mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
381ed2a91fa7ff5743a365511d9f5cd6bff141a9
26 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Anso
|
381ed2a91f |
feat: add Admiral Hardened Build channel and business assurance surfaces (#1629)
* feat: add Admiral Hardened Build channel and business assurance surfaces Introduce Studio Saelix entitlement-backed Hardened Build switching, a single-flight image operation coordinator, Recovery Vault naming, Admiral Account settings, and typed Fleet update failures while preserving Community custom-repo and targetless pull-current updates. * fix: harden image-op paths and clear CI CodeQL/pilot flake Validate operation IDs before filesystem use, use hostname checks in Fleet fetch mocks, sanitize registry probe logs, and swallow expected TCP teardown errors in the pilot reverse-route post-handshake test. * fix: sanitize image-op docker config write and probe logs Allowlist-copy registry host keys and base64 auth before writing the temp DOCKER_CONFIG, and log registry probe failures with a fixed message so CodeQL no longer flags network-to-file and log-injection mediums. * fix: address Admiral Hardened Build audit blockers Expose imageChannel so hardened Fleet peers still POST for typed rejection, claim community updates before 202, terminalize helper failures, gate Hardened on paid, and align support/docs/e2e wording. * fix: terminalize image ops on helper survival and aborted claims * fix: prevent recreating persist from overwriting helper-exit failure * test: assert helper-exit failure lands before recreating persist * fix: keep current pointer when acknowledging a stale image operation |
||
|
Anso
|
ad71a281a3 | docs: reorganize documentation navigation (#1606) | ||
|
Anso
|
a7e856f447 |
feat: enforce singleton local node per instance (#1567)
Only one local node is allowed. Creating a second local returns 409, and the last local node cannot be deleted or converted to a remote type. Existing duplicate local nodes from older versions are preserved and can be cleaned up individually. Zero-local recovery auto-assigns the default flag. Frontend delete surfaces and the Add Node form respect the new invariant. Enforced in DatabaseService (addNode/updateNode/deleteNode guards) and routes (error translations). Legacy test fixtures use raw SQL helpers. |
||
|
Anso
|
41dc339c26 |
fix: enforce 1:1 compose path mapping for Pilot agent mounts (#1516)
* fix: enforce 1:1 compose path mapping for Pilot agent mounts Pilot enrollment now generates validated 1:1 bind mounts so every agent path maps to a unique compose directory. Persisted agent paths reconcile during startup to catch drift. Unsafe relative-bind redeploys are blocked before container removal to prevent path escapes. - Add composePathMapping utility with strict path validation - Generate COMPOSE_DIR and validated mounts during Pilot enrollment - Reconcile persisted agent paths during startup bootstrap - Block redeploy when a relative-bind mount would escape the compose root - Default Pilot UI path to /opt/docker/sencho - Update multi-node and pilot-agent documentation - Add regression tests for enrollment, bootstrap, compose-service, and environment-check paths * fix: update E2E enrollment regexes for YAML-quoted token values |
||
|
Anso
|
e9c262ae6a |
feat: split Host Alerts into Host Alerts, Container Alerts, and Stacks guardrails (#1461)
* feat: split Host Alerts into Host Alerts, Container Alerts, and Stacks guardrails Move global_crash from Host Alerts to new Monitoring > Container Alerts section. Move health gate and env deploy guardrails from Host Alerts to Infrastructure > Stacks > Deploy Guardrails subsection. Host Alerts now contains only host threshold settings (CPU, RAM, disk, alert suppression, and the master host_alerts_enabled toggle). Stacks gains a Deploy Guardrails subsection (node-scoped, admin-gated) alongside the existing Workflow controls (browser-local). Dashboard Crash detection row now routes to Container Alerts. * docs: update crash detection toggle description to match new Container Alerts section |
||
|
Anso
|
cc78873e65 |
feat(scheduler): group schedule action picker by operator intent (#1446)
* feat(scheduler): group schedule action picker by operator intent Reorganize the New Schedule action picker from a flat dropdown to a category-grouped list (Lifecycle, Updates, Security, Maintenance, Backups). - Extend Combobox component with optional group field on ComboboxOption, rendering grouped sections with non-interactive headers when groups are present. Flat rendering is unchanged for all other callers. - Reorder SCHEDULED_ACTIONS by category group and update seven action labels per the operator-intent spec. - Add DEFAULT_SCHEDULED_ACTION_ID constant so picker order and form defaults are independently controllable. - Wire grouped actionOptions into ScheduledOperationsView. - Update all label references in docs and tests. - Add Combobox grouping tests, registry order test, and default-constant test. * fix(scheduler): correct Combobox grouping for interleaved groups, docs labels - Replace last-group-append with Map-based group partitioning so interleaved or mixed-group options land in the correct group. - Add interleaved-groups test and restore non-interactivity test. - Update stale "Start Stack" references to "Start / Bring Up Stack" in doc action-label contexts. - Update action-picker alt text to describe the new grouped order. |
||
|
Anso
|
45c004e1cd |
docs: reflect Community tier rebalance for scanning, audit log, and registries (#1340)
Update tier mentions for the capabilities now available on Community: - Trivy managed auto-update, single-scan SBOM export, node labels, and the fleet topology layout modes are present-tense Community features. - The audit log documents a 14-day recent-activity window on every tier, with CSV/JSON export, anomaly detection, and configurable retention as Admiral. - Private registries split Docker Hub / GHCR / custom (every tier) from AWS ECR (Admiral). SARIF export and deploy enforcement stay Admiral. Also removes two fence-spec phrasings (per-tier label cell and 'visible on Admiral' for the audit tab) in favor of stating each requirement once. |
||
|
Anso
|
ce08a593d7 |
feat(settings): reorganize the settings hub into domain groups (#1321)
* refactor(settings): split System Limits and regroup the hub System Limits had grown into a grab-bag of host alert thresholds, Docker cleanup, and mesh data-plane controls under one mislabeled section. Split it into Host Alerts, Docker & Storage, and Fleet Mesh, and split Developer into Developer Diagnostics and Data Retention. Reorganize the sidebar into ten domain groups: Personal, Access, Infrastructure, Monitoring, Notifications, Automation, Organization, Security, Operations, Help. Each section now saves only its own keys, so a concurrent edit in one section no longer clobbers another. Data Retention sends the audit-log window only on a paid plan, matching the field's existing visibility, so a Community save no longer fails on a key the operator cannot set. NumberChip moves to a shared module and the toggle reuses the existing shared component. The /settings API is unchanged. * test(settings): cover registry structure and per-section save payloads Add structural invariants for the ten-group registry (every item maps to a real group, ids are unique, the System Limits and Developer splits land in the right groups with the right gates, renamed labels and the Registries paid gate hold) and per-section payload tests asserting each split section patches only its own keys, including the Community path where Data Retention omits the paid audit-log key. * docs(settings): document the regrouped settings hub Rewrite the settings reference for the ten-group layout, replace the System Limits page with Host Alerts, Docker & Storage, and Fleet Mesh, and document the prune-on-update, reclaimable-space banner, and mesh auto-recreate settings that were previously undocumented. Update the Settings navigation breadcrumbs across the feature docs and refresh the affected screenshots. * fix(settings): show Access sections as instance-global, not operator-scoped License, Users, SSO, and API Tokens are instance-global settings but the masthead scope label rendered them as operator-scoped because it keyed off the old Identity group. Only Personal sections (account, appearance) are operator/browser-scoped now; everything else reads as global. Also add a compile-time exhaustiveness guard to the section switch so a future SectionId added without a matching case fails the build instead of silently rendering a blank panel. * docs(settings): remap remaining settings breadcrumbs to the new groups Update the navigation breadcrumbs that still pointed at the removed Identity, Alerts, and Advanced groups: API Tokens and Users now sit under Access, Webhooks under Automation, Labels under Organization, App Store under Infrastructure, Appearance under Personal, and scan policies under Security > Vulnerability Scanning. Correct the settings reference scope note so Access reads as global. * docs(settings): remap renamed-section breadcrumbs across feature docs Sweep every feature, operations, getting-started, and reference page for navigation paths that still named the renamed settings sections, and point them at the current ones: Security becomes Security > Vulnerability Scanning, Notifications becomes Notifications > Channels, Routing becomes Notifications > Notification Routing, and Developer becomes Operations > Developer Diagnostics (with its retention windows under Operations > Data Retention). App Store moves under Infrastructure and the four-group overview in the getting-started intro is rewritten to the ten groups. Separators each page already used are preserved. |
||
|
Anso
|
865d792874 |
feat(pricing): collapse to two tiers (#1309)
* feat(pricing): collapse to two tiers (Community + Admiral) Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral) to two: a generous free Community tier and a single paid Admiral tier. The Skipper tier is removed. Now free in Community: auto-heal, auto-update, scheduled operations, webhooks, notification routing, Fleet Actions and bulk operations, SSO preset providers (Google / GitHub / Okta), unlimited users with admin and viewer roles, and deploy safety (atomic deploys, auto-rollback, and one-click rollback). Admiral (paid) is focused on running and governing a fleet: blueprints, Fleet Secrets, deploy enforcement, vulnerability report export, audit log, host console, private registries, mesh networking, node cordon, managed cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles (deployer, node-admin, auditor) with per-resource scoped assignments. Internally the license variant distinction is removed so tier is binary (community / paid). License validation still verifies the Lemon Squeezy store and product before granting paid status. Docs and the contributor guide are updated to the two-tier model. * docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording The licensing docs page kept the old Admiral pricing plus a Founder Lifetime column and an Enterprise paragraph after the two-tier collapse. Update it to $12/month or $99/year, drop the lifetime and Enterprise content, and link to the pricing page for current pricing. Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title, and three test comments. Historical CHANGELOG entries and the retired-Skipper license-guard test are intentionally left as-is. * docs: align licensing and SSO pages with the two-tier model Correct the SSO overview so the Google, GitHub, and Okta presets read as available on every tier, matching the provider table; only LDAP and Active Directory require Sencho Admiral. Remove the lifetime-plan references from the licensing, settings, and troubleshooting pages so they reflect subscription-only Admiral pricing. * fix(rbac): omit scoped permissions from /me on the Community tier Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case. * docs: use custom-pricing wording on the contact page The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists. |
||
|
Anso
|
65a69d9ecc |
fix(nodes): never send stored node tokens to clients (#1281)
Node read endpoints now return a client-safe projection that omits the stored api_token and exposes a has_token boolean instead, so a node's long-lived proxy credential is never serialized to a browser or API token client. The token stays encrypted at rest and is read server-side only by the components that need it (the remote proxy, the connection test, and the mesh dialer). The edit form opens the API Token field blank, and a blank value keeps the existing credential, so saving an edit without retyping the token no longer clears it; a non-empty value rotates it. The backend enforces the same rule defensively. Node management actions (add, edit, delete, test connection, generate node token) are gated in the UI to match their server-side permission checks, so operators no longer see an action the API would reject. The test-connection route also gains the missing server-side permission and token-scope guards. Also validate the x-node-id header and fall back to the default node for malformed values instead of an obscure 404, and return 400 (not 500) when deleting the default node. |
||
|
Anso
|
adcd04b01a |
refactor(auto-update): retire per-stack gate, drive auto-update from schedules only (#1233)
* refactor(auto-update): retire per-stack gate, drive auto-update from schedules only
The per-stack Auto-update toggle in the stack sidebar context menu wrote a
gate row to `stack_auto_update_settings`, but actual updates only ran when a
`scheduled_tasks` row with `action='update'` fired. On a fresh install the
toggle was inert: detection ran every 6h, nothing was applied.
