs(appearance): refresh against current live app and source * docs(stack-activity): refresh against current live app and source Add the missing "Stack taken down" event category, cross-link the Suppressed badge to notification mute rules, list the new Compose Labels tab in the Anatomy panel strip, and replace both screenshots with current production captures. * docs(dossier): fix generated-facts wording, add rollback readiness section Corrects three Dossier tab Generated Facts rows against current frontend behavior: the Ports count is not filtered to host-published mappings, the Network row's "bridge" label is fixed text rather than a derived driver, and missing env var names appear only in the Markdown export, not the live tab. Adds a Rollback Readiness subsection under Connected Features (previously only an orphaned Limitations bullet), links to Compose Networking and Storage Portability, and clarifies that a missing export section can mean either an older node build or a failed on-demand fetch, not only a version gap. Recaptures all three screenshots against production. * docs(stack-drift): refresh against current live app and source Fixes the stack detail tab bar description (Compose Labels tab was missing, Files/Edit compose were wrongly listed as tabs), documents that re-check only requires read access to the stack (so viewer and auditor roles can trigger a ledger write), and cross-links the network findings to the Networking tab's runtime drift section and the Fleet Overview's Drift filter. Replaces all four screenshots with fresh 1920x1080 production captures. * docs(compose-doctor): refresh against current live app and source Corrects the rule count from 31 to 32 and documents the previously undocumented self-managed-stack guard rule and enforcement, the per-browser dismiss control for the summary card and Doctor tab dot, the acknowledged summary state, the full Health-Gated Updates verdict mapping, and the temporary exposure intent option. Replaces all four screenshots with production captures. * docs(compose-networking): refresh against current live app and source Adds cross-links to the new node-wide Networking operator page, documents the "view node networking" link and the unset/inherit exposure-intent pill labels, corrects the stale Resources Hub network-tab reference, and replaces all screenshots against the production node. * fix(docs): unbreak stack-activity page render The screenshot alt text used backslash-escaped quotes, which is invalid MDX/HTML attribute syntax. Mintlify failed to parse the file and silently dropped it from routing, so the page 404'd despite being listed in docs.json navigation. * docs(environment-guardrails): refresh against current live app and source Fix the ENV FILES section description: it lists env_file: entries and project files with an existence problem, not every declared env file. A cleanly-resolving project file is already named in the Project Environment File panel above it. Replace all three screenshots with current production captures. * docs(docker-label-audit): refresh against current live app and source Add production screenshots (page had none), a Capability gating section, a Limitations section, and a Troubleshooting accordion. Tighten the secret-redaction heuristic description and cross-link Stack Labels, Compose Doctor, Environment Guardrails, and Node Compatibility. * docs(compose-storage): refresh against current live app and source Captured fresh production screenshots (both prior images were stale) and fixed a leftover pre-rename card title pointing at the Files tab. * docs(stack-labels): refresh against current live app and source Removed the stale trailing-dot sidebar claim (that rendering was removed from the sidebar in a prior UI pass), documented the new label-scoped notification muting available from the sidebar, stack context menu, and Settings panel, corrected the Fleet Actions card copy to match the redesigned cards, added the previously undocumented bulk-assign size cap and the node-scoped label bulk-action API, and replaced all 8 screenshots with fresh production captures. * docs(sidebar): refresh against current live app and source Removes the stale per-row label dot claim (removed from StackRow), corrects the update indicator and Updates chip color from orange to fuchsia, and documents Mute/Take down in the context menu, the label group mute kebab, Ctrl+A/Esc bulk-mode shortcuts, pin-eviction toast, and the offline-node skip behavior in cross-node search. Replaces all 8 screenshots with fresh production captures. * docs(deploy-progress): refresh against current live app and source Corrected the Scan entry point (node-wide Scan this node from Security Overview, not a per-stack config scan), added the missing Take down verb and entry point, broadened recovery actions to cover restart and rollback failures, fixed the modal status text and raw-output color claims to match the live UI, and replaced all screenshots with fresh captures from a throwaway demo stack on the production node. * docs(atomic-deployments): refresh against current live app and source * docs(health-gated-updates): refresh against current live app and source * docs(deploy-enforcement): refresh against current live app and source Correct the tier note to every-tier (verified against the current policy gate, which no longer has a paid-only blocking switch), add the Security Overview deploy-enforcement summary card, tighten the honor- suppressions default wording, cross-link the separate pre-deploy scan advisory dialog to avoid confusion with the block dialog, and replace all three screenshots against the current production UI. * docs(blueprint-model): refresh against current live app and source Replaced all 11 screenshots with fresh production captures. Corrected the volume-destroying-drift Enforce-downgrade claim (appeared three times): that code path has no call sites in the runtime reconciler, so any compose edit on a stateful or state-unknown blueprint always re-enters Awaiting confirmation regardless of drift mode. Corrected the Create workflow (creation does not trigger an immediate reconciliation tick) and the Delete workflow (now requires typing the blueprint name to confirm). * docs(scheduled-operations): refresh against current live app and source * docs(blueprint-model): drop tier framing, treat as Community-native Blueprints carry no tier gate, so "available on every tier" implied a comparison that doesn't exist. Removed the tier framing from the intro note, the Prerequisites table, and the Security section; the role requirement (admin to write, every role to read) already says everything that matters. * docs(auto-update-policies): refresh against current live app and source Documents that every update trigger on this page, Apply now and scheduled Auto-update tasks alike, runs through the same atomic backup, build-aware rebuild, and post-update health gate as a manual update from the stack editor, and is subject to the same deploy enforcement policy gate. Corrects the readiness-computation description to scope it to registry-image services and cross-links to Health-Gated Updates, Atomic Deployments, Deploy Enforcement, and Stack Management. Replaces the readiness board screenshot with a fresh production capture and removes three orphaned