11 Commits

Author	SHA1	Message	Date
Anso	0f9925e04f	feat: block self-stack lifecycle ops with UI and preflight guardrails (#1569) ... * feat: block self-stack lifecycle ops with UI and preflight guardrails Refuse update, deploy, down, stop, and delete when the stack matches Sencho's compose project. Return 409 self_stack_protected. Expose isSelf on /statuses and disable guarded UI actions. Add SelfStackProtectedDialog and self-managed-stack preflight warning. Closes #1564 * fix: add missing stackSelfFlags mock to useSidebarContextMenu test The production hook now reads stackListState.stackSelfFlags[file], but the test mock did not include it, causing 6 tests to fail with TypeError: Cannot read properties of undefined (reading 'web.yml'). * fix: harden self-stack protection during startup Add a global environment preflight warning when Sencho is managed inside COMPOSE_DIR. Align status decoration and route guards on Docker label fallback detection. Block rollback and service-level stop on the protected self stack. * fix: add self_stack_location to diagnostics-route expected check IDs	2026-07-06 02:08:16 -04:00
Anso	5f1baa7522	fix: harden deploy/update concurrency and node-targeting safety (#1390) ... * fix: harden deploy/update concurrency and node-targeting safety Release stabilization for deploy/update operational safety. Per-stack operation locking is now global. Background lifecycle paths (scheduler auto stop/down/start/backup/update, webhook execute, Git source auto-deploy, image auto-update, label bulk actions, fleet snapshot redeploy, and mesh redeploy) acquire the per-node, per-stack lock through a new StackOpLockService.runExclusive helper and skip rather than race a manual deploy/update/rollback/backup on the same stack and node. Skips surface honestly (a failed scheduled run, a recorded webhook failure, a per-stack batch result, or a thrown error) instead of a silent no-op. Update readiness and policy-bypass now run against the node captured when the dialog opened, not the live active node, so switching nodes while a dialog is open cannot retarget the update or the bypass retry. Rollback readiness no longer presents a moving-tag or unpinned image as a ready image revert. Restoring files does not revert a moving tag, so those stacks read as partial, and the rollback success message states that the compose and env files were restored. * fix: lock blueprint reconcile against manual ops and correct rollback wording Follow-up to the deploy/update safety hardening, closing two more gaps from a verification pass. BlueprintService.deployLocal and withdrawLocal called ComposeService directly, so blueprint reconciliation could race a manual deploy/update/rollback/backup on an owned stack. Both now run their compose lifecycle call through StackOpLockService.runExclusive and skip (recorded as a failed reconcile, retried on the next cycle) on conflict. The withdraw holds the lock across both the compose down and the directory delete so neither races a manual operation. The runtime rollback messages overstated recovery: a rollback restores the compose and env files and recreates containers, but does not revert an image behind a moving tag. The auto-rollback deploy-progress output, the recovery panel and chip, the failure toasts, and the manual rollback route message now state that the compose and env files were restored, with the matching OpenAPI example and atomic-deployments doc updated. * fix: acquire stack lock before blueprint deploy mutates compose and marker files Local blueprint deploy wrote the compose and marker files and ran the policy assert before acquiring the per-stack lock; the lock only wrapped the deploy itself. A reconcile could therefore rewrite an owned stack's files while a manual deploy/update/rollback/backup was running. The lock now wraps the whole critical section (create, write compose, write marker, policy assert, deploy), so on conflict nothing is written and the reconcile records a failed outcome. Adds a test asserting a deploy under a held lock records failed, writes no marker file, and leaves the manual lock untouched. * fix: make remote blueprint apply atomic under the receiving node's stack lock Remote blueprint deploy wrote the compose and marker files to the target node via separate HTTP calls and only locked on the final deploy, so the file writes could race a manual operation on that node. A node's operation lock is process-local and cannot be held by the hub across HTTP calls, so the locked create/write/deploy now runs on the receiving node. The locked critical section is extracted into BlueprintService.applyLocalUnderLock and exposed via POST /api/blueprints/apply-local. The hub posts the blueprint to that endpoint in one call; the receiving node runs create + write compose+marker + deploy