The same context menu already exposes `Schedule task`, which opens
ScheduledOperationsView pre-filled for the stack where the user can pick
`Auto-update Stack` and any cron. Keeping the toggle alongside that flow
duplicated the same action and turned the gate table into a parallel store
of "is a covering schedule active" derivable from `scheduled_tasks` itself.
Drop the gate model entirely:
- Backend: remove the `stack_auto_update_settings` table and its four
accessors, the three routes under /api/stacks/*/auto-update, the per-stack
skip in /api/auto-update/execute and SchedulerService.executeUpdate's
fleet branch, and the clearStackAutoUpdateSetting call on stack delete.
Dashboard `autoUpdate` count derives from scheduled_tasks (action='update'
rows pinned to the node, total/enabled split).
- Frontend: drop the Auto-update entry from the sidebar context menu and its
optimistic toggle plumbing. Drop autoUpdateSettings state, the
/stacks/auto-update-settings fetch, and the auto-update-settings-changed
WebSocket branch. Slim useSidebarActivitySummary (just nextRunAt; no
enabled/total counts). AutoUpdateReadinessView's per-card autoUpdateEnabled
now means "a covering enabled action='update' schedule exists" (per-stack
row or fleet row on this node, earliest next_run_at wins, per-stack row
wins on ties), with the gate-fetch removed.
- New: scheduledTasksRouter broadcasts scope: 'scheduled-tasks' on POST,
PUT, PATCH /toggle, and DELETE so useConfigurationStatus and
useNextAutoUpdateRun refetch under the 250ms debounce instead of waiting
for the 60s poll. The broadcast is wrapped so a broken subscriber socket
cannot turn a successful mutation into a 500.
- Docs: rewrite the "Per-stack control" section of auto-update-policies.mdx
to describe the schedule-based model; update the matching troubleshooting
entry. The misleading fleet-update help text in ScheduledOperationsView
is corrected to reflect that every stack on the node is covered.
Tier parity: the surviving auto-update path (Schedule task -> Auto-update
Stack / All Stacks) is gated `requirePaid + requireAdmin` backend and
`isPaid + isAdmin` frontend, matching the gate the deleted routes carried.
The pre-commit grep returns no tier-related diff outside this PR's scope.
No data migration is provided: greenfield rules apply, and the leftover
table on already-shipped instances is harmless because no code reads or
writes it after this PR.
* docs: sweep remaining references to the per-stack auto-update toggle
The previous commit retired the per-stack Auto-update gate in favor of
configuring auto-update purely through scheduled tasks. This commit
removes the now-stale mentions of that toggle across the operator docs:
- docs/features/sidebar.mdx: drop the Auto-update entry from the Inspect
group description, the matching screenshot alt-text, and the Skipper
Note that listed it. Schedule task now carries the cross-link to
Auto-Update Policies.
- docs/features/stack-management.mdx: drop the Auto-update list item;
refresh the Schedule task entry to mention the Auto-update Stack action.
- docs/features/dashboard.mdx: rename the Configuration Status row from
"Auto-update stacks" to "Auto-update schedules" with the new value
shape, and rewrite the troubleshooting accordion to describe the
scheduled-tasks invalidation path.
- docs/features/scheduled-operations.mdx: rewrite the Auto-update All
Stacks row and helper text to reflect that every stack on the node is
covered (no per-stack opt-out from this surface anymore).
- docs/features/multi-node.mdx: rewrite the Updates column definition to
derive the Auto/Off flag from enabled Auto-update Stack / Auto-update
All Stacks schedules instead of the removed per-stack policy.
The auto-update-policies.mdx rewrite in the previous commit already
covered the main reference page. The sidebar-context-menu.png screenshot
will be refreshed on release once the new menu is live in production;
the alt text is updated in this commit so it accurately describes the
shipping state.
No website edits needed: the Auto-Update Policies feature card description
("Schedule automatic image pulls and redeployments per stack on your own
cadence") and the feature matrix labels ("Auto-update stack schedule",
"Auto-update all stacks schedule") remain accurate under the new model.
* fix(stacks): drop orphaned requireAdmin import after auto-update route removal
CI's backend lint step flagged this PR's earlier deletion of the three
/api/stacks/*/auto-update routes: those handlers were the only callers of
`requireAdmin` inside routes/stacks.ts, leaving the named import on line 15
unreferenced. `requirePaid` and `effectiveTier` from the same line are still
in use elsewhere in the file and stay.
tsc --noEmit does not flag unused named imports; ESLint's no-unused-vars
does. Local backend lint reproduces and now reports 0 errors against the
existing 334-warning baseline.
|
||
|
Anso
|
08caa914ce |
docs: v1 docs refresh (batch 2) (#988)
* docs(atomic-deployments): refresh page around current UI and behavior
Rewrites the page to match the v1 docs refresh template. Corrects
several factual errors against the current code, fills in missing
detail, and adds a screenshot of the rollback overflow menu.
Notable corrections:
- Scheduled tasks do not run atomically; only stack editor Deploy and
Update, App Store installs, webhook triggers, and image auto-updates
pass the atomic flag through to ComposeService.
- Rollback lives in the stack editor's More actions overflow menu, not
on the action bar directly. The backup timestamp renders as a
sub-line of the menu item.
- Health probe is a 3-second window with an exit-code check on every
container labelled with the compose project name; describe this
exactly rather than as 'waits briefly'.
- Document where backups live (DATA_DIR/backups/<stack>/), why they
are kept outside the compose folder, and that the slot is one per
stack with overwrite semantics.
- Document the four streamed log markers users see in the deploy
progress modal during the atomic flow.
- Add a troubleshooting accordion group covering missing menu entry,
late crashes outside the probe window, manual-intervention message,
and the single-slot retention edge case.
* docs(deploy-enforcement): refresh page for v1 and align with current enforcement paths
Update the page to match the current pre-flight gate behavior, the v1 modal chrome on the
block dialog, and the AccordionGroup troubleshooting pattern used across the v1 docs.
Drift items corrected:
- Replace the broken vulnerability-scanning/deploy-blocked-dialog.png reference with three
fresh captures under docs/images/deploy-enforcement/ (policy list, policy editor, block
dialog).
- Drop "Recreate from the stack actions menu" and the git-source apply pre-flight claim;
neither path runs the gate.
- Add bulk label deploy and the auto-update scheduler to the enforced code paths, with a
dedicated subsection for the auto-update interaction (alert-and-skip, not 409).
- Drop the false claim that severity chips in the block dialog are clickable; the dialog
is informational.
- Document the compose-parse-fails-closed branch with its synthetic violation label.
- Refresh dialog copy to reflect the v1 ModalDestructiveHeader (kicker, title, button
variants).
- Convert the troubleshooting Q&A into AccordionGroup blocks and add accordions for the
compose-parse-error case and the auto-update-skipped case.
- Quote the verbatim audit-log summary format.
* docs(blueprints): refresh against v1 UI and add federation/state-review coverage
* docs(git-sources): refresh page against v1 UI and current behavior
Rewrites the page against the v1 docs refresh template (Note tier-gate,
sectioned anatomy, AccordionGroup troubleshooting), aligning prose with
the live UI labels and the current code paths.
Corrections:
- Authentication toggle reads "Public (no auth)" / "Personal Access
Token" (not "None"), and apply mode "Auto-write files" (not
"Auto-write").
- Diff dialog kicker is GIT . PULL PREVIEW; local-edits state opens an
Overwrite local edits? confirmation modal whose primary button is
Overwrite and apply.
- Sidebar pending indicator is a small GitBranch icon, not a brand-color
dot, and the image-update dot takes priority over it on the same row.
- Pending update banner appears in the panel; Review re-fetches the
commit and opens the diff (no client-side payload caching).
Adds coverage for:
- Anatomy of the panel (pending banner, form, last-applied stat strip,
footer actions).
- 10-second webhook debounce window.
- Pending compose/env content is encrypted at rest in the database, not
just the token.
- Auth/host failures map to HTTP 400, never 401, so they do not sign
the user out.
- Per-stack lock serializes pull, apply, and create-from-git so a
webhook firing during a manual apply waits rather than racing.
- Compose validation has a 10-second budget; clone fetches have a
30-second timeout.
- New troubleshooting accordion for Pending commit has changed since
this pull was fetched.
Recaptures all five screenshots from the v0.74.x production node,
signed in as admin: panel, create-from-git tab, pull-preview diff
dialog, sidebar GitBranch pending icon, webhook Action select with
Git source sync highlighted.
* docs(stack-labels): refresh page for v1 sidebar grouping and fleet-action surface
- Lead with the v1 behavior the previous page did not cover: the sidebar
groups stacks under collapsible label headers (PINNED first, label
buckets sorted by stack count desc then name asc, UNLABELED last)
with a count chip per group. Trailing colored dots on each row
(max 3 + N overflow, paid-only) supplement the headers.
- Drop the stale claim that a label-pill filter bar lives between
search and the stack list; that UI no longer exists.
- Drop the right-click-on-pill bulk actions table (Deploy all / Stop
all / Restart all). The legacy per-node action endpoint stays in
the backend but no longer has a UI binding, so the page documents
only what users can click today.
- Document the two Skipper+ Fleet Action cards: Stop fleet by label
(name match across nodes, autocomplete, per-node breakdown,
HTTP 429 on per-node concurrency) and Bulk label assign (per-node,
replace semantics, clear on empty selection).