screenshots left over from the page's prior CRUD-policy layout. * docs(auto-heal-policies): refresh against current live app and source Correct the admin-only prerequisite: viewing policies and history is open to every signed-in role, only creating/toggling/deleting requires admin. Rewrite the matching troubleshooting entry to match, note the overlap behavior between an All-services and a named-service policy on the same container, and replace all three screenshots with a real production policy. * docs(webhooks): refresh against current live app and source Replaced all three screenshots with fresh production captures (single webhook create/reveal flow, two-card configured list), verified every claim against WebhookService/StackOpLockService/registry.ts, and added the previously undocumented per-stack lock skip behavior for non-Git-source-sync actions with a matching troubleshooting entry. * docs(global-observability): refresh against current live app and source * docs(audit-log): refresh against current live app and source - Fix nav terminology: Audit is a top navigation tab, not a sidebar tab. - Correct retention claim: Admiral shows full retained history (default 90 days), not a fixed 14-day window; the 14-day clamp only applies to the Community API, which has no navigation entry point at all. - Fix settings path: Settings - Operations - Data Retention (previously pointed at the now-split Developer Diagnostics section). - Restore current Recovery Vault naming (was stale Sencho Cloud Backup). - Expand the tracked-actions list: stack take-down, label management, MFA reset, and notification suppression rules were missing. - Note that assigning the Auditor role itself requires Admiral. - Replace all four screenshots with fresh production captures (Stream, Table, expanded row, Data Retention) reflecting the current five-row retention card. * fix(audit-log): reframe data-retention screenshot to card content only The prior crop included the Settings sub-navigation panel, which isn't part of what the surrounding text describes. Retake tightly cropped to match the page's other screenshots (card content only, no chrome). * docs(multi-node): refresh against current live app and source Rewrites the Pilot Agent enrollment flow (now a generated compose.yaml plus docker compose up -d, not a single docker run command) and the Settings scope table (current registry: Stacks, Container Alerts, Docker & Storage, Data Retention, Mute Rules, Recovery, and the Admiral Account / Recovery Vault renames). Adds a Sencho Mesh cross-link matching the live add-node form copy. Replaces all eight screenshots with sanitized production captures. * docs(pilot-agent): refresh against current live app and source * docs(readme): refresh GitHub README against current live app Replace all 9 screenshots (stale top nav showing a removed Console item and missing the new Networking page); document Take down, Drift Detection, Environment and Secrets Guardrails, Storage Portability, Docker Label Audit, Remote Updates, and the node-wide Networking dashboard; fix a broken non-root-user anchor link; correct the notification channels list (no email channel exists yet) and the global search scope (pages, nodes, and stacks, not containers or services); rename "scan policy packs" to the current "scan policies" terminology; broaden the App Store bullet to cover custom registries. * docs(readme): reposition intro copy and refresh badge row Lead with DevOps/platform/sysadmin framing instead of homelab-first, drop pre-1.0 "production" language, state plainly that Sencho provides a UI instead of promotional "does the work you do" phrasing, and call out that multi-node was part of the architecture from the start. Swap the Discussions badge for CodeQL, last-commit, open issues, and live website/docs status badges, and add a blog link. * docs: retake Dashboard and Global Search screenshots for accuracy Configuration Status now shows Recovery Vault instead of the stale Cloud Backup label, and the search palette capture includes the Networking page entry added after the prior screenshot batch. * docs: refresh Fleet View page against current app Fleet View has drifted since its last rewrite: the Docker Labels tab, Export Dossier action, Networking filter/badge, node label pills and latency in topology, the Policy sync status row, and the node card Mute submenu were all shipped but undocumented. The Check Updates and Add Node actions also moved into the Overview toolbar (renamed Node Update / Manage Nodes) and no longer sit in the shared action row. Replaces all five screenshots with fresh production captures and corrects the masthead's motion description (a calm shimmer on Healthy, a steady glow on Degraded/Critical, not a pulsing dot). Also fixes a Fleet Sync limitation that claimed no first-party sync-status panel exists, now that the Status tab surfaces one. * docs: refresh Fleet Dossier page against current app Adds the page's first screenshot, documents the network exposure summary now included per stack, documents the storage-summary omission versus the Stack Dossier export, and adds two troubleshooting entries. * docs(fleet-federation): deep rewrite for the rollout-approval gate Federation's cordon and pin controls no longer take effect by themselves: the reconciler requires a confirmed rollout preview (Apply now -> Confirm Apply) before it mutates the fleet, and pinning or unpinning always clears a blueprint's approval. Rewrote the mental model, step-by-step, lifecycle table, security section, limitations, practical workflows, troubleshooting, and cross-links to reflect that gate. Also corrected the audit-log claims: cordon/uncordon/pin are not filterable by a node.cordon/blueprint.pin action taxonomy, only by the free-text search box against the method, path, and summary. Replaced 4 screenshots and added 3 new ones (production fleet plus an isolated instance to capture the rollout preview dialog in both a safe and a blocked state), and fixed one stale pin-workflow sentence in blueprint-model.mdx that the same audit surfaced. * docs(fleet-federation): drop tier-availability framing The feature isn't tier-gated, so calling out "every tier" reads as an unnecessary advertisement. Removed the tier note and the Community/ Admiral prerequisite row, and reworded two role-visibility sentences that had conflated tier with role. * docs(fleet-actions): deep rewrite for the v2 action-card redesign Rewrites the page against the shipped Fleet Action Card redesign: a single cyan rail with per-card action-class chips instead of the old per-card rose/purple/amber rails, plus the live blast-radius preview, dry-run, and confirmed-target binding mechanics that replaced the old static warning banners. Documents two previously-undocumented endpoints (match-preview, prune/estimate), the preview-confirm-execute model shared by all three cards, per-node locking, timeouts, and the version-gated confirmed-target contract for mixed-version fleets. All five screenshots recaptured against the live production UI. * docs(fleet-actions): fix nested quote in screenshot alt text * docs(fleet-sync): refresh against current app and document proxy gap Retake all screenshots against the live fleet (control authoring view, a genuine replica showing the read-only banner, and replicated