under its own per-stack lock. Older nodes without the route answer 404 and fall back to the legacy multi-call flow. The endpoint is gated by paid tier and the same per-stack stack:edit and stack:deploy permissions as the PUT-compose + deploy it bundles, validates the stack name, compose size, and marker structure, and returns 409 on a lock conflict without writing anything. Adds tests for the atomic single-call path, the 404 legacy fallback, the 409 lock-conflict mapping, the route validation and permission paths, and the write-compose-then-marker-then-deploy ordering of the shared locked apply. * fix(deps): bump undici to 7.28.0 to clear high-severity advisory The frontend CI npm audit gate (--audit-level=high) failed on a transitive undici 7.25.0 (a dev-only dependency via jsdom): TLS certificate validation bypass (GHSA-vmh5-mc38-953g) and cross-user cache information disclosure (GHSA-pr7r-676h-xcf6). Bumping undici within jsdom's existing ^7.25.0 range to 7.28.0 clears the high-severity advisory and unblocks the frontend job. Lockfile only; no direct dependency or source change.	2026-06-18 13:38:19 -04:00
Anso	7ce045accb	feat: pre-deploy scan visibility and pinned scanner version (#1378) ... * feat: pre-deploy scan visibility and pinned scanner version Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a manual deploy can surface each image's latest scan before it runs. - Managed Trivy now installs a pinned, known-good version by default for reproducible installs. Auto-update still tracks the latest release, and an explicit update always pulls the latest. - Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from the editor first shows each image's latest cached scan severity for review. It is visibility only and never blocks; deploy enforcement is unchanged. - Backend: pre_deploy_scan_advisory setting, PUT /security/pre-deploy-scan-advisory, a cache-only GET /security/stacks/:name/pre-deploy-summary, and a node-scoped getLatestVulnScanByDigestForNode lookup. - Frontend: advisory toggle on the Security page scanner setup, and a PreDeployScanDialog wired into the editor deploy flow that fails open when the summary is unavailable. - Docs: scanner configuration, version pinning, and the advisory. * fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state Addresses review findings on the pre-deploy advisory. - Block a second editor deploy during the async advisory window with a synchronous pending ref, cleared on cancel and in the deploy's finally, so a double-click can no longer start two deploys. - Keep the pre-deploy advisory toggle visible to admins whenever the setting is on, so it can still be turned off after the scanner becomes unavailable. - Resolve the managed Trivy version inside the install lock so the busy state and serialization cover the latest-version fetch and the managed-install check.	2026-06-16 00:42:33 -04:00
Anso	3d39d856a3	feat: chart-led Security overview with sortable Images and History tables (#1364) ... * feat: chart-led Security overview with sortable Images and History tables Refine the Security page around the existing design system and add the data the dashboard needs. - Overview leads with four charts (30-day risk trend, severity donut, top exposed images, findings by type); the signal-rail counts become a secondary summary, and the scanner and deploy-enforcement posture follow. - Images becomes a recessed table with search, a severity filter, sortable columns, a last-scan column, and inline scan actions; the findings cell is clickable into the scan sheet, and the per-row cursor tooltip is dropped where the columns already carry that information. - Policies puts deploy-enforcement first, collapses the policy packs into an accordion, and uses the standard primary button for Add policy. - Suppressions and acknowledgements move their titles and Add buttons outside the cards, matching the Fleet tab layout. - History switches from the detail sheet to an inline table (search, sortable columns, two-scan compare, pagination); the now-unreachable scan-history overlay is removed. - Add GET /api/security/overview/trend, a node-scoped daily critical/high rollup backing the risk-trend chart. - Extract the shared image-scan hook and the severity classifier, and harden the overview data fetch so a malformed non-critical response can never read as a clean security state. * fix: treat malformed Security responses as errors, not empty or clean states Address an independent review of the data-fetch paths so a 200 with an unexpected shape can never read as a benign "no findings" view. - SecurityView: validate that the image-summaries body is a scan-summary map; an unexpected shape now sets the error state instead of an empty map. Isolate the trend fetch in its own self-catching promise so a transport failure on the non-critical chart can no longer poison the overview or summaries error state. - useImageScan: only a "completed" poll counts as success (a malformed or unknown status now throws), and a failed post-scan summaries refresh is logged instead of silently dropped. - HistoryTab: a 200 whose body lacks an items array is treated as an error, not an empty "no completed scans" list.	2026-06-12 14:35:03 -04:00