- Document the inline 'New label' form inside the stack right-click /
three-dot Labels submenu, the Settings - Advanced - Labels masthead
N/50 stat, the LABELS - NEW / EDIT modal kickers, and the
LABELS - DELETE - IRREVERSIBLE confirmation copy verbatim.
- Document the Fleet Overview Tags multi-select filter (filters by
stack labels aggregated across nodes), with cross-link to fleet-view.
- Capture every screenshot fresh from production signed in as admin:
sidebar-grouping, context-menu-labels, inline-create-form,
settings-labels, create-label-dialog, fleet-tags-filter,
fleet-actions. Drop the now-stale sidebar-with-labels,
sidebar-filtered, and bulk-actions-menu captures.
* docs(dashboard): refresh page for v1 layout (status masthead, gauges, fleet heartbeat, restart map)
Aligns docs/features/dashboard.mdx with the redesigned Home tab. Replaces the obsolete
Recent Activity feed coverage with the actual DashboardActivityCard split (Fleet Heartbeat
when remote nodes are registered, Stack Restarts (7d) otherwise) and recaptures every
screenshot from the v0.74.x production node.
* docs(global-search): refresh page for v1 palette
- Note tier and role gating on the Pages list (Auto-Update, Console,
Schedules, Audit) so the prose matches what the top bar exposes.
- Document the ACTIVE chip on the currently active node row.
- Document the 50-result cap counter and the Searching... loading state.
- Mention the ~250 ms debounce and clarify that filename matching
includes the file extension.
- Replace stack screenshot with a redesigned capture and add empty-state
Pages and Nodes captures showing the ACTIVE chip.
* docs(global-observability): refresh page for v1 layout (masthead, signal rail, filter strip, paused-resume chip)
Full rewrite against the current Logs tab and the v1 docs refresh template
(hero Frame, sectioned anatomy, AccordionGroup troubleshooting, refresh-cadence table).
Replaces the single overview screenshot with seven captures under
docs/images/global-observability/ (overview, masthead, signal-rail,
filter-strip, feed-bands, paused-resume-chip, error-only-filter), all from
the v0.75.x production node signed in as admin with PII scrubbed
(profile chip patched to AD, in-feed LAN IPs and third-party hostnames
substituted via DOM injection while the stream was paused).
Aligns prose with the actual UI labels and code:
- Masthead kicker reads LIVE LOGS · NODE · <NAME> with LOCAL for the
local node; state word toggles Streaming / Idle / Offline; SESSION
uses uppercase letter suffixes (1H 43M / 0M 12S) per formatUptime.
- Signal rail tile counts are scoped to the 2000-entry buffer and reset
with Clear; CONTAINERS is buffer-bound, not a monotonic accumulator.
- Filter strip controls quoted verbatim (Stacks · All / Stacks · n,
segmented controls All / Out / Err and All / Info / Warn / Error).
- Feed row anatomy: severity dot, timestamp, brand-cyan container name
with stack/container tooltip, message tinted by source. Row tint
follows detected level, which is regex-based, so an STDOUT line
containing ERROR: still classifies as ERROR.
- Day bands: NOW, Nm AGO, Nh AGO, calendar date.
- Empty states: two-tier kicker over caption (Awaiting events / No matches).
- Pause keeps the SSE buffer filling up to the 2000-entry cap; resume pill
reads <n> NEW · RESUME and counts the queue, not total arrivals during
the pause.
- Download filename and row format quoted: sencho-logs-<ISO8601>.txt and
[<ISO>] [<stack>/<container>] <LEVEL>: <message>.
Documents behavior the previous page never covered:
- Active-node scoping; node switch resets the stream and the buffer.
- SSE primary transport with 30-second server heartbeat and a 5-second
polling fallback against /api/logs/global (server-capped at 500 lines
per snapshot).
- Initial replay of the last 500 lines per container when the SSE
connection opens, so the feed has context immediately.
- Display limits (2000 client buffer, 300 rendered rows, Showing last
300 of N overflow notice).
- Refresh cadence table covering UI tick, flush cadence, polling
cadence, SSE heartbeat, sparkline window, and the Idle threshold.
Adds a seven-accordion troubleshooting block (Offline state, gray Idle
dot, ERROR-without-tint, growing Resume pill, Clear-cutoff lag,
node-switch buffer drop, fleet-wide aggregation expectations).
Tightens the closing Note so it makes clear that Notification Log
Retention does not govern this live container stream.
* docs(alerts-notifications): refresh page for v1 and absorb notification-routing
Full v1 template rewrite of /features/alerts-notifications. Bundles in
the entire Notification Routing page so a reader sees channels, routing,
per-stack rules, and retention in one place; deletes the standalone
notification-routing.mdx and points all five cross-link sites at the new
in-page anchor.
* docs(alerts-notifications): drop "What's not in scope" section
The page should describe what Sencho does, not enumerate what it does
not ship. Users find missing integrations through the Webhook section
and the routing matcher reference; the explicit disclaimer added noise
without adding guidance.
* docs(audit-log): refresh page for v1 layout, expanded action list, troubleshooting accordion
- Clarify that the search/method/date filter strip lives in Table view only.
Stream view always shows the unfiltered chronological feed.
- Fold the total-entries readout into the card subtitle wording where it
actually renders, instead of describing it as a separate header element.
- Sharpen the Peak hour off-hours window to the literal 08:00 to 17:59
working window the tile keys off, plus the 5% / 20% failure-rate tints.
- Note that the Actors tile names a sample actor alongside the new-IP count.
- Expand the example actions list to cover surfaces that have shipped since
the last edit: per-service stack lifecycle, node cordon/uncordon, fleet
replica role changes, Sencho Cloud Backup operations, Fleet Secrets, and
blueprint federation pin updates.
- Correct the Settings path: Settings · Developer · Data retention card,
Audit log input, Save settings button.
- Add a Troubleshooting AccordionGroup matching the rest of the v1-refresh
pages: missing tab, filter scope, anomaly thresholds, export cap, and
retention pruning.
- Replace all four screenshots with fresh captures of the current UI.
* docs(multi-node): refresh page for v1 layout, pilot agent mode, refreshed table columns
Rewrites docs/features/multi-node.mdx against the current product. The previous page predated the v1 Settings hub redesign and the Pilot Agent enrollment model, so it documented only the Distributed API Proxy add-node flow and missed the new Mode, Endpoint, and Labels columns on the Nodes table.
Restructures the page into 13 sections: intro, How it works, the local node, Choose a remote mode (decision table comparing Pilot Agent vs Distributed API Proxy), Add a remote node: Pilot Agent (three steps plus re-enrollment), Add a remote node: Distributed API Proxy (three steps), Switching between nodes, the Nodes table (full column reference), What Settings apply per node (verified against settings/registry.ts), License enforcement across nodes, Editing and deleting nodes, Security (token security, transport encryption, why no application-layer TLS), and Troubleshooting (AccordionGroup matching the v1 template used on audit-log, atomic-deployments, and deploy-progress pages).
Refreshes seven screenshots against the production node signed in as admin, scrubbing IPs and usernames before capture: full Nodes panel overview, Generate Node Token card with a placeholder token, Add node modal in Pilot Agent mode, Add node modal in Distributed API Proxy mode (with the inline plain-HTTP warning visible), Edit modal showing the Regenerate enrollment token card for a pilot agent, Pilot enrollment modal with the docker run command, refreshed node switcher popover, and a close-up of the table columns. Drops the obsolete add-node-form.png, http-warning.png, and per-node-scheduling/ folder.
* docs(fleet-view): refresh page for v1 layout, expanded tabs, cordon, sheet-based updates
- Aligns the Overview, Status, and Node Updates content with today's UI:
the masthead's `The fleet` headline plus CPU / MEM / CONTAINERS stat tiles,
the eight-tab strip (Overview, Snapshots, Status, Deployments, Traffic,
Federation, Fleet Actions, Secrets) with per-tier visibility, and the
Check Updates surface that is now a system sheet rather than a modal.
- Documents the toolbar (search, sort, filter popover with Status / Type /
Severity / Tags sections) and the Grid / Topology segmented control
including the topology graph's status pill (Online / Critical / Offline),
connector colouring, ReactFlow controls and minimap.
- Documents the per-card surfaces that were missing from the prior page:
Cordoned badge with cross-reference to Fleet Federation, fleet stack
label dots in the drill-down, container drill-down rows (state dot,
badge, image, status, open-in-editor hover button), and the Admiral
three-dot Node actions menu for cordon / uncordon.
- Documents the Node Updates sheet anatomy (Recheck and Update all (n)
header actions, four summary cards, node table columns, Update flow,
reconnecting overlay timing, admin enforcement) and the GitHub Releases
with Docker Hub fallback resolution path with its 30-minute cache.
- Replaces every stale screenshot with a fresh capture (overview,
topology, drill-down, status tab, node updates sheet) and removes the
obsolete files plus the empty docs/images/fleet/ folder.
- Reformats troubleshooting as an AccordionGroup matching dashboard,
multi-node, and audit-log refreshes.
* docs(fleet-backups): refresh page for redesigned fleet and settings UI
Replace all six screenshots with current production captures. Update
content to reflect the new fleet header card, eight-tab layout, full-
page Cloud Backup settings with header stats, and corrected navigation
paths. Add cloud backup rows to the access control table.
* docs(fleet-backups): convert troubleshooting to AccordionGroup pattern
Match the foldable-accordion pattern used across the v1 docs refresh
batch. Merges the standalone Cloud Backup troubleshooting subsection
into a single Troubleshooting section at the bottom of the page with
seven accordions covering skipped nodes, two restore failure modes,
three cloud-upload failure modes, and a diagnostic logging entry.
* docs(remote-updates): refresh page for v1 sheet, accordion troubleshooting, factual fixes
Rewrites the page against the v1 docs refresh template (Note tier gate,
sectioned mechanism deep-dive, Frame screenshots with detailed alt text,
inline AccordionGroup troubleshooting), bringing it in line with the
recently-refreshed fleet-view, fleet-backups, dashboard, and audit-log
pages.
The page is repositioned as the mechanism deep-dive (prerequisites, what
runs on a node during an update, completion and failure detection,
recovery actions). The full UI tour for the Node updates sheet remains in
fleet-view so the two pages stop overlapping; remote-updates now links
into fleet-view#node-updates instead of restating the table anatomy.