suppression rows) and document a previously-unwritten behavior: scan policies, CVE suppressions, and misconfig acknowledgements are fetched localOnly and are not proxied through the node switcher like most other Security page tabs, so viewing a remote's Fleet Sync state requires signing into that instance directly. * docs(fleet-backups): refresh against current app and note new integration points Replaces all 6 screenshots with fresh 1920x1080 production captures and corrects several drifted details: the Cloud Snapshots panel's pagination and per-item delete action, the exact Recovery Vault storage-mode label, and the real per-file size-cap behavior (an oversized compose.yaml skips the whole stack; an oversized .env is dropped but the stack still captures). Documents two entry points that were missing from the page: the pre-update snapshot checkbox in Health-Gated Updates and the snapshot coverage nudge on the Storage Portability tab. Expands the single warning banner description in the detail view to cover all four banner types, notes the Snapshots tab and Recovery Vault are hub-only, and adds a Where Fleet Backups fits table cross-linking the six adjacent features. * docs(remote-updates): refresh against current app and add hardened-channel notes Replace all screenshots with fresh 1920x1080 production captures and fix the Node Updates trigger label (Check Updates -> Node Update). Add the Changelog tab, correct the reconnect overlay's stale 'Update timed out'/Try Reloading copy to the current Taking longer than expected/Reload to check text, and document the Admiral Hardened Build channel's carve-outs (pinned-but-not-blocked, entitlement-gated local update path). Disambiguate this page from the unrelated top-level Update (Health-Gated Updates) nav tab. * docs(node-compatibility): refresh against current app and expand capability list Replace all screenshots with fresh production captures (node switcher, capability lock card, connection test panel) and swap the lock-card example from a now-hidden Host Console to Audit Log, which is directly reachable. Bring the capability table from 26 to 35 entries to match the current registry, add a Mute Rules row, and split out fine-grained fallback capabilities (update-guard, service-scoped-update, cross-node-rbac, stack-down-remove-volumes) with their non-lock-card fallback behavior. Fix the compose-networking row, which incorrectly claimed to also gate the node-level Networking overview. Note that Pilot Agent nodes never advertise host-console regardless of version. * docs(security): refresh against current app and document scan-node launcher Replaces all screenshots with fresh production captures, documents the Scan this node launcher and the third Scanner setup toggle (pre-deploy scan advisory), tightens the Compose risks example list and the Policies block-condition description to match the live app, and adds an On a phone section. * docs(vulnerability-scanning): refresh for exploit intel and risk-based policies Documents exploit intelligence (KEV/EPSS evidence tags), the redesigned risk-based scan policies (severity/known-exploited/fixable block conditions replacing the single max-severity field), and the new Findings badge state. Replaces all screenshots with fresh production captures and adds a Secrets tab example. * docs: refresh CVE suppressions page Retook all screenshots against production (prior ones predated the triage-status/OpenVEX UI and the edit capability). Documented the suppression edit flow, which the page previously described as delete-and-recreate only. Corrected the remote-node banner copy on the Suppressions tab and added a screenshot of it. Cross-linked the Misconfig acknowledgements panel that now sits on the same tab. * docs(two-factor-authentication): refresh screenshots and document rate-limit layers Replace all 11 non-count-variant screenshots with fresh production captures. Document the throttled sign-in state precisely (kicker/hero/caption change, not just the input), that a replayed TOTP counts toward the lockout counter, and the separate per-network-address sign-in rate limit that sits in front of the per-account MFA lockout. * docs(api-tokens): refresh screenshots and document service-scoped deploy actions Deploy Only now authorizes eight lifecycle POSTs (was six): the per-service update and restore endpoints were missing from the scope table. Universal restrictions gained a row for image channel management, which was already rejecting API tokens in code but undocumented. Replaced all five screenshots with fresh captures showing the current three-scope create flow and a populated list with one token of each scope. * docs(upgrade): refresh against current app and remove legacy-version framing Fixes migration-list inaccuracies (registry credentials were never plaintext, unlike node API tokens), rephrases the SSH/TLS and JSON-config migration bullets to drop version-numbered legacy framing, adds a GHCR mirror note matching the quickstart pattern, and cross-links the Hardened Build entitlement-gated update path so digest-pinned installs aren't sent down the manual docker pull steps. * docs: refresh Backup & Restore against current backend Broadens the encryption.key warning to cover everything CryptoService actually encrypts (node tokens, Git source and Fleet Secrets, SSO/MFA, Recovery Vault, fleet snapshot contents), not just registry credentials. Adds the built-in backupData CLI as a no-host-tooling alternative to the sqlite3 .backup command, cross-linked to Emergency command-line recovery. Corrects node-token migration guidance: tokens are signed with a secret stored in sencho.db and remain valid after a host move, so no regeneration is required. * docs: refresh Recovery guide against current Settings page and CLI Documents the Settings · Recovery page's full System health / Environment / Safe actions / Command-line hub instead of only its environment-preflight section, adds the missing "Sencho compose location" preflight check, adds the SSO/OIDC/LDAP lockout scenario now that disableSso.js exists, and corrects the rollback description (exact UI label, backup-required and image-layer caveats). * docs(emergency-cli): sync in-app page description, add CLI operational details Aligns the "in-app Recovery page" summary with the freshly refreshed Recovery guide (System health / Environment / Safe actions / Command-line recovery, SSO providers, one-click command download). Adds constraints verified against the CLI source: password/username minimums, the valid SSO provider identifiers with an example, and a note that diagnostics.js always reports Docker as unreachable (it runs without a live Docker connection, unlike the in-app page). * docs(troubleshooting): refresh against current backend and nav Corrects several claims that had drifted from the implementation: network name validation (underscore is not a valid leading character), the remote-update delayed-failure window (3 minutes, not 90 seconds), and an unsubstantiated version-compatibility check on the Admiral 403 entry. Removes two entries describing legacy pre-v0.39 node behavior that no longer applies to any currently shipped build. Replaces stale "Profile > Settings > X" navigation with the current Settings hub paths, and "wifi icon" with the current Test Connection