Anso	38aabe7064	feat: health-gated updates and rollback readiness (#1354) ... * feat: classify stack deploy and update failures with suggested next actions Failed deploy and update responses now carry a failure classification (cause category, headline, and suggested next step) derived from the compose error output. The recovery panel and chip render the classification and include it in copied diagnostics, and gateway-style failures surface as a node-unreachable cause. * feat: add update and rollback readiness reports for stacks Before a manual update, Sencho now shows an advisory readiness verdict computed from the stored preflight result, open drift findings, live container health, the pending image change, the rollback backup slot, and node disk headroom. The Stack Dossier gains a rollback readiness section that states what a rollback can restore and explicitly discloses that volume and bind-mounted data are not covered. Toolbar and sidebar updates now share one update path, and admins can create a fleet snapshot from the readiness dialog before updating. Nodes that do not advertise the capability keep the direct update flow. * feat: observe stack health after updates with a post-deploy health gate After a deploy or update succeeds, Sencho now watches the stack for a configurable observation window and records a passed, failed, or unknown verdict: containers must stay running, healthchecks must report healthy, and restart loops or disappearing containers fail the gate. The deploy panel shows the observation live and holds off auto-closing until the verdict lands, a failed gate surfaces the existing recovery actions including rollback, and the stack timeline records update started and gate verdict events. Scheduled, webhook, bulk, and git-source updates are gated the same way; rollbacks and installs are deliberately not. The gate is observational only and can be tuned or disabled per node under host alert settings. * docs: document health-gated updates and rollback readiness New operator page covering the update readiness dialog, the post-update health gate and its settings, the rollback readiness disclosure, and classified failures, with cross-links from the atomic deployments and deploy progress pages. The API reference gains the readiness and health-gate endpoints, the healthGateId success field, and the failure classification schema on deploy and update error responses. * feat: withhold the success verdict while the health gate observes An update used to show a green Succeeded that a failed health gate then contradicted moments later. The deploy modal now reports Verifying health while the gate observes, shows success only when the gate passes, and makes a failed or unknown gate the headline result; success toasts soften to a verifying message while a gate runs. The mobile recovery card groups its actions behind one bottom-right Take action menu so it stays compact on a phone, with the classified cause still visible on the card. A successful image update now also counts as the last known-good marker in rollback readiness, and the docs gain screenshots of the readiness dialog, gate states, dossier section, and settings. * fix: harden log format strings and the env existence path check Log calls that interpolated the stack name into the console format string now use constant format strings with placeholder arguments, and envExists validates path containment inline at its filesystem access, matching the established patterns used elsewhere in the same files. * test: adapt deploy modal success specs to the post-deploy health gate The deploy feedback modal now withholds its success verdict while the health gate observes the new containers, showing "Verifying health" until the gate passes. The two success-path E2E tests waited for "Succeeded" within the gate's 90s default window and timed out. Shorten the observation window to the 15s minimum for these tests via the settings API, assert the verify-then-succeed sequence the modal actually renders, and restore the default window afterward so the test value does not leak into later runs. * fix: serialize health gate polling and harden gate observation Address race conditions in the post-update health gate found in review. Backend: the gate poller used setInterval, so a Docker observe slower than the 5s tick could overlap the next poll and corrupt the restart and missing-container