Captures three screenshots from the production node, signed in as admin:
fleet-node-updates.png shows the Node updates sheet with eight nodes and
seven remote updates available; local-update-confirm.png shows the
LOCAL · UPDATE alert dialog with the Cancel and Update & restart buttons;
node-card-update-available.png shows the Opsix card with the Update
available pill and the Update to v0.76.7 outline button.
Corrects several factual claims that no longer matched the current code:
- The remote early-fail threshold is about 3 minutes, matching
EARLY_FAIL_MS in backend/src/routes/fleet.ts, not 90 seconds.
- The Recheck button sits in the sheet header, not the footer.
- The component is a SystemSheet, so the page now consistently calls it
the Node updates sheet instead of a dialog, with lowercase "Node
updates" and lowercase "Update all (n)" matching the live UI.
- Reconnecting overlay polls /api/health every 3 seconds, not "every few
seconds".
- The local Failed badge surfaces as soon as the helper writes its error
file, by the 3-minute mark at the latest.
Documents the LocalUpdateConfirmDialog kicker, title, body, and CTA
verbatim, the Triggering... loading state on the Update buttons, the
four completion signals the gateway accepts (version change, process
startedAt change, offline-then-online transition, version at or above
the comparison target after 15 seconds), and the 60-second auto-clear
of the Updated badge.
Drops references to two screenshots that never existed
(fleet-node-updating.png, fleet-node-failed.png); the in-flight and
failed states are described in prose instead, the same way fleet-view
handles them.
* docs(scheduled-operations): refresh page for v1 timeline, fleet-wide update action, sheet-based run history
Rewrites the Scheduled Operations page against the v1 template
(Note tier gate, sectioned anatomy, Frame screenshots, AccordionGroup
troubleshooting) applied to sibling pages in this batch. Captures
seven fresh screenshots against the production node signed in as
admin (timeline, all-tasks, action-picker, create-restart,
create-prune, create-scan, run-history) and removes every legacy
PNG.
Documents the new "Auto-update All Stacks" action that was absent
from the page, extends the Skipper allow-list to all four Skipper
actions (Auto-update Stack, Auto-update All Stacks, Fleet Snapshot,
Vulnerability Scan) and clarifies that the action picker hides
operations the active tier cannot run.
Corrects several factual claims that no longer matched the code:
- Scheduled scan completion is `info`/`scan_finding` on a clean run
and `warning`/`scan_finding` when findings are present (not
`info`/`system` as previously stated). Cross-link now points at
`alerts-notifications#vulnerability-scanning`.
- Lifecycle actions (auto_backup, auto_stop, auto_down, auto_start)
execute against the local Sencho instance only; only Auto-update
Stack / All Stacks have a remote-proxy code path. The page
reinstates the guidance to schedule remote lifecycle operations
from that node's own UI.
- Run history lives in a right-side sheet with a "Schedules ›
<task> › Runs" breadcrumb and a Download CSV secondary action.
- Timeline masthead is described in terms of the v1 visual
(`NEXT 24 HOURS` kicker, italic display heading, monospace date
range, right-anchored Next pill with countdown, glowing cyan now
rail, six-tick bottom axis).
* docs(rbac): refresh RBAC & user management page against v1 template
Bring /features/rbac onto the v1 docs refresh template (Note tier gate,
sectioned anatomy, Frame screenshots, AccordionGroup troubleshooting).
Recapture five screenshots from the production node signed in as admin
and remove the three stale captures under docs/images/rbac/.
Corrections vs. the prior page:
- Deployer no longer claims node:read in the permission matrix; the
backend grants only stack:read and stack:deploy.
- Add the system:registries row (container registry management).
- Document the form as inline below the Add user button (not a modal).
- Note the (you) marker on the signed-in admin's row and the disabled
delete icon on that row.
Additions:
- Settings nav location and hub-only visibility.
- 2FA reset row action with verbatim modal kicker, title, and body.
- Five-failure / 15-minute MFA lockout behavior and admin reset recovery.
- Token-version session-security table covering deletion, role change,
password change, and admin 2FA reset.
- SSO password-fields-hidden line quoted verbatim and the per-provider
Require MFA toggle.
- Audit-log emissions list for every user-management mutation.
- API tokens cross-link explaining the user-vs-machine boundary.
- Scoped permissions section retightened: scoped role picker is
Deployer / Node Admin / Admin only; resource type is Stack or Node.
AccordionGroup with eight troubleshooting entries covering missing nav,
greyed role options, seat-limit errors, unexpected sign-outs, scoped
deployer mismatches, missing shield icon, re-locking MFA accounts, and
SSO role drift at provisioning.
* docs(2fa): refresh two-factor authentication and admin guide against v1 template
Bring /features/two-factor-authentication and /operations/two-factor-admin
onto the v1 docs refresh template (Note tier gate, sectioned anatomy, Frame
screenshots with descriptive alt text, AccordionGroup troubleshooting,
verbatim modal copy with kicker callouts). Recapture every screenshot under
docs/images/two-factor-auth/ from a fresh session and add six new captures
for surfaces the prior page did not document.
Corrections vs the prior pages:
- Panel rename: Settings -> Account & Security is now Settings -> Account,
under the Identity group of the settings sidebar. Replaced every
occurrence on both pages.
- Enrol dialog titles match the current modal: Pair your authenticator,
Confirm the pairing, Save your recovery codes (was: Set up 2FA, Confirm,
Save your backup codes). Step rail 01 PAIR / 02 CONFIRM / 03 ARCHIVE
documented.
- Manual-entry affordance is the always-visible Secret manual entry row
with a copy icon, not the toggleable Can't scan Show secret key link.
- Confirm step auto-submits on the sixth digit; no submit button. Verified
in MfaChallenge.tsx and MfaEnrollDialog.tsx and called out explicitly.
- Authenticator-app list trimmed to match in-app copy (1Password, Bitwarden,
Google Authenticator, or any TOTP app). Authy and Microsoft Authenticator
dropped because the dialog does not mention them.
- Disable dialog: kicker SECURITY MFA DISABLE, title Turn off two-factor,
destructive header, Disable button. Replaces the prior Disable 2FA
paragraph that did not describe the dialog chrome.
- Regenerate dialog: two-step flow with kicker SECURITY BACKUP CODES, Confirm
identity then New recovery codes, with the verbatim PREVIOUS CODES HAVE
BEEN INVALIDATED warn rail on the show step. Documented that the dialog
only accepts a TOTP, not a backup code.
- Per-user SSO toggle label corrected: Require 2FA on SSO sign-in (was:
Require 2FA even when signing in via SSO). Added the per-provider vs
per-user distinction on both pages (admins can also enable Require MFA
on the SSO provider config, which is independent of the per-user toggle).
- Admin reset modal: verbatim USERS RESET 2FA kicker, Reset 2FA for
<username> title, full-body copy reproduced. Documented that the reset
bumps the target's token version and invalidates active sessions.
Additions:
- Sign-in throttle: five failed verifications lock the account for 15
minutes, server returns 423 with Retry-After, UI shows the Retry in MM:SS
countdown plus Rate limited label. Lockout recovery section explains
that the counter only clears on a successful sign-in, so retries after
the window expires re-lock immediately.
- Account panel anatomy section enumerates the three rows (Authenticator
app, Backup codes, Require 2FA on SSO sign-in) plus the destructive
Disable 2FA link, and the masthead 2FA on / BACKUP N left chips.
- Recovery codes section now covers all three count states (3 plus, 1 to 2,
0) with verbatim helper text, tone, and the standalone No backup codes
left callout that renders at zero. New screenshots for the 2-remaining
and 0-remaining states.
- Cross-references to the admin operations page (CLI fallback, token version
rotation, what a reset changes in the DB), the SSO page, and the RBAC
page (per-provider Require MFA toggle, SSO auto-provisioning).
Troubleshooting on the feature page rewritten as an AccordionGroup with
nine entries: clock drift, wrong account selected, QR will not scan, lost
phone with no codes, lost codes with authenticator, ran out of codes,
unexpected SSO prompt (with both toggle causes), repeated lockout after
the window expires, missing shield icon on Users panel.
The admin operations page also gains the SSO + 2FA two-toggles table so
administrators can answer the per-user vs per-provider question without
context-switching between pages.
Six new images added; six existing images replaced. Total 14 captures.
* docs(rbac,host-console): drop enforcement-boundary detail from tier-gate notes
Operator-facing docs should state tier or role requirements once, in plain
customer-facing language, and leave the enforcement chain to the source.
Two surfaces on the v1-refreshed pages over-specified the gate:
- `features/rbac.mdx::Scoped permissions`: the Note enumerated both the UI
hide on Skipper and the `/api/users/:id/roles` write rejection. The first
half ("Scoped permissions require Admiral.") is the operator-relevant
fact; the rest reads as a fence specification, which is awkward for an
open-core product where the gate is readable in source anyway. Trimmed
to just the tier claim.
- `features/host-console.mdx::Availability`: the paragraph already says
who can use the console and that the Console tab is hidden on Community
or Skipper. The trailing "Attempting to access the console endpoint
directly without the correct license or role is rejected" is the same
bypass-prevention coda. Dropped.
No functional behavior change; the gates themselves are untouched.
* docs(sso): refresh SSO & LDAP authentication page against v1 template
Rewrites docs/features/sso.mdx against the v1 docs refresh template (intro
+ tier callout, sectioned Configuration anatomy, Frame screenshots,
AccordionGroup troubleshooting), bringing it in line with the previously
refreshed two-factor-authentication and rbac pages on this branch.
Recaptures all four screenshots from the production node signed in as
admin: sso-settings (overview with the five collapsible provider cards),
sso-settings-ldap (LDAP form expanded), sso-settings-oidc (Google form
expanded), sso-settings-custom-oidc (Custom OIDC form expanded with all
eleven fields).
Refreshes the Settings UI section to match the redesigned panel: each
provider is a collapsible card with an Active badge on the header, an
enable / disable toggle pill, and a footer with Save, Test Connection
(green check or red X next to the button), and Remove (only after a
config has been saved). Documents the static callback-URL helper that
sits below all five cards.
Clarifies that the per-OIDC claim mapping environment variables
(SSO_OIDC_*_ID_CLAIM, *_USERNAME_CLAIM, *_EMAIL_CLAIM) are accepted for
Google, GitHub, and Okta, not just Custom OIDC. The Settings UI hides
those fields on the presets because the defaults match.
Converts the troubleshooting section to an AccordionGroup with five
entries (Test Connection discovery failure, issuer validation error,
wrong username or missing email after sign-in, invalid redirect URI,
SSO buttons missing on the login page). Cross-links the operations
troubleshooting page for setup-time errors.