label. Adds Pilot Agent awareness to the remote-offline entry with a cross-link to its dedicated troubleshooting section, and trims the docker-run converter entry to point at the fuller, already-current version on the Stack Management page instead of duplicating it with a broken anchor. * docs(verifying-images): document the :dev GHCR integration tag Verified the existing cosign/SBOM/VEX/tag-policy content against docker-publish.yml and docker-preview.yml; all accurate. Added the previously undocumented :dev/:dev-<sha> integration tag published on every push to main via docker-dev.yml. * docs(trivy-setup): sync install guide with node-scoped scanner and current Trivy upstream docs Documents that Trivy installs independently per node, adds the TRIVY_BIN override and non-PATH mounting option, fixes the deprecated apt-key install flow and RHEL repo gpgkey placement, notes the Exploit intelligence toggle for air-gapped hosts, and replaces the stale Scanner setup screenshot. * docs(two-factor-admin): document lockout recovery and self-reset gotcha Verified the reset flow, CLI recovery, and SSO toggle claims against current source and replaced the stale admin-reset modal screenshot. Added the failed-attempt lockout behavior (undocumented despite being promised in the page description) and a warning about resetting your own 2FA from the Users list, which signs you out immediately unlike the self-service disable flow. * fix(docs): make Settings and Self-hosting discoverable in the sidebar The Reference and Operations groups used root pages that were only reachable by clicking the ambiguous group label, and that click also triggered an unwanted double action (expand plus navigate). List both pages as explicit sidebar entries and disable global drilldown so group headers only expand or collapse. * docs(settings): sync reference page with current Settings Hub Renamed License to Admiral Account throughout (Hardened Build channel switch, image channel display, DURATION pill), corrected the password policy, documented the new Appearance navigation and log-chip-color controls plus font options, noted Mesh data plane is not on every installation, fixed the label cap (50, not 100), and replaced every screenshot with a fresh capture from the production node. * fix(docs): apply the sidebar toggle-only fix to Start here and Product guide These two groups had the same click-to-navigate-and-expand pattern as Reference and Operations. Flattening them is safe here too: the Product guide root page has no directory listing depending on it, and the Start here root page's own hand-authored Next steps CardGroup already covers the same links the auto-generated listing duplicated. * docs(licensing): refresh licensing page for Hardened Build and sales-led Admiral pricing Admiral pricing moved from self-serve checkout to a contact-sales model, and a new Hardened Build image-channel switcher shipped in the Admiral Account settings page; neither was reflected in the docs. Also documents the lifetime-license edge case (no Manage subscription button, no Billing row) and refreshes all four screenshots against the current UI. * docs(security): sync reference page with current API-token and encryption scope Verified every claim against the live implementation: the API-token universal restrictions list was missing MFA management, Recovery Vault, and image channel management; the encryption-at-rest field list was missing Recovery Vault credentials; added a note on the password strength indicator's recommended-vs-enforced distinction. Refreshed the SSO settings, API tokens, and audit log screenshots against the production node. * docs(settings): fix password policy and session-invalidation claims Cross-checked against auth.ts while verifying the same claims on the security reference page: the enforced minimum is 8 characters (the 12+/mixed-case/number text is a frontend strength hint, not a validated rule), and a password change invalidates every other session for the account rather than leaving them valid. * docs(contact): sync contact channels with sales-led pricing and current support gating Replace the retired contact@sencho.io with hello@sencho.io (the address actually used in the website footer and the pricing page's Get in touch CTA), narrow the licensing@sencho.io scope to existing-license activation/billing/refunds now that new Admiral conversations route through hello@sencho.io, drop the stale LICENSE-file and in-app upgrade-prompt claims (the AGPLv3 relicense removed both), correct the Support settings path and add the published response-time targets, and remove the unsubstantiated bug bounty mention.	2026-07-21 09:13:12 -04:00
Anso	23cd9d41cc	docs: align README with the open-source Community product (#1626) ... * docs: align README and overview docs with current AGPLv3 tier model Community is now described as the complete free product, with a single consolidated Admiral section replacing scattered per-bullet tags that had drifted out of sync with the actual gates (security scanning, private registries, and most of RBAC/audit moved to Community over time). Remove promotion of Sencho Mesh, Fleet Secrets, and Host Console, which are no longer discoverable by default. Align the Fleet Secrets, Host Console, and Sencho Mesh sections in the features overview with the limited-availability framing already used elsewhere on that page. Refresh every README screenshot to the current UI and add new captures for Security, Blueprints, Scheduled Operations, and Compose Doctor. The introductory tier-framing sentence and docs navigation placement for the now-hidden surfaces are intentionally left for a later, dedicated pass once the Admiral positioning work settles. * docs: restructure README around the open-source Community product Drop "What Sencho is not (yet)", fold its known-limitations pointer into the Documentation section. Rewrite Telemetry and data handling to drop the Admiral license-validation detail, since this file is the open-source entry point and Admiral customers work from their own agreements. Move the Admiral section to just before Documentation, community, and license so the README leads with the Community product throughout.	2026-07-13 14:47:44 -04:00