accounting, and a wedged socket could leave a poll pending forever. Polling is now single-flight: each cycle self-schedules the next only after it settles, and the observe is bounded by an 8s timeout so a hung probe counts as a poll error and resolves the gate unknown after three in a row. Frontend: the gate poller could overlap requests, letting a slow earlier "observing" response overwrite an already-applied terminal verdict. It is now single-flight with a terminal latch, so a late response can never roll the UI back from passed or failed. Also reject a non-digit nodeId on the snapshot coverage route instead of letting parseInt coerce it, document that turning off the deploy progress panel opts out of the live gate UI while the gate still runs server-side, and add gate-coverage tests for the webhook, git source, and auto-update apply paths plus the new single-flight, observe-timeout, and recovery cases.	2026-06-11 00:26:26 -04:00
Anso	e8f271f5f6	feat(ui): make the core stack flow usable on mobile (#1327) ... * feat(ui): make the core stack flow usable on mobile Below the md breakpoint the app collapses to a single full-width column: the stack list is full-screen, tapping a stack opens a full-screen detail with a Health / Logs / Compose segmented control (Logs first) and a back button, and a bottom tab bar switches Stacks, Fleet, Schedules, and Settings. Compose is read-only on a phone with a prompt to edit on desktop. Desktop (md and up) is unchanged: the mobile shell is gated behind a useIsMobile hook plus max-md/md variants, and the stack-detail blocks are shared with the desktop two-pane view so it renders identically. Also generalizes the unsaved-changes guard so leaving a dirty editor (back, tab bar, hamburger) prompts before discarding; adds 44px touch targets on list rows, filter chips, and actions; makes log and shell modals full-screen on mobile; and offsets toasts and the deploy pill above the bottom tab bar. * fix(ui): keep mobile nav in sync when opening views from outside the bottom bar On a phone the sidebar activity actions, the node switcher's Manage Nodes, the profile Settings entry, and the dashboard configuration links set the active view without flipping the mobile surface to content, so the user stayed on the stack list and never saw the destination. Route these through the mobile-aware navigation and settings helpers (a no-op on desktop).	2026-06-07 01:03:13 -04:00
Anso	b33a0e8422	fix(deploy-enforcement): surface scan-policy blocks on update and sidebar deploys (#1248) ... * fix(deploy-enforcement): surface scan-policy blocks on update and sidebar deploys A blocked deploy only opened the policy dialog from the editor deploy button. The update action and the sidebar context-menu deploy/update fell through to a generic error toast, so an admin could not review the violations or bypass the block from those entry points. Route the 409 policy response through a shared handler on all three paths and make the "Deploy anyway" bypass retry the originating action (deploy or update) so an update bypass still re-pulls images. Also: - Correct the "Block on deploy" policy-editor helper text, which described post-deploy alerting rather than the pre-flight rejection it actually performs. - Dispatch the documented scan_finding warning (policy name and the offending images) when a scheduled auto-update or auto-start is blocked, instead of recording an opaque failure. - Add a standard log line when the gate blocks a deploy, plus developer-mode diagnostics for the matched policy and per-image severity decision. - Fix deploy-enforcement docs: complete the enforced entry-point list, correct the policy-precedence wording, and remove inaccurate tier and audit-actor claims. * fix(deploy-enforcement): surface policy block on rollback and name images in remote auto-update alert Addresses two gaps found in independent review: - Rollback is a policy-gated deploy path (it restores the saved files then re-runs the gate before redeploying), but the frontend treated a blocked rollback as a generic error toast. Route the 409 through the same handler as deploy and update so the block dialog opens, and let an admin "Deploy anyway" retry the rollback with the bypass flag (the rollback route already honors it). - The remote auto-update path dispatched its policy-block warning without the offending image refs, unlike the local scheduler. Append the images so the alert matches the documented contract on every node. Also list rollback as an enforced entry point in the docs and clarify that Git Source enforcement covers both the create-time deploy and a manual apply-with-deploy.	2026-05-29 08:48:50 -04:00