Tightens the LDAP TLS env var note to spell out the literal string
'false' requirement. Syncs the Combining SSO with 2FA section to use
the live toggle label 'Require 2FA on SSO sign-in'.
* docs(sso): drop the Community-tier Custom OIDC workaround tip
The Tip walked through how a Community-tier operator could integrate
Google, GitHub, or Okta by pointing Custom OIDC at the provider's
discovery URL, bypassing the Skipper preset gate. Operator docs should
state the tier rule once and stop; they should not describe how to
circumvent it.
The tier matrix above the removed block already names which providers
are paid; the Custom OIDC row already lists "any spec-compliant OIDC
provider" as its scope. That is enough.
* docs(vulnerability-scanning): refresh page for v1 UI and corrected tier mapping
The page was last revised before the v1 visual redesign and before the
tier-mapping changes shipped in v0.81.2 (open Community access to
secret scanning, compose misconfig scanning, scan history, and scan
comparison). This refresh:
- Rewrites the tier matrix to match the shipped Community / Skipper /
Admiral split. Secret detection, compose misconfig scanning, scan
history, scan comparison, and misconfig acknowledgements are now
correctly marked as Community. Scheduled fleet scans, scan policies
with block_on_deploy, SBOM, SARIF, and Trivy auto-update stay paid.
- Drops two stale Notes that said secret detection and compose
misconfig scanning required Skipper or Admiral. The page now states
each tier requirement once, in plain language.
- Refreshes all six existing screenshots from the production node:
resources-badges, scan-details-sheet, scan-history-sheet,
scan-compare-sheet, security-settings, app-store-toggle.
- Adds a new scan-config-button screenshot showing the stack-page
overflow menu where Scan config now lives.
- Describes the scan drawer header accurately: Re-scan + Compare + CSV
+ SARIF as top-level buttons, with SBOM as a separate button below
the summary.
- Updates the compose misconfig flow to point at the stack overflow
menu (not the Deploy controls).
- Converts the troubleshooting section to a single AccordionGroup per
the v1 template, and audits each entry for legacy phrasing and the
removed tier claims.
- Adds a TRIVY_BIN reference to the How it works section so operators
know about the host-binary override.
* docs(cve-suppressions): refresh page for v1 UI and corrected suppression specifics
- Recapture all three screenshots from the production node signed in
as admin under `docs/images/cve-suppressions/` (`settings-panel`,
`create-dialog`, `suppressed-row`). The previous file referenced
three image paths that did not exist in the repo.
- Align prose with the actual UI labels:
- Dialog kicker `SUPPRESSIONS . NEW`, title `New suppression`.
- Field labels match the form: `CVE or advisory ID`, `Package
(optional)`, `Image pattern (optional)`, `Reason`, `Expires in
(days, optional)`.
- Remove confirmation reads `Remove suppression` with kicker
`SUPPRESSIONS . REMOVE . IRREVERSIBLE`.
- Factual corrections:
- Fleet sync truncation cap is 5,000 rows (not 10,000).
- State the admin-role requirement once in the lead Note.
- Drop references to a `Fleet . Sync status` page and a `Reanchor`
button; neither exists in the UI. The reanchor flow is an admin
API call and is documented in /features/fleet-sync.
- Sharpen the specificity scoring section (package + image scores
3, package only 2, image only 1, neither 0) so the order matches
the read-time filter logic.
- Note that the image-pattern glob is case-sensitive.
- New coverage:
- Suppressing directly from a scan result, including which fields
are read-only in that inline flow and when to fall back to
Settings to broaden scope.
- The `replicated` and `expired` row badges in the panel.
- Hovering the package column on a suppressed row to surface the
Reason.
- Two distinct read-only modes: viewing a remote node from the hub
(panel hidden, banner shown) versus signing into a replica
instance (panel visible, read-only).
- SARIF export carries suppressions through as
`kind: external, status: accepted`, cross-linked to the
Vulnerability Scanning page.
- Convert troubleshooting to AccordionGroup with six entries; update
the truncation entry to reflect the 5,000-row cap.
* docs(private-registries): refresh page for v1 UI and fleet-wide credential model
Rewrites the page against the v1 docs template (Note tier gate, opening Frame,
sectioned anatomy, AccordionGroup troubleshooting) and replaces every
screenshot with a fresh capture taken against the current product.
Corrects several factual claims that no longer matched the current code:
- Registries are stored once on the control instance and applied fleet-wide,
not configured per node. The old Multi-node behavior section and the
matching troubleshooting entry described a per-node model that the product
no longer has.
- The Registries section is hidden on remote nodes (global scope) and on
Sencho versions that do not surface the feature. New troubleshooting
entries explain both visibility states.
- The feature is admin-only on Admiral. Non-admin operators do not see the
section even on Admiral; previous copy implied any Admiral license user
could manage credentials.
- Registry endpoints are not reachable from API tokens; only an admin
browser session can manage credentials. The Security section now states
this without naming internal route paths.
Documents UI behavior the previous page omitted: the inline form (not modal),
the four type-specific form variants, the Docker Hub read-only URL field, the
destructive delete confirmation with its stack-pull warning, the masthead
REGISTRIES count, and the empty-state callout copy.
Screenshots replaced:
- registries-overview.png: section with one configured GHCR card and the
masthead stat at one.
- registries-empty.png: empty state with the Add registry button and callout.
- registries-add-form.png: inline form with the Docker Hub default and the
read-only URL field.
- registries-ecr-form.png: form switched to ECR, showing the AWS Region
field and the relabelled AWS credential inputs.
- registries-card-detail.png: card close-up with the three action icons and
the metadata row.
- registries-delete-confirm.png: destructive ConfirmModal with the kicker,
title, and stack-pull warning body.
- registries-with-entry.png removed (superseded by registries-overview.png
and registries-card-detail.png).
* docs(auto-update): refresh readiness page for v1 redesign
Bring the Auto-Update Readiness doc in line with the shipped UI:
- Replace the hero screenshot with a fresh capture of the redesigned
board (italic-display hero, brand-cyan accent, per-node groups with
local/remote pills, dashed-border changelog separator).
- Rewrite the card-anatomy list. Drop the rollback-target bullet (the
field exists in the backend payload but is not rendered). Add the
"Rebuild available" inline label and the primary-image / multi-service
count line.
- Rewrite the risk-tags table as a risk-badges table using the actual
badge labels and colors emitted by the UI (Safe / Review / Blocked
with the corresponding icons; Digest rebuild for non-semver tags).
- Add an Empty state section and document the per-node group header.
- Tighten the hero subtitle paragraph to match the actual UI string
(only major-bump count is surfaced separately; preview failures are
not).
- Fix workflow step 4: major-bump apply path is the stack lifecycle
Update action, not the Schedules editor (a scheduled task hits the
same block).
- Add the 2-minute manual-refresh cooldown to the Recheck workflow.
- Remove the broken cross-link to the non-existent
/features/image-update-detection page and inline the 6-hour cadence
fact from ImageUpdateService.INTERVAL_MS.
- Convert troubleshooting to AccordionGroup format per the troubleshoot
ing convention used on /features/deploy-progress.
- Sync the Auto-Update entry in /features/overview.mdx to the new
badge labels and the corrected hero-counter description.
* docs(auto-update): fix Auto-Update entry point in Workflow step 1
Workflow step 1 said "Open the Auto-Update view from the sidebar." The
Auto-Update view is opened from the top nav strip (alongside Home,
Fleet, Resources, App Store, Logs, Schedules, Console, Audit). The
sidebar carries the stack list and the per-stack right-click / kebab
context menu that toggles auto-updates on or off; it does not house
the Auto-Update top-level view.
* docs(auto-update): trim enforcement detail from per-stack control note
State the tier requirement once and stop, per Directive 27. The
"The toggle does not appear on Community" sentence enumerates the
enforcement effect of the gate, which the source already reflects;
operator docs do not need to narrate it.
* docs(auto-heal): refresh page for v1 UI and policy hardening
Rewrite Auto-Heal Policies docs against the current Stack Monitor
sheet: corrects the Max restarts / hr field label, documents the
per-policy enable toggle, the consecutive-failures pill, the full
Recent activity action set (including Docker unavailable), the 30s
evaluation cadence, multi-node behavior, notification dispatches,
and the dashboard Configuration status counter.
Replaces the broken /images/auto-heal-policies/policy-sheet.png
reference with three fresh screenshots captured against a live
node: the sheet on the Auto-heal tab, a single policy row, and
the expanded Recent activity panel.
* docs(webhooks): refresh page for v1 UI, correct tier and add Git source sync
- Fix tier note: gate is Skipper or Admiral, management is admin-only.
- Update Settings path to Settings -> Alerts -> Webhooks; document the
read-only Node field and the green secret-reveal callout.
- Add the missing Git source sync action and the git-pull override value.
- Refresh the configured-webhooks card description: action/stack/node
badges, On/Off toggle, copy URL, and the Recent executions disclosure.
- Tighten the trigger section with a constant-time signature check note
and a status/body/meaning response table.
- Add an Accordion troubleshooting block covering common signature
failures, the 404 case, no-op actions on 202, and git-pull prereqs.
- Re-capture all three screenshots from the v1 UI.
* docs(webhooks): wrap troubleshooting accordions in AccordionGroup
* docs(sidebar): refresh page for v1 redesign with filter chips, bulk mode, row anatomy, and troubleshooting
Rewrites the Stack Sidebar page against the live v1 sidebar and the v1
docs refresh template (Frame screenshots, Note tier callouts,
AccordionGroup troubleshooting). Recaptures all four existing
screenshots and adds three new captures: filter chips, row anatomy,
and bulk mode.
Adds coverage for features the previous page omitted entirely: the
ALL / UP / DOWN / UPDATES filter chips with their counts cap and
collapse toggle; bulk mode (B key, sticky toolbar with Start / Stop /
Restart, and Update gated on Skipper or Admiral); stack-row anatomy
(status pill, label dots with +N overflow, image-update dot vs Git
source icon priority, hover kebab); the Auto-update toggle, Schedule
task, and Open App entries in the context menu; the B shortcut for
bulk mode.
Corrects three claims that no longer matched the code or UI:
Auto-Heal is gated on Skipper or Admiral, not universal; the global
Ctrl+K opens the command palette, not the sidebar search box; the
activity footer kicker reads LIVE / IDLE with the verbatim copy from
SidebarActivityTicker. Documents the in-menu ↗ and L › glyphs as
visual hints rather than global keybindings to match
useStackKeyboardShortcuts.ts.