Anso	9ff678a7bb	docs: v1 docs refresh (batch 5) (#1395) ... * docs(introduction): refresh for the redesigned UI and replace screenshots Bring the Getting Started Introduction page in line with the current product: - Add the Security top-level view to the navigation list and a dedicated Security section with a new screenshot. - Correct the Fleet tab names (Snapshots, Status, Map, Deployments, Routing, Federation, Actions, Secrets). - Split Settings out from security and list the current nine setting groups (Security graduated to its own view). - Refine the navigation paragraph so role, tier, and local-vs-remote context read accurately. Replace all four existing screenshots (Home, stack workspace, Fleet, Resources) with fresh captures of the redesigned UI and add a Security overview screenshot. * docs(configuration): document advanced env vars and clarify deployment vs runtime config Add an Advanced environment variables section (TRIVY_BIN, SENCHO_MESH_SUBNET, GITSOURCE_MAX_CLONE_BYTES, SENCHO_PUBLIC_URL, SENCHO_COMPOSE_STALL_TIMEOUT_MS) and reframe the intro to separate deployment-time configuration from the runtime settings that live in the in-app Settings Hub. Cross-link the pilot-agent variables to the Pilot Agent page instead of duplicating them. * docs(sso): refresh SSO Setup Guide and SSO & LDAP reference for the redesigned UI Refresh both SSO documentation pages against the current product and the redesigned settings UI. - Correct the navigation path to Settings -> Access -> SSO on both pages. - Fix the "Require 2FA on SSO sign-in" toggle location to Settings -> Personal -> Account. - Describe the login-page experience (the Local / LDAP toggle and the branded OIDC buttons under the "Or continue with" divider) and the SSO panel masthead (SCOPE, PROVIDERS, ENABLED). - Replace all six SSO screenshots with fresh captures of the redesigned UI. * docs(features): refresh the Features Overview page for the redesigned UI Rewrite docs/features/overview.mdx to mirror the current Features navigation grouping (Stacks, Deployment, Resources, Observability, Fleet, Automation, Security & Identity) and add the recently shipped capabilities surfaced in the redesign: Stack Dossier, Drift Detection, Compose Doctor, Compose Networking, Environment & secrets guardrails, Storage portability, Health-Gated Updates, Fleet Dossier, and the dedicated Security page. Correct stale claims (the file explorer now gates writes on stack edit permission, not an admin role; downloads are a read action; bulk label assign now spans nodes) and standardize the tier callouts so partly paid features read as "Admiral adds X". Replace the three pre-redesign screenshots and add a Security overview banner, all captured from a populated fleet. * docs(features): refresh the Appearance page for the redesigned UI Add fresh screenshots and a troubleshooting section to the Appearance page, verified against the live product. - Add four screenshots: the Theme card (live preview, mode, accent, and fine-tune sliders), the top-bar quick switcher, the Typography card, and the Display card. - Refresh the Density screenshot used by the Settings reference page. - State that the quick switcher also covers text size, and that the contrast, border, and glow sliders stay in Settings. - Add a Troubleshooting accordion covering per-browser persistence, resets to defaults, cross-operator scope, and the quick-switcher versus full-Settings split. * docs(introduction): refresh screenshots and correct stale content * docs(reference): refresh the Settings Reference page for the redesigned UI Replace all seven stale screenshots with fresh 1920x1080 captures. Add five new screenshots for the sections that previously had none. Content changes: - Sidebar table: rename Infrastructure "Fleet Mesh" entry to "Fleet"; add "Image update checks" to the Automation group list - Fleet section: rename heading to match registry label; add the Documentation snapshots subsection (snapshot_documentation toggle) - Container Alerts: add screenshot - Image update checks: add the full section (Registry checks table, scheduling mode, interval presets, cron expression support) - Stacks / Deploy Guardrails: add screenshot - Recovery: add the full section (System health snapshot, Environment preflight checks, Safe actions, Command-line recovery table) * docs(sso): refresh screenshots for SSO quickstart and feature pages * docs: refresh Features Overview screenshots and content Replace all 4 hero screenshots with fresh 1920x1080 production captures. Correct security posture state names (Action needed / Monitoring / Secure), add the Policies tab to the Security section tab list, mention the Simple mode in Scheduled operations, and update all alt text to match the new screenshots. * docs: refresh Appearance page screenshots and correct quick-switcher scope Replace all four Appearance screenshots with fresh production captures. Fix the quick-switcher control list: remove fonts (not present in the popover), add visual style and readability which are. Add Log chip color to the Display section. Update all screenshot alt text to match new captures. * docs: refresh stack management page with current UI and anatomy tabs * docs: fix convert-tab-error screenshot with fully visible error toast * docs: convert troubleshooting section to AccordionGroup format * docs(quickstart): refresh screenshots and align dashboard description Replace all three first-boot and dashboard screenshots with current UI. Add Security to the top navigation list, update gauge and Stack health descriptions to reflect sparklines and column detail, and align Configuration Status wording with the Introduction page. * docs(editor): rewrite anatomy panel, replace all screenshots - Correct the anatomy panel tab inventory: the panel has eight tabs (Anatomy, Activity, Dossier, Drift always; Environment, Networking, Doctor, Storage when the node advertises the matching capability), not three as previously documented - Add table describing all eight tabs with capability gates and links to dedicated feature pages - Add anatomy-tabs.png screenshot showing the scrollable tab row - Note the Doctor severity dot (red for blocker, amber for high-risk) - Remove the stale Markdown-export subsection; Dossier and Activity are now covered in the tab table - Replace all six stale screenshots with fresh 1920x1080 captures - Replace the compose diff preview screenshot * docs(files): refresh Files & Volumes screenshots and fix context-menu alt text Replace all 9 stale screenshots on the Files & Volumes page with fresh captures from the production node. Fix three alt-text strings that did not match the live UI: removed hardcoded octal value 644, and added the Duplicate, Copy to, and Move to entries missing from the context-menu alt text. * docs: rewrite Stack Activity page with full event categories and fresh screenshots Expands the event category table from 5 to 10 entries to cover drift detected, drift resolved, update started, health gate passed, and health gate failed. Adds a live-disconnected-state section, a background-actor attribution table, and a corrected troubleshooting accordion covering the WebSocket reconnect case. Replaces both stale screenshots with fresh 1920x1080 captures from the production node. * docs(drift): rewrite drift detection page with screenshots and full coverage Full rewrite of the Drift Detection feature page. Adds two previously undocumented finding types (network-undeclared, network-missing), expands the temporal section to distinguish the raw-file hash from the parsed-model hash, documents the two-layer spatial-engine and ledger architecture, explains when the ledger is reconciled (post-deploy vs manual re-check vs tab open), adds Activity timeline integration note, introduces a Limitations section (no background scanner, port-range caveat, history cap, advisory-only enforcement), expands Troubleshooting from five entries to seven using the AccordionGroup convention, and adds four production screenshots. * docs(drift): use CardGroup for Related section * docs(dossier): rewrite Stack Dossier page with full feature coverage * docs(networking): rewrite Compose Networking page with full feature coverage * docs(doctor): rewrite Compose Doctor with full 30-rule reference, screenshots, and cross-links * docs(networking): add production screenshots and correct alt text Adds 7 