Anso	117f590332	fix(security): gate admin-only scan affordances on isAdmin (#1230) ... * fix(security): gate admin-only scan affordances on isAdmin Backend already required admin for SBOM, SARIF, scan policies, Trivy install/update/uninstall, the auto-update toggle, CVE suppressions, and misconfig acknowledgements. The matching frontend surfaces were gated only on isPaid (or only on isReplica), so non-admin users at the same tier saw buttons that returned 403 on click. Threads isAdmin from useAuth() into SecuritySection, SuppressionsPanel, and MisconfigAckPanel. Updates the scan-result sheet caller in ResourcesView so SBOM and SARIF render only when paid AND admin; passes canManageSuppressions to the stack-misconfig sheet so admins can ack misconfigs from that surface too. Read paths remain visible to non-admins (policy list, suppression list, ack list, scan history) since the GET routes are auth-only on both sides. * fix(security): close 3 remaining scan-sheet parity gaps from review Code review surfaced three sites missed in the first pass: 1. SecurityHistoryView opened the scan sheet with canGenerateSbom set only on isPaid, so Skipper non-admins saw SBOM and SARIF buttons even though the backend requires admin+paid. Now ANDed with isAdmin. 2. ResourcesView passed onRescan unconditionally, and the sheet renders a Re-scan primary action whenever onRescan is defined. Non-admins reaching the sheet via the severity-badge shortcut saw the button; clicking it called POST /security/scan, which the backend requires admin for. onRescan is now undefined for non-admins. 3. ShellOverlays and ResourcesView passed canManageSuppressions=isAdmin without considering the replica gate, so a replica admin saw suppress and ack columns whose backend writes blockIfReplica. The sheet now probes /fleet/role internally and ANDs !isReplica into the effective canManageSuppressions, so the column hides on a replica regardless of how the caller wired the prop. * fix(security): clear isReplica state on every scan-sheet probe The previous probe only flipped the state to true on a replica response and never wrote false on a control, non-OK, or skipped probe. With the sheet kept mounted by ResourcesView, SecurityHistoryView, and ShellOverlays, an admin who first viewed a scan on a replica would keep suppress/ack controls hidden even after switching to a control instance, because the stale true value persisted across re-opens. The effect now resets isReplica to false at the start of every probe and assigns the result of /fleet/role directly. Probe failures and skips leave the state at false, so the UI is permissive and the backend blockIfReplica guard remains the source of truth.	2026-05-25 18:33:04 -04:00
Anso	7c84969b31	fix(editor): harden save-deploy, node-switch, delete, and stats reactivity (#1188) ... * fix(stacks): validate input, bound YAML parses, and reorder delete steps Backend hardening covering three editor-served routes: - `/:stackName/containers` GET adds an explicit `isValidStackName` guard so bad input is rejected at the call site even if the router-level param validator changes in future. - `MAX_COMPOSE_PARSE_BYTES` (1 MiB) bounds the two `YAML.parse` callsites (`resolveAllEnvFilePaths`, `/services`) so a malformed or oversize compose cannot exhaust heap during routine env/service lookups. - `DELETE /:stackName` is reordered to abort before any database cleanup if `FileSystemService.deleteStack` throws, keeping DB and FS in sync. Partial-failure responses now describe the resulting state in human terms instead of returning a generic 500. Adds debug-mode entry-point traces (`[Stacks:debug] ...`) on save / down / restart / delete handlers, all sanitised through `sanitizeForLog`. New vitest covers the containers validator, the YAML size guard, and the small-compose happy path. * fix(editor): gate save-and-deploy on save success, abort stale loads `saveFile` now returns a boolean: true on a successful PUT, false on any failure. `handleSaveAndDeploy` short-circuits when save fails so a backend 500 on the compose write no longer slips through to a deploy with the unsaved in-memory content. The diff-preview confirm path in ShellOverlays applies the same guard. `loadFile` now drives a per-hook `AbortController`. A stack switch, a node switch (via `resetEditorState`), or hook unmount aborts the in-flight GET chain so a late compose / env / containers / backup response from the previous selection never overwrites freshly-loaded state. `hasUnsavedChanges` is exported so EditorLayout can check it during the node-switch lifecycle. New unit tests cover the boolean save contract and the save-fail-blocks-deploy invariant. * fix(editor): prompt on node switch when the editor has unsaved changes Switching the active node previously called `resetEditorState()` without checking the editor's dirty state, silently dropping in-progress edits. The post-auth shell now intercepts the node-change effect: if