* docs(sidebar): trim enforcement-effect sentence from context-menu tier note
State the Skipper / Admiral requirement once and stop, per Directive 27.
The "They do not appear in the menu on Community" clause described the
enforcement effect alongside the gate, which the directive bans in
operator-facing docs.
* docs(host-console): refresh page for v1 UI and clarify shell metadata
Rewrite the Host Console page to match the current Cockpit layout
(masthead + terminal well + chip strip), replace the legacy PowerShell
screenshot with a fresh bash capture, and document the masthead tone
states, kicker, metadata pills, and session/heartbeat behavior. Trim
the security section to state the tier and role rule once.
* docs(licensing): refresh page for v1 UI, corrected pricing, and trial flow
Rewrites the Licensing & Billing page to match the redesigned v1
Settings layout. The previous draft still described the legacy
Settings Hub: in-app "Upgrade your plan" Skipper/Admiral cards,
"Start monthly trial" / "Start annual trial" buttons, the
"Have a license key?" field, "Manage Subscription" with a capital S,
"Deactivate License" as the button label, and the license-active.png
asset rendering the literal "Sencho Pro" string in the card title.
None of that exists in the current product.
- Refreshes the Plans table to the live pricing on sencho.io/pricing
and adds an Enterprise mention with the floor price ($3,500/year).
Skipper now $11.99 annual / $14.99 monthly / $449 lifetime, Admiral
now $69.99 annual / $89.99 monthly / $2,499 lifetime.
- Rebuilds the Feature breakdown from a code-level audit of every
requirePaid, requireAdmiral, requireScheduledTaskTier, and
requireTierForSsoProvider call site in backend/src/routes, not
from the marketing page. Notable code-grounded items: CVE
suppressions on Community (no requirePaid guard), manual fleet
snapshots on Community (scheduled snapshots on Skipper),
Sencho Mesh under Admiral (entire mesh.ts router is requireAdmiral),
and scheduled-task tiering names update/scan/snapshot as the
Skipper subset with everything else under Admiral.
- Rewrites the Free trial flow end to end. The previous steps told
operators to click in-app "Start monthly trial" or "Start annual
trial" buttons; no such buttons exist. The new flow starts on
sencho.io/pricing, switches to the Annual or Monthly tab, clicks
"Start 14-day trial" on the Admiral card, completes the Lemon
Squeezy checkout (card-required, no charge before day 14), and
pastes the issued key into Settings -> License -> License key.
- Adds a new "The Plan section" anatomy block describing the masthead
SCOPE / PLAN / DURATION (or RENEWS, TRIAL, STATUS) stat pills and
the Plan card fields (Customer, Product, masked License key, status
helper).
- Adds a new "License states" reference table covering
Community / Trial / Active subscription / Active lifetime /
Expired / Disabled, what each surface renders, and which of the
Plan / Activate / Pricing sections is visible in each state.
- Corrects every UI label that drifted: section heading is Activate,
field label is License key (not "Have a license key?"), buttons are
Manage subscription (lowercase s) and Deactivate (not "Deactivate
License"), and the action-row hint reads "Lemon Squeezy manages
billing".
- Documents the redesigned profile dropdown: identity header with
initials chip, role badge, and tier badge, then Settings,
conditional Billing, Documentation, Feedback, an Appearance
segmented control, and Log Out. Billing only appears when the
license is an active non-lifetime subscription.
- Replaces all four screenshots under docs/images/licensing/:
license-admiral-active.png (production Admiral lifetime view),
profile-menu.png (redesigned popover), and two new captures for
the Community-tier surfaces (license-activate-section.png,
license-community.png). Removes the stale license-active.png
(legacy "Sencho Pro" card) and profile-billing.png (legacy
dropdown).
* docs(settings-reference): refresh page for v1 UI with new sections and masthead
Rewrites docs/reference/settings.mdx against the current Settings Hub so a reader
encounters an accurate map of every section. Adds the previously missing **Cloud
Backup** and **Security** sections, restructures **System Limits** into Host
thresholds and Docker hygiene subsections (GiB units, "Global crash capture"
toggle), fixes the Account password minimum to 8 chars and documents the
two-factor subsection, refreshes License/Routing/Webhooks/App Store with the
field labels actually rendered today, and documents the masthead pills
(SCOPE/NODE, EDITED, plus the per-section stats like 2FA, PLAN, CHANNELS, ROUTES,
WEBHOOKS, LABELS, TRIVY, POLICIES, PROVIDER, USED, SNAPSHOTS, DEV MODE).
Replaces five existing screenshots that predated the v1 redesign and adds five
new captures: Account with the 2FA card, License panel, System Limits with both
subsections, Security with the Trivy installer, and Cloud Backup with Sencho
Cloud Backup provisioned. All shots taken against the production node.
* docs(licensing): drop billing-provider name from operator-facing copy
The previous draft named the third-party billing provider in nine
places (checkout, receipt email, error toast verbatim, Customer /
Product field descriptions, the action-row hint, the billing portal,
and the validation API). Operator docs don't need to advertise which
vendor sits behind the checkout, billing portal, and validation
calls. Rewrite each instance to describe what the operator sees and
does without naming the upstream service.
* docs(node-compatibility): refresh page for v1 UI with lock card visuals and current capability list
- Replaces the legacy "dim + blur + pill overlay" description with the
current CapabilityGate behavior: a centered lock card with an Unplug
icon, title "<feature> is not available on this node", and a body line
that names the node and its running version.
- Corrects the tier-interaction section: on the wrong tier the entry
point is hidden entirely, so the lock card only appears for users who
already cleared the license gate.
- Documents the public /api/meta endpoint, the 5-minute success cache,
the 30-second failure cache, and the lazy-fetch behavior visible in
the switcher (the version pill appears once a node has been visited).
- Refreshes the capability table against the current CapabilityRegistry
list, adding container-exec and vulnerability-scanning, with a note
that vulnerability-scanning is only advertised when Trivy is installed.
- Adds three production screenshots captured on the live fleet:
switcher popover with mixed-version pills (one node on v0.76.9, rest
on v0.81.11), a real lock card on an older pilot agent, and the
Connection Details panel from Settings · Nodes.
* docs(security): refresh security architecture page for v1 UI
Add Fleet Secrets and Webhook signatures cards plus tier-matrix rows for
shipped-but-undocumented features. Rename SSO presets from "one-click" to
"preset providers" (presets still require OAuth-app provisioning on the
upstream IdP). Update settings paths to the v1 middle-dot convention:
Settings · Users, Settings · Account, Settings · Developer · Data retention.
Extend the encryption-at-rest list with registry credentials and Fleet
Secrets bundle payloads (both sealed with the same AES-256-GCM data key)
and clarify the password section with bcrypt cost factor 10.
Add a Webhook signature authentication subsection covering the per-webhook
HMAC-SHA256 secret, one-shot display, masked preview thereafter, and
constant-time comparison on inbound triggers.
Replace the API Tokens screenshot with a fresh capture against the v1
Settings · Identity · API Tokens panel.
* docs(security-advisories): retire reference page
The reference/security-advisories page does not survive the v1 docs
refresh:
- Misuses the term "Security Advisories", which industry-wide refers to
published notices for confirmed product CVEs (ID, severity, affected
versions, fix version, remediation). The retired page was a narrative
changelog of internal hardening work between v0.19 and v0.25.2.
- The narrative is also frozen at v0.25.2 (April 2026) while current
release is v0.81.11. Refreshing it would require backfilling ~56
release entries' worth of hardening copy.
- The framing is uniformly "improved from prior behavior" (minimum 8
characters up from 6, 1-year token expiry previously without expiry,
CORS previously allowed all origins, users should upgrade promptly).
Sencho has not shipped publicly; there are no users to address as
upgraders.
All operationally relevant content already lives elsewhere: the
security architecture page covers the current posture, verifying-images
covers the supply-chain attestations, cve-suppressions covers operator
acknowledgment, vulnerability-scanning covers the in-app scanner, and
contact + the security architecture page both surface the disclosure
path. Published Sencho-product advisories, when any exist, will appear
on the GitHub Security tab, which is already linked from those pages.
Inbound-link audit returned a single hit on the nav entry itself; no
other doc, README, or operator artifact deep-links the slug.
* docs: rewrite Pilot Agent page with deep architecture and operations reference
Reframes docs/features/pilot-agent.mdx as the architecture-and-operations
companion to the operator walkthrough in Multi-Node Management. Adds a
mental model section, an explicit security and trust model, a full agent
env-var reference, an honest limitations list, and a 5-item FAQ. Verifies
every constant and label against the current backend source. Refreshes
four production screenshots (admin login, scrubbed) and resolves the
previously-broken /images/pilot-agent/enrollment-dialog.png reference.
Adjacent edits keep the cross-linking coherent:
- multi-node.mdx adds a one-line forward link to the rewritten page
- security.mdx adds a Pilot Agent tunnel credentials subsection
* docs(fleet-federation): deep rewrite with production screenshots
Rewrites the Fleet Federation page against the v1 docs refresh template
following the recent fleet-view, pilot-agent, and multi-node refreshes.
Doubles the page length (92 to 204 lines) while keeping the cut-line v1
MVP scope: operator-driven placement controls (cordon + pin) for
Blueprints, no expansion into mesh/sync/pilot territory.
What changed:
- Adds four production-captured screenshots under docs/images/fleet-federation/:
the Federation tab with a cordoned node populated, the node-card kebab
menu showing the Cordon node entry, the cordon confirmation dialog
with a reason filled in, and a node card displaying the Cordoned pill.
- Expands the page to eleven sections: opening summary, philosophy
(kept), key capabilities, prerequisites, step-by-step usage with
embedded screenshots, behaviour and lifecycle table, security and
audit, limitations and non-goals (expanded), practical workflows (new:
OS patching, host-to-host migration, gateway pinning), troubleshooting
(eight accordions, up from five), and a Where Federation fits
cross-link table.
- Documents the exact production UI strings observed: the cordon
dialog description, the uncordon confirmation copy, the reason field
cap (256 chars), and the audit log action names (node.cordon,
node.uncordon, blueprint.pin).
- Documents the audit visibility surface so operators know how to
filter the Audit view for cordon and pin history.
- Adds eight cross-links to sibling pages (Fleet View, Multi-Node,
Pilot Agent, Mesh, Fleet Actions, Fleet Sync, Blueprints, Licensing)
with one-line scope contrasts so newcomers can place Federation in
the broader fleet picture.