production screenshots for all sections of the Compose Networking page and updates the four placeholder alt texts written before screenshots were taken to match what the actual images show (arr-net external badge, swag service with 443/tcp and 80/tcp, single-service exposure intent row). Also adds the full-panel overview image at the top of the page. * docs(environment-guardrails): rewrite with project env file, env file status, and screenshots * docs(storage): rewrite Storage Portability page with screenshots and full coverage Rewrites compose-storage.mdx from a 61-line sketch into a complete reference page. Key additions: Where to find it section with screenshot, full storage inventory section documenting all mount type/access/status chips and the Linux owner display, expanded portability verdict section with per-reason detail and edge-case caveats (read-only binds, symlink escapes, anonymous volume risks), snapshot coverage section with admin scope and remote-node behavior, Findings in Doctor cross-reference, and six troubleshooting accordions covering tab visibility, bind status, external named volumes, render errors, and snapshot coverage states. Adds two production screenshots: storage-tab.png and storage-node-bound.png. * docs(stack-labels): rewrite with accurate permissions, capability gate, dry run, live preview, and color conflict docs * docs: rewrite Stack Sidebar page with accurate feature coverage Rewrites the Stack Sidebar documentation page to match the current UI. Key changes: - Fix branding header description (shows logo + version, not just version) - Fix bulk mode icon description (stacked-rows, not square) - Add cross-node search section (fan-out behavior, Other nodes section, unreachable-node warnings, click-to-switch navigation) - Update Labels submenu description (inline New label creation, Manage labels link) - Note that Delete only appears when the user has delete permission - Remove the auto-update implication from Schedule task description - Rewrite the Activity ticker section with the full 6-state priority cascade table; remove the non-existent IDLE state; correct pulsing-dot behavior - Replace all 7 stale screenshots with fresh production screenshots - Add new sidebar-cross-node-search.png screenshot * docs(atomic-deployments): refresh screenshot and document project env files, rollback readiness, and recovery actions * docs(atomic-deployments): fix rollback permission visibility and banner string accuracy The Rollback menu entry is hidden by the frontend when the user lacks stack:deploy; it never appears and does not 403. Fixed the step-4 narrative and troubleshooting accordion to match. The rollback-failure banner emitted by ComposeService is '=== Rollback failed. Manual intervention may be required ===' (period, capital M). Fixed both occurrences in the page. Updated the Settings navigation path from the nonexistent 'Roles & Access' to the real 'Access'. * docs(deploy-progress): rewrite with health gate, inline style, and 9 fresh screenshots Add health gate section covering all four states (observing, passed, failed, unknown) with exact UI banner text and the configurable observation window. Expand the inline style section with full band content, 4s auto-dismiss, and pill handoff. Add Scanning as a supported entry point. Replace all 6 existing screenshots and add 3 new ones (modal-health-gate, inline-banner, setting-style). Add two health gate troubleshooting accordions. Add Related CardGroup linking to health-gated-updates, stack-activity, deploy-enforcement, and atomic-deployments. * docs(health-gated-updates): refresh screenshots and correct signal row order and label * docs(deploy-enforcement): rewrite with fleet replication, honor suppressions location, scan-failed dialog state, and fresh screenshots Adds the Fleet policy replication section covering control/replica behavior, Managed by control node banner, and Demote to control. Documents the exact location of the Honor suppressions toggle (bottom of Policies tab). Expands the block dialog section with the scan-failed row state. Updates all three screenshots to the current visual design. Restores the Admiral license note and corrects the policy-card scope description. * docs(app-store): rewrite with mobile layout, fresh screenshots, and registry admin note - Replace all 5 stale screenshots with 1920x1080 production captures - Add app-store-mobile.png showing the status masthead layout - Document mobile single-column layout in a new Mobile subsection - Note that the featured hero has its own Deploy button - Mark the category rail as desktop only with a cross-link to Mobile - Add admin-account requirement to the custom registry section - Add Related CardGroup linking vulnerability scanning, deploy progress, deploy enforcement, and resources	2026-06-29 01:29:03 -04:00
Anso	0be479100c	docs: v1 docs refresh (#966) ... * docs(introduction): rewrite intro page and refresh screenshots Rewrite the Getting Started introduction to reflect the current product: adds the Mesh, Blueprints, Pilot, Fleet, Resources concepts up front; restructures capability sections around Stacks, Fleet (now including Fleet Actions), Mesh, Blueprints, Monitoring, Resources, Security, Automation, and Pilot/Remote ops; cross-links every claim to the matching feature page. Replaces the dashboard hero shot with a fresh capture against the redesigned cockpit chrome and adds three inline shots (running stack with anatomy and logs, fleet command deck, resources hub with reclaim header). All screenshots taken at 1920x900, dark theme, with node names, usernames, IPs, and home paths neutralized. Drops outdated claims: stale "190+ templates" count, the "viewer accounts" RBAC summary, and the "atomic" deployment label that did not match the actual rollback mechanism. * docs(introduction): add Federation and Fleet Secrets Federation has shipped (Admiral) with cordon and pin policy as operator overrides on the blueprint reconciler. Fleet Secrets is landing as a Skipper+ tab for versioned env-var bundles encrypted at rest, with diff preview and target push. Mirror those in the Run-one-machine-or-many bullet list and in the Tiers paragraph so the introduction matches the current product. * docs(introduction): re-shoot screenshots against v0.72.0 production Re-capture all four introduction screenshots from the upgraded production node so the fleet view shows the current full tab strip (Overview / Snapshots / Status / Deployments / Traffic / Federation / Fleet Actions / Secrets) instead of the older Overview / Snapshots / Status only. Same 1920x900 dark-theme capture and the same PII scrub applied (node names, usernames, IPs, home paths neutralized). * docs(quickstart): rewrite around v0.72.0 cockpit and add screenshots Replaces the bare install snippet with a five-minute walkthrough that matches the redesigned UI. Leads with a docker-compose.yml block (the bare docker run command is collapsed in an Accordion), keeps the 1:1 path rule, and adds two new sections that show the user what happens on first boot. Adds two screenshots at 1920x900 dark theme: - setup-cold-start.png: the Cold start card with Username, Password, Confirm password fields, and the Initialize console button. - dashboard.png: the post-sign-in dashboard captured against v0.72.0 with the full