the editor is dirty, the attempted node is stashed via the existing `pendingUnsavedNode` field, `pendingUnsavedLoad` is set to a sentinel that routes `discardAndLoadPending` to `setActiveNode`, and `activeNode` is reverted to the previous node so the dialog can be resolved without losing content. A re-entrant switch (clicking a third node while the dialog is still open) is now ignored — the second switch reverts silently so the dialog's anchor stays on the first attempt. When the previous node is no longer in the registry and cannot be reverted to, the operator gets a warning toast before the wipe so the loss is at least visible. * fix(editor): split delete and deploy permission gates in the action bar The action bar previously wrapped every affordance — including the Delete menu item — in a single `can('stack:deploy')` check, even though the backend route requires `stack:delete`. A user with `stack:deploy` only saw a Delete button that 403'd, and a user with `stack:delete` only saw no menu at all. Each affordance now renders against its own permission: deploy / stop / restart / update on `stack:deploy`, delete on `stack:delete`, rollback on `canDeploy + isPaid + backupInfo.exists`, scan on `isAdmin + trivy.available`. The overflow menu appears if any of {rollback, scan, delete} is granted, so a delete-only operator still has a way to remove the stack. Adds a Monaco model dispose on EditorView unmount via the existing editor ref, and a compact `Stats unavailable` chip in the CONTAINERS header that lights up when the live-stats WebSocket reports a persistent failure. * fix(editor): make container-stats hook reactive to the active node `useContainerStats` previously read the active node id from `localStorage` on each WebSocket open, with a deps array of `[containers]` only. After a node switch the stats stream stayed pointed at the previous node's `/ws` endpoint until the containers array refreshed. The hook now accepts `activeNodeId` as a second argument, depends on `[containers, activeNodeId]`, and drops the localStorage read. The return shape is `{ stats, error }`: the error field carries a string when the stream fails, surfaced by EditorView as a small chip in the CONTAINERS header. A per-WS `warnedOnce` set ensures a flaky daemon emits at most one console.warn per stream lifetime, never at message rate. Close codes 1000 / 1001 stay silent (normal teardown, navigation). The error reset (`setError(null)`) is split into its own effect keyed on `activeNodeId` so the banner does not flap on every containers-array refresh tick against a persistently-flaky daemon. Tests cover the new shape, the node-id reactivity, and the abnormal-close warn behaviour. * docs(editor): describe new gate split and add troubleshooting entries Updates the editor cockpit page to reflect that the action bar now gates each affordance on its own permission (deploy / delete), and that the bar appears for delete-only users so a stack can still be removed. Adds three troubleshooting accordions covering the new behaviours: a failed save that blocks the subsequent deploy, the unsaved-changes prompt on node switch, and the live-stats chip when the daemon is unreachable. Adds an E2E spec verifying that a forced PUT 500 on the compose write surfaces the failure toast and prevents the deploy POST from firing. * fix(stacks): use printf-style format for compose-down warn `console.warn` treats arg-1 as a printf format string when subsequent args follow. The template literal here interpolated a sanitized but not %-escaped stackName into arg-1 alongside an error argument, so a stackName containing a `%s` placeholder could theoretically swallow the error in the substitution. Switch to the file's established `'... %s ...', value, err` pattern. * test(editor): fix save-deploy spec; click both edit buttons, drop Monaco fill The editor has two edit affordances: a lowercase 'edit' in the Anatomy panel header that swaps the right column to the editor tabs, and a capital 'Edit' in the editor toolbar that flips Monaco from read-only into edit mode. The spec previously matched both with a case-insensitive regex and only fired one click, so Monaco never entered edit mode. It also tried to fill .monaco-editor textarea — that element is Monaco's IME accessibility helper, hard-coded readonly; the real editable surface is a contenteditable div. `saveFile()` does not gate on a dirty buffer, so the spec does not need to modify Monaco at all. Click both edit buttons with case-anchored regexes and drop the fill step. * test(editor): disambiguate Save & Deploy locator from sidebar row The TEST_STACK fixture is named 'e2e-save-deploy-stack'. The sidebar renders each stack into a div with role=button whose accessible name includes the stack slug, so the regex /save.*deploy/i matches both the sidebar row ('e2e-save-deploy-stack') and the editor toolbar's actual Save & Deploy button — strict-mode bails. Anchor the locator to the literal button text with exact:true.	2026-05-24 15:18:47 -04:00