- Tightens lifecycle table to operator-relevant terms (no DB column
names) and audit section to operator-facing wording (no middleware
names), keeping the page operator-focused rather than
implementation-focused.
Validation:
- Captured screenshots against the production node logged in as admin,
using Playwright MCP. Cordoned and pinned actions reverted; audit log
confirmed the matched cordon/uncordon pair.
- Verified every cross-link target exists in the v1-refresh worktree
(/features/fleet-view, /features/multi-node, /features/pilot-agent,
/features/sencho-mesh, /features/fleet-actions, /features/fleet-sync,
/features/blueprint-model, /features/licensing).
- Compliance: no em dashes, no PII, no "previously"/"used to" framing,
no fence-spec language, tier rule stated once in plain language.
* docs(fleet-federation): drop fence-spec phrasing in the open-core context
Sencho is open-core: anyone can clone the repo and read the tier gate.
Operator docs that name exactly where the UI gate sits ("hidden at the
Community and Skipper tiers", "lower-tier users do not see the toggle",
"only the Federation tab is gated") work as a dig-target for a
tech-savvy reader and undercut the open-core posture. Directive 27
already bans enforcement-chain spelling; the open-core threat model
makes the same phrasings risky even when they describe UI surfaces
rather than route guards.
Removes three instances of the pattern on this page:
- Top Note callout: drops "The tab is hidden at the Community and
Skipper tiers." Keeps the one-line requirement: "Federation is an
Admiral feature. Cordon and pin actions require an admin user role."
- Security and audit section: drops the sentence enumerating which UI
affordances are hidden from which tiers. Keeps the customer-visible
behavior (the Cordoned pill stays visible at every tier as a
read-only signal).
- Troubleshooting "Federation tab is not visible" accordion: rewrites
to lead with the requirement and the role check, drops the
"Federation is hidden by design" and "only the toggle and the
Federation tab are gated" phrasings.
Other claims on the page unchanged; rule is still stated once in plain
language at the top of the page.
* docs(fleet-sync): deep rewrite with production screenshots
Replace fleet-sync.mdx with a verified end-to-end reference. The previous
page named two replicated resources but the code syncs three, described a
sync-status panel and a fleet-vs-node scope picker that do not exist in
the shipped UI, and was missing prerequisites and several edge cases.
Highlights of the rewrite:
- Names all three replicated resources (scan policies, CVE suppressions,
misconfig acknowledgements) and treats them uniformly.
- Drops the sync-status-panel and node-scope-picker UI claims; both move
to the Limitations section as honest caveats.
- Adds prerequisites covering the paid-tier requirement on the control,
admin-role requirement, proxy-mode remotes, and reachability.
- Expands lifecycle coverage: per-node serialised pushes, add-node
backfill, monotonic pushedAt, per-resource watermarks, identity-drift
notifications, the 5000-row truncation cap, stale-target warnings,
audit-log entries on the replica.
- New "Where Fleet Sync fits" closing table cross-linking to Fleet View,
Multi-Node Management, Pilot Agent, Vulnerability Scanning, CVE
Suppressions, Fleet Federation, Fleet Actions, and Licensing.
- Two fresh production screenshots: control Security panel and the
"Scanner is per-node" callout shown when proxying to a remote.
* docs(fleet-actions): deep rewrite with production screenshots
Three cards are documented end to end: Stop fleet by label, Bulk label
assign, and Prune Docker resources fleet-wide. Adds the execution-path
distinction (control-orchestrated fan-out vs single-node proxy), per-card
behaviour and partial-failure semantics, prerequisites, limitations,
practical workflows, an Accordion troubleshooting section, and a Where
Fleet Actions fits comparison table linking the surrounding Fleet view
features.
Corrects the prior page's tab-neighborhood claim, confirm-dialog wording,
autocomplete-vs-request scope, and missing batch ceiling. Replaces the
ten-day-old single screenshot with five fresh production captures under
docs/images/fleet-actions/.
* docs(fleet-secrets): deep rewrite with production screenshots
Full rewrite of /features/fleet-secrets matching the fleet-actions
structure. Replaces the sparse v1 page (no Frames, inline Q&A) with a
gold-standard layout: opening Frame, single Note for the tier gate,
'What it covers' table, mental model, prerequisites, create + edit +
versions + push (Target / Preview / Results) sections each with a
production Frame, Import from stack section, behaviour and lifecycle
table, audit-trail mapping with the six exact audit strings,
limitations and non-goals, practical workflows, AccordionGroup
troubleshooting, and a Where-it-fits cross-link table.
Adds six fresh production screenshots under
docs/images/fleet-secrets/ : overview, create, versions, target,
preview, and results.
Documents the Import-from-stack flow (depends on the bundle editor's
new Import action) and uses the post-rename 'Send' wording on the
bundle-row action (depends on the aria-label fix).
Corrects three factual drifts vs the code: env-key regex described as
'letter or underscore, then letters/digits/underscores; case-
sensitive' to match ^[A-Za-z_][A-Za-z0-9_]*$ ; documents only the
'ok' and 'failed' status pills (the 'skipped' enum value is unused);
replaces the bogus 'stack not found' troubleshooting entry with the
real 'env file not declared' cause.
Drops the fence-spec phrasing 'The tab is hidden on Community.' per
Directive 31; the tier requirement is now stated once in plain
language.
* docs(sencho-mesh): deep rewrite with mental model, lifecycle, security, screenshots
Replace the feature-reference page with a deep product + technical guide.
Adds:
- Opening hook framing audience and problem (cross-node service-to-service
without a separate VPN or service-mesh sidecar).
- Mental model: three moving parts (sencho_mesh bridge, alias registry,
cross-node transport) with direction-of-flow described in prose.
- Key capabilities, prerequisites, step-by-step usage with inline screenshots.
- Full lifecycle section covering opt-in, opt-out, sticky stack-stopped state,
peer reconnect, and the proxy-mode bridge with its real default (persistent,
env-override for idle).
- Security and trust boundaries split into authentication, inbound exposure,
encryption, audit, and app-layer caveats.
- Limitations and non-goals: one-alias-per-port, port 1852 reserved,
central-relay for remote-to-remote, shared 1024-stream pool with the Pilot
tunnel, no L7, host-network unsupported, in-memory activity log.
- Three concrete workflow examples and a complete troubleshooting accordion
(every data-plane reason, every probe stage, every unreachable cause) plus
a Common questions FAQ.
- Where Mesh fits CardGroup linking Pilot Agent, Multi-Node, Federation,
Licensing.
Corrections vs prior text:
- Tab is labelled Traffic in the UI (not Routing); all navigation references
updated.
- Proxy-mode bridge default is no idle close (env-overridable to opt into idle
teardown); prior 5-minute-teardown claim removed.
- Audit trail scope tightened: only opt-in / opt-out write durable rows;
tunnel-state and probe events live in the in-memory activity log.
Adds seven production screenshots under docs/images/sencho-mesh covering
Table view, opt-in sheet, graph (Tunnels and Aliases edge modes), Diagnostics,
activity log, and per-stack topology.
* docs(blueprints): add missing detail-state-review screenshot
Captures the Blueprint detail sheet with a deployment row in the
"Awaiting confirmation" status (stateful first-deploy gate), to fix the
broken image referenced at blueprint-model.mdx:132. mint broken-links
now reports zero broken references.
* docs(blueprints): deep rewrite with mental model, lifecycle, security, prerequisites
Restructures the Blueprints page against the v1-refresh template used by the
recently-refreshed mesh, secrets, and atomic-deployments pages. Adds a mental
model, prerequisites table, lifecycle and status-transition map, security and
trust boundaries section, practical workflows, common questions accordion,
and a Where Blueprints fits CardGroup. Removes the internal-style rollout
and watch-plan section. Replaces all nine production screenshots with fresh
captures against the production node signed in as admin, and adds two new
captures (federation pin policy table, stateless eviction dialog). Rewrites
the tier-gate Note to drop the fence-spec phrasing that violated Directive
31. Every retained claim is anchored to current backend or frontend code.
* docs(pilot-agent): recapture enrollment dialog with compose payload
Replaces the pre-0.84 docker-run capture with the current dialog (Compose
file, two-step instructions, "Copy compose file" button) and refines the
alt text to describe the captured content. URL and token redacted to
placeholder values during capture.