top nav (Home, Fleet, Resources, App Store, Logs, Auto-Update, Console, Audit, Schedules) and the populated Stack health table sorted by load. Where-to-next now uses CardGroup cols=2 to match the introduction page's pattern. * docs(configuration): align env var reference with current backend Bring docs/getting-started/configuration.mdx up to date with the v0.72.0 backend: - Remove PORT from the optional env vars table. The listen port is hardcoded to 1852 in backend/src/helpers/constants.ts and is never read from the environment. Replace it with a Listen port section that explains the fixed port and host-port remapping. - Document API_RATE_LIMIT (default 200) and API_POLLING_RATE_LIMIT (default 300), both applied in production only. - Note the /app/compose fallback default for COMPOSE_DIR while still pointing readers at the 1:1 path rule. - Point the SSO env var section at the new SSO Quickstart page and keep the SSO feature reference as the deeper dive. - Tighten First boot and cross-link to Quickstart so the screenshot is not duplicated. - Add a Where to next CardGroup matching the refreshed Introduction and Quickstart pages. Drop stale PORT=1852 and JWT_SECRET=your-secure-jwt-secret-here lines from .env.example so the example no longer contradicts the docs (PORT is hardcoded, JWT_SECRET is auto-generated and persisted to the database during initial setup). * docs(configuration): replace em-dash-substitute hyphens in prose Three sentences used ` - ` (space-hyphen-space) as an em-dash substitute. Replaced with the punctuation that fits each case: - "How Sencho organizes your compose directory": semicolon between the two related clauses. - Data directory Warning: parentheses around the parenthetical insertion. - 1:1 path rule explanation: comma before the contrastive clause. Heading slugs and YAML code-block comments are unchanged. * docs(sso): refresh setup guide and drop misleading "one-click" wording Brings the SSO Setup Guide in line with how SSO actually works in the current build, and corrects misleading copy across both SSO docs pages. - Setup Guide: explains the env-var-seeds-once / DB-is-authoritative config model up front, replacing per-section "Restart Sencho" wording that implied a restart was always required. - Setup Guide: promotes the per-provider Test Connection button out of the LDAP-only paragraph into a generic intro callout, and adds a self-signed LDAPS tip. - Setup Guide: notes that all OIDC providers accept a *_DISPLAY_NAME override for the login button label, and adds a commented LDAP TLS toggle to the full compose example. - Setup Guide: adds two screenshots of the redesigned Settings > SSO panel (overview + LDAP card expanded with form). - Both pages: replaces "one-click presets" / "one-click configuration" with "preset providers". The Skipper-tier presets still require an OAuth app provisioned in the provider's console; what they actually buy is provider-aware defaults and a branded login button. The old wording overpromised. * docs(features-overview): regroup catalog and add 17 missing features Restructure the Features Overview into the same six groups the docs sidebar uses (Stacks & Deployments, Observability, Fleet & Multi-Node, Security & Identity, Automation, Platform) plus a short Reference tail. Add catalog entries for 17 shipped features that the previous overview never mentioned: Stack Activity, Stack File Explorer, Deploy Progress, Deploy Enforcement, Blueprints, Git Sources, Global Search, Pilot Agent, Sencho Mesh, Fleet Federation, Fleet Actions, Fleet Sync, Fleet Secrets, Two-Factor Authentication, CVE Suppressions, Auto-Heal Policies, Stack Sidebar. Fix two factual inaccuracies: - Fleet View blurb wrongly gated search, sort, filter, and stack drill-down behind Skipper. The deep-dive is explicit that those are available on every tier; only the bulk Update All action inside the Node Updates modal is paid. - Auto-update entry was titled and described as a scheduling system. The deep-dive page is the Auto-Update Readiness board (risk tags, changelog previews, rollback targets); the scheduler lives under Scheduled Operations. Add three hero screenshots captured from production at 1920x900, illustrating the redesigned cockpit visual language: Home dashboard, stack anatomy, and fleet topology. * docs(stack-management): refresh page around v0.72.0 cockpit and add screenshots Updates the Stack Management page to match the current UI: sidebar with filter chips and label groups, bulk mode, restructured kebab menu, two-tab anatomy panel, and three-source New stack dialog (Empty, From Git, From Docker Run). Adds sections for Filter chips, Pinned and label groups, and Bulk mode. Restructures the Stack context menu around the inspect, organize, lifecycle, and destructive groups with their keyboard shortcuts. Documents the From Git tab and cross-links Git Sources for the full sync flow. Replaces every existing screenshot with fresh captures from the current UI and adds eight new captures for the new sections. Cross-links Stack Activity, Stack Labels, Stack File Explorer, Compose Editor, Atomic Deployments, Scheduled Operations, Auto-Heal Policies, Auto-Update Policies, and Alerts and Notifications for features documented on their own pages. * docs(stack-activity): refresh page around v1 cockpit and recapture screenshots Realign the page with the current Anatomy panel tab strip and the StackActivityTimeline component: - Frame the Activity tab as a sibling of Anatomy under the right-hand panel, with files/edit actions belonging to the strip. - Expand the category guidance: list the five iconized categories and call out that other stack-scoped notifications (deploy failure, available image updates, auto-heal triggers, monitor alerts, scan findings) flow into the timeline with a generic icon. - Tighten the actor-attribution rule to match the component: omitted for events without an actor and for system-driven events. - Add the day-format example to the relative-time row. - Recapture both screenshots from a populated stack (Today + Yesterday + Earlier with three distinct icons) and an empty stack. - Convert troubleshooting blurbs to H3 for anchor links and consistency with the v1-refresh sibling pages. * docs(stack-activity): wrap troubleshooting entries in Accordion blocks Match the foldable troubleshooting pattern established by docs/features/deploy-progress.mdx so the page stays compact and readers can scan to their issue. This is the canonical formatting for the /features section's troubleshooting blurbs going forward. * docs(editor): refresh page around v1 cockpit and recapture screenshots Rewrites the page around the dual-mode right panel (Anatomy by default, Monaco when the user clicks edit), the redesigned Command Center action bar, the new container row layout with status badges and live stats, the Structured / Raw terminal logs toggle, the Git Source toolbar button, and the opt-in diff preview. Drops the obsolete persistent embedded terminal section. Preserves the #diff-preview-before-save and #log-viewer anchors referenced from settings.mdx and global-observability.mdx. Replaces editor-overview.png and container-exec-modal.png with fresh captures against v0.72.0 production at 1920x900 dark theme; renames container -actions.png to containers-list.png; adds