Anso	3ec0a45ff0	feat(frontend): SystemSheet §9.11 — security and scheduled sheets (PR 2/3) (#961) ... * feat(frontend): add SystemSheet primitive and migrate mesh sheets to §9.11 chrome DESIGN.md §9.11 codifies one canonical right-side detail-sheet shell (cyan rail, mono crumb, italic serif name, mono meta, ESC chip + close glyph, fixed three-slot toolbar, cyan-underline tabs, ScrollArea body, footer freshness band). Today the 16 sheet consumers each render their own header chrome with stock shadcn SheetHeader/SheetTitle. Introduce <SystemSheet> + <SheetSection> in frontend/src/components/ui/system-sheet.tsx, composing the existing <Sheet>/<SheetContent> primitive. Add a backward-compatible showClose prop to SheetContent so SystemSheet can render its own ESC chip + close glyph instead of the stock cyan square close. Migrate the four mesh sheets as the first batch: * MeshActivitySheet: crumb Fleet › Mesh › Activity, footer freshness from most-recent event timestamp. * MeshOptInSheet: crumb Fleet › Mesh › {nodeName}, meta of opted-in count, drops the redundant bottom Close button (ESC chip dismisses). * MeshDiagnosticsSheet: removes the icon-prefixed title (forbidden by §9.11), lifts Refresh/Restart buttons from the body into the toolbar band, three SheetSection blocks for sidecar status, streams, cache. * MeshRouteDetailSheet: adds Overview/Events/Raw tabs, lifts Test probe into the toolbar primary slot, footer surfaces last probe latency. * feat(frontend): migrate security and scheduled sheets to §9.11 chrome PR 2 of the System Sheet (§9.11) rollout, stacked on the SystemSheet primitive PR. Migrates six more sheet consumers and merges the Stack alert + auto-heal sheets into a single tabbed sheet per audit §17. Sheets migrated: * NodeUpdatesSheet: crumb Fleet > Updates, Recheck primary, Update-all secondary when applicable. Stat tiles and node rows lose their card-in-sheet wrapping (forbidden by §9.11) for flat dividers. * StackAlertSheet (now the merged stack monitor): tabs Alerts / Auto-heal, crumb Stack > {name} > Monitor. New initialTab prop lets callers open directly to either tab. Auto-heal tab is hidden entirely for Community-tier users (matches the existing tier-gating on the context menu trigger and keyboard shortcut). * StackAutoHealSheet.tsx: deleted. Its body became the Auto-heal tab inside the merged sheet. * VulnerabilityScanSheet: removed the icon-prefixed title (forbidden by §9.11). Re-scan, Compare, CSV, SARIF lifted from body cards into the toolbar band. Tabs Vulnerabilities | Secrets | Misconfigs (counts on the tab labels). SBOM dropdown stays in the body summary section pending a primitive enhancement for dropdown-attached toolbar actions. * ScanComparisonSheet: crumb Security > Scans > Compare, name Diff, meta with the +added/-removed delta. * SecurityHistoryView: the inner sheet only. Crumb Security > Scan history. Compare (paid + 2 selected) and Refresh in toolbar. * ScheduledOperationsView run-history sheet (lines ~847-935 only): crumb Schedules > {taskName} > Runs, Download CSV in toolbar, footer surfaces next-run timestamp. Hook refactor: * useOverlayState replaces three separate state vars (alertSheetOpen, alertSheetStack, autoHealStackName) with one stackMonitor object carrying { stackName, tab }. New helpers openAlertSheet(stackName), openAutoHeal(stackName), closeStackMonitor(). Tests rewritten and pass (11/11). * useSidebarContextMenu and ShellOverlays updated for the new API. The three other call sites (useStackMenuItems, useStackKeyboardShortcuts) already use openAlertSheet/openAutoHeal and need no change.	2026-05-06 23:19:16 -04:00
Anso	1cf996142b	refactor(frontend): EditorLayout final shell (B4-7) (#906) ... * refactor(frontend): extract useOverlayState hook from EditorLayout * refactor(frontend): extract useStackActions hook and wire useOverlayState into EditorLayout * refactor(frontend): fix quality issues in useStackActions post-review * fix(frontend): fix interval leak, RunResult contract, yml hardcode, and loadFile length in useStackActions * refactor(frontend): extract useSidebarContextMenu hook from EditorLayout * refactor(frontend): extract ShellOverlays component from EditorLayout * refactor(frontend): relocate Monaco layout effect and log-viewer event listener out of EditorLayout The Monaco tab-switch layout effect is now self-contained in EditorView, alongside its monacoEditorRef. The SENCHO_OPEN_LOGS_EVENT listener moves into useOverlayState, where openLogViewer lives. EditorLayout is left with the two coordination effects that depend on cross-hook state.	2026-05-04 07:43:02 -04:00