command-center.png and editor-edit-mode.png. PII scrubbed (host paths normalized) and the compose-diff-preview/diff-modal.png shared asset is left untouched after visual diff against the live UI showed no chrome change. * docs(features): wrap troubleshooting accordions in AccordionGroup Wraps the loose <Accordion> blocks in editor.mdx and stack-activity.mdx in a single <AccordionGroup> to match the troubleshooting design used by fleet-federation.mdx. Structural only; no content changes. * docs(stack-file-explorer): refresh page around v1 explorer and add screenshots Full rewrite to match the live two-pane Files tab. Replaces the false 'Edit' toolbar flow with the read-only chip + always-on Save model, fixes the protected-files list (5 names) and dedicated-tab redirect list (3 names), drops the fabricated 100 MB download cap, and corrects the upload claim to single file at a time. Adds sections for New File, Rename, Permissions, the type-to-confirm protected-file delete flow, the non-empty folder delete confirmation, the 500-entry tree display cap, and the symlink rendering. Restructures troubleshooting around <AccordionGroup> + <Accordion> to match fleet-federation.mdx, and adds two new entries (display cap, 403 on Community admin write). Ships nine screenshots captured against v0.72.0 production at 1920x900 in dark theme: overview, two-pane layout, protected-tree-marker, viewer-edit-mode, new-file-dialog, context-menu-folder, context-menu-file, permissions-dialog, delete-protected-confirm. * docs(deploy-progress): rewrite around current modal + capture v1 screenshots Aligns the page with the v0.72.0 implementation and standardizes the troubleshooting layout with the rest of the docs refresh. Setting and gating - Renames the Settings field to "Deploy progress modal" and quotes the current helper text verbatim. Documents that the toggle is off by default, lives under Settings > Appearance > Display, is stored in localStorage, and syncs across tabs in the same browser. Modal anatomy - Names every visible UI string: header verbs, status indicator (with the "closes in <n>s" countdown that was previously undocumented), empty-body strings, footer toggle that flips between "Raw output" and "Hide raw", and the destructive border on ERR rows vs the softer warn tint on WARN rows. - Replaces the vague "after a few seconds" with the actual 4-second auto-close timer; documents hover-to-pause and the leave-hover-restarts-the-countdown behavior. - Documents the truncated error message in the failed-state header and the manual close-only requirement. - Notes that the pill is portal-mounted and survives navigation. Stage badges - Keeps the 9-badge table but adds an honest note that most lines render as LOG because the badges are gated on Compose's "[+]" progress prefix, which Compose only emits in TTY mode and Sencho spawns it without one. Entry points - Splits the supported actions into the four that produce a populated structured-log body (Deploy, Update, Install, Git Apply) and the two that bypass compose and finish with 0 lines (Restart, Stop). Drops the "Down" claim from the user-facing list since no UI control currently triggers it; mentions the down route as an automation surface only. Troubleshooting - Wraps the existing accordions in an <AccordionGroup> matching the pattern used by the editor and stack-activity refreshes. Adds two new entries: one explaining the Restart/Stop "0 lines" outcome, one explaining the LOG-everywhere case for non-TTY compose output. Screenshots (six PNGs in docs/images/deploy-progress/, 1920x900, dark theme, captured against the upgraded production node) - setting-toggle.png: the Display section with the toggle enabled. - modal-streaming.png: a real update in flight at 19s, 554 lines. - modal-succeeded.png: succeeded state with the live closes-in countdown visible. - modal-raw-output.png: structured rows with the Raw output panel expanded beneath. - pill.png: minimized pill anchored bottom-center on a stack editor view. - modal-failed.png: failed state with the truncated error in the header and ERR rows highlighted. * docs(resources): refresh Resources Hub page for v1 redesign and feature additions Rewrite the page to match the shipping UI and replace stale screenshots with fresh captures of the redesigned chrome. - Document the admin-only Reclaim hero and clarify the per-tile Sencho-only vs. All Docker (includes external) split in Quick Clean. - Add coverage of the Scan history toolbar button and the per-row severity badge plus shield-icon scan dropdown in the Images tab; cross-link to the vulnerability scanning page. - Correct the Volumes column list (no Size column; size lives on the Largest 5 landing card) and call out admin gates on browse and delete. - Spell out the List/Topology view-mode toggle and that Create Network is admin-only and List-mode only. - Rewrite the Unmanaged tab section around the project-grouped layout, the Select all + Purge Selected (N) admin-only multi-select, and the empty state copy. - Replace screenshots: resources-reclaim, networks-list, create-network, network-inspect, network-topology, network-topology-toggle. Add fresh resources-volumes-tab and resources-unmanaged-tab captures. * docs(app-store): refresh page around v1 deploy sheet, scan integration, and registry settings Rewrites the App Store reference to match the current cockpit: - Documents the weekly-rotated featured banner picked from the top-5 by GitHub stars and the star-descending grid sort. - Adds the deploy-sheet structure (breadcrumb, meta line, About panel with Read more) and splits the Advanced tab into Ports, Volumes, Environment variables, Custom variables, and Security subsections. - Documents the Trivy-gated Security checkbox, atomic vs non-atomic deploys by tier, and the rollback semantics driven by error class. - Adds a Watching the deploy section linking to the deploy-progress modal. - Rewrites the Custom registry section against the new two-panel settings layout (Default + Custom) with the URL validation rule and the using default / using custom hint. - Adds a four-entry Accordion troubleshooting block in the house style. - Replaces three screenshots and adds two (Advanced tab, Settings registry panel) captured against the production node. Permissions wording aligns with current backend (admin only); the broader stack:create gate will land in a follow-up fix branch. * docs(app-store): describe inline port-conflict messaging on deploy sheet Update the deploy-sheet section to match the visible port-conflict behavior: the Essentials tab surfaces a Port-conflict warning that replaces the defaults hint when any default port is already bound, and the Advanced tab shows an inline "in use by {stack}" message next to the container port instead of a hover-only tooltip. Refresh the screenshot alt-text and the troubleshooting Accordion to match. * docs(app-store): align permissions note with stack:create gate Pairs with the backend gate swap in fix/templates-deploy-rbac (#986) which moves POST /api/templates/deploy from requireAdmin to requirePermission('stack:create'). Updates the Note block under 'Watching the deploy' so the docs match the new behavior: admin and node-admin can deploy templates from the App Store; viewer, deployer, and auditor cannot.	2026-05-07 23:44:13 -04:00