|
||
|
Anso
|
ccad5c925b |
feat(nodes): hide hub-only views when active node is remote (#1007)
* feat(nodes): hide hub-only views when active node is remote Fleet, Schedules, Audit, Logs, and Auto-Update operate on hub-owned state (node registry, fleet schedules, centralized audit, fleet-wide log aggregation, fleet-wide update preview). When the active node is remote, proxying those surfaces would show that remote's own disconnected state instead of the hub's. Hide them from the nav strip and force-redirect to Home if one was open during the node switch. Backend hubOnlyGuard middleware sits between nodeContextMiddleware and the remote proxy and rejects /api/scheduled-tasks, /api/audit-log, and /api/notification-routes with 403 + HUB_ONLY_ENDPOINT when nodeId resolves to a remote, closing the script-bypass path the UI gating cannot reach. Settings sub-sections were already gated via the hiddenOnRemote registry; this extends the same model to top-level views. * docs(nodes): note hub-only visibility on Fleet, Schedules, Audit, Logs, Auto-Update Each of the five hub-only feature pages now points readers to the canonical "What top-level views show when a remote node is active" section in multi-node.mdx, so users landing directly on a feature page understand why the nav item disappears when they switch to a remote node. |
||
|
Anso
|
ed553f1f19 |
feat: change default listen port from 3000 to 1852 (#756)
Updates the backend listen port, Vite dev proxy target, Docker EXPOSE, compose port mapping, .env.example default, GitHub Actions smoke-test default, healthcheck URLs, and every doc/example reference. Test fixtures that include example URLs were updated for consistency, though their assertions are port-agnostic. The rate-limit value of 3000 in middleware/rateLimiters.ts and the 3000 entry in WEB_UI_PORTS (which detects user containers like Grafana) are intentionally untouched. |
||
|
Anso
|
08f57c7141 |
feat(settings): surface security, notifications, and app store on remote nodes (#716)
Flip Security (Trivy), Notifications (agents + history), and App Store from global-and-hidden-on-remote to node-scoped so operators can manage them when a remote node is selected in the node picker. The primary instance proxies the calls to each remote, which resolves the correct per-instance binary state, agent config, and template registry. Backend: key `agents` and `notification_history` by `node_id` with idempotent column-add migrations and a `(node_id, type)` unique index on agents, matching the Labels pattern. Thread `req.nodeId` through the /api/agents and /api/notifications routes. Internal NotificationService and ImageUpdateService writes resolve the middleware default via `NodeRegistry.getDefaultNodeId()` so monitor-emitted rows share a bucket with user-facing ones (avoids split-brain where the UI sees test notifications but not internal alerts). Frontend: split Security on remote to render only the scanner card and hide scan policies and CVE suppressions (those remain control-plane-only). Drop the misleading "Always Local" badge on Developer since retention windows govern backend jobs, not UI state. Flip the App Store registry to node-scoped. Docs: add a "What Settings apply per node" table to multi-node, clarify remote alert setup in alerts-notifications, and note Trivy's per-host install in vulnerability-scanning. |
||
|
Anso
|
c7dfde4b79 |
fix(sidebar): distinct fuchsia notification dot for update indicator (#708)
The pulsing dot signaling an available image update used --info (blue hue 250), the same hue as --label-blue, so the two blended visually when a stack carried a blue label. Introduce a dedicated --update token in vibrant fuchsia (hue 320) sitting outside the label palette, and render both the sidebar StackRow and the fleet NodeManager indicator as a notification-dot pattern (solid stationary core with animate-ping halo). Aligns with the design rule that static state should not pulse. |
||
|
Anso
|
e721742560 |
feat(ui): redesign node switcher as sidebar identity anchor (#694)
Replace the inline Select in the sidebar with a dedicated NodeSwitcher component that always renders as an identity card, regardless of node count. With two or more nodes it opens a Popover listing every node with status dot, type, version, last-seen metadata, and an active-row accent rail, matching the design language of the user menu and notification panel. Extract the relative-time formatters out of NodeManager into a shared @/lib/relativeTime module with formatTimeUntil and formatTimeAgo, and add a 'just now' / '<1m' branch so fresh heartbeats and imminent runs read naturally. |
||
|
Anso
|
a1804c8fbe |
docs: comprehensive review and refresh of all documentation (#374)
* docs: comprehensive review and refresh of all documentation pages Reviewed every doc page against the current app state after the v0.38 dashboard redesign. Updated content, fixed inaccuracies, and refreshed all screenshots at 1920x1080. Pages updated: - introduction: expanded feature list to 25 items across 6 subsections - quickstart: fixed docker run command (Docker Hub, auto JWT, COMPOSE_DIR) - configuration: replaced personal paths with generic /home/user/docker - sso-quickstart: fixed Settings navigation reference - sso: added SSO_LDAP_DISPLAY_NAME env var - overview: added 8 missing feature sections (labels, API tokens, schedules, etc.) - dashboard: complete rewrite for new health bar, gauges, stack health table - stack-management: updated for UP/DN indicators, rollback button, split actions - editor: rewritten for two-column layout, inline stats, embedded terminal - resources: updated Quick Clean docs, added network topology and inspect - app-store: updated categories, deploy sheet details, permission gate, settings - openapi.yaml: fixed YAML parsing error on line 1831 Screenshots refreshed: 14 images across 6 feature areas. * docs: review and update observability, console, multi-node, and compatibility pages - Global Observability: fix log format fields, add download button docs, split display limits into memory buffer vs rendered rows, correct settings labels - Host Console: remove internal implementation details per security docs policy, add stack directory behavior, expand header bar docs, remove unverified scrollback claim - Multi-Node: add Compose Directory field, document connection test details panel, fix edit/delete node behavior, simplify token security section, remove internal details - Node Compatibility: add missing self-update capability, remove internal endpoint paths and cache TTL, move from Features to Reference group in navigation - Refresh all screenshots for the redesigned UI (7 images) * docs: review and refresh fleet, remote updates, labels, alerts, routing, and webhooks pages - Fleet View: added node updates modal, container detail, version/update/critical badges, Tags filter - Remote Updates: removed internal details, added capability cross-link, fast polling - Stack Labels: three creation methods, two assignment methods, 10 colors, bulk actions screenshot - Alerts & Notifications: fixed metric labels, added notification popover detail, status banner - Notification Routing: HTTPS requirement, rule card layout, channel terminology fix - Webhooks: corrected license tier to Admiral, matched action labels to UI, removed internal security details, added local-only note - Troubleshooting: centralized entries from remote-updates, stack-labels, notification-routing - Refreshed all screenshots at 1920x1080, removed 11 orphaned images * docs: review and refresh RBAC, user management, and atomic deployments pages - RBAC: added missing Auditor role (5th role), updated permission matrix, fixed license tier references, documented username/password validation rules, self-deletion protection - Atomic Deployments: added "Which operations are protected" section covering webhooks/schedules/app store, removed internal backup path, fixed license tier to Skipper/Admiral - Screenshots: cropped to dialog element per updated strategic cropping guideline, removed 2 orphaned images * docs: review and refresh fleet-wide backups and audit log pages Update fleet-backups page to reflect current inline create form, add scheduled snapshots section, document the detail view and restore dialog, expand RBAC table to all five roles. Update audit log page to document expanded row detail fields, pagination, refresh button, and data retention screenshot. Replace all screenshots with fresh captures at 1920x720. * docs: review and refresh API tokens and private registries pages - API Tokens: clarify Full Admin scope, add Managing tokens section with card details, document revocation confirmation dialog, add usage tracking to security model, refresh screenshot - Private Registries: add Managing registries section with card details and action buttons, document edit behavior, fix URL auto-fill description, remove encryption algorithm name per security policy, fix grammar, refresh both screenshots * docs: review and refresh auto-update policies, scheduled operations, and SSO pages - Auto-Update Policies: document all 8 table columns, expand action buttons, add "All Stacks" wildcard option, fix field labels, add CSV export and pagination details, refresh screenshots - Scheduled Operations: fix System Prune target description, add Task List table columns, restructure create dialog fields with action-specific annotations, rewrite execution history with column table, refresh screenshots - SSO: remove encryption algorithm name per security policy, add LDAP and OIDC configuration field tables, document provider card controls (Save, Test Connection, Remove, Active badge), refresh screenshots - Move SSO troubleshooting entries to centralized troubleshooting page * docs: review and refresh licensing & billing page Update upgrade card feature lists to match actual tier gating (Skipper: fleet view, webhooks, labels, atomic deployments, backups, auto-update policies; Admiral: scoped RBAC, SSO, audit log, host console, API tokens, private registries, scheduled operations). Add flex layout to align upgrade card buttons at the bottom. Replace stale screenshot with fresh community and active license captures. Add feature breakdown subsection and profile menu billing shortcut to docs. * docs: review and refresh settings reference and security advisories pages Settings Reference: add 5 missing sections (SSO, API Tokens, Registries, Labels, Routing), expand Users from 2 to 5 roles, fix System Limits and Developer field labels to match UI, restructure Developer into Streaming and Data Retention sub-tables, update App Store and Support sections, refresh overview screenshot. Security Advisories: restructure into versioned sections (v0.25.x hardening and v0.19-v0.24 CVE remediation), expand from 3 bullet points to 10 specific improvements, fix GitHub URL from SaelixCode to AnsoCode, redact internal details per security docs policy. Remove "Sencho Pro" product name from all three pages, replaced with tier names (Community, Skipper, Admiral). * docs: review and refresh troubleshooting page, remove architecture and development guides - Rewrote forgotten password section to remove exposed SQL and table names - Updated all Settings navigation paths to Profile > Settings > X - Fixed network topology from "tab" to "view mode", added Pro license note - Updated Prune Networks to current "Prune Dead Networks" label - Corrected update check cooldown from vague to 2 minutes - Consolidated two network creation error sections into one - Removed hardcoded version reference (v0.34.0) - Replaced em dashes throughout - Deleted architecture.mdx (exposes internal implementation details) - Deleted development.mdx (contributor guide belongs in repo, not public docs) - Removed both pages from docs.json navigation * docs: review and refresh operations pages (backup, upgrade, self-hosting, troubleshooting) Backup & Restore: - Added missing encryption.key to all backup/restore procedures - Added Warning about restoring db without matching encryption key - Added cross-reference to Fleet-Wide Backups for paid tiers - Removed false claim about no built-in backup scheduler - Updated cron example to include encryption key copy Upgrading Sencho: - Removed internal migration details (table names, column specs, encryption algorithm) - Replaced with high-level migration summary per security docs policy - Added encryption.key to pre-upgrade backup command - Updated version pinning example from 0.25.3 to 0.38.0 - Added Remote Updates cross-reference for Skipper/Admiral users Self-Hosting Best Practices: - Removed JWT_SECRET from env var table (auto-generated, not an env var) - Removed PORT from env var table (hardcoded to 3000, not configurable) - Added API_RATE_LIMIT to env var table (actually exists in code) - Fixed listen port description from "configurable" to "fixed" - Updated resource recommendations based on measured footprint audit - Removed su-exec reference (internal implementation detail) - Upgraded data directory Note to Warning with file names Troubleshooting: - Fixed "Pro features" heading to "Paid features" with correct tier names |
||
|
Anso
|
6c26ae3f50 |
feat(license): distributed license enforcement across multi-node setups (#359)
* feat(license): distributed license enforcement across multi-node setups The primary instance's license tier is now asserted to remote nodes on every proxied HTTP and WebSocket request via trusted headers. Remote nodes honor the assertion only when the request carries a valid node_proxy JWT, preventing unauthorized elevation from browsers or API tokens. Falls back to local license tier for direct access. * fix(test): remove unused vi import in distributed-license tests |
||
|
Anso
|
efbd20fed5 |
feat(nodes): add per-node scheduling and update visibility (#344)
* feat(labels): add stack_labels schema and DatabaseService CRUD methods
* feat(labels): add label CRUD, assignment, and bulk action API routes
* feat(labels): add oklch label color palette for light and dark themes
* feat(labels): add LabelPill and LabelDot reusable components
* feat(labels): add LabelAssignPopover component for inline label management
* feat(labels): add label pill bar, label dots, and label assignment to sidebar
* feat(labels): add label filtering and label dots to fleet view
* feat(labels): add label-scoped bulk actions (deploy/stop/restart all)
* docs: add Stack Labels feature documentation
* fix(labels): use context menu sub-menu for label assignment and add settings integration
Replace broken Popover-inside-ContextMenu pattern with native Radix
ContextMenuSub for reliable label toggling on right-click. Wrap
ContextMenuSubContent in a Portal to prevent overflow clipping. Add
"Manage labels..." item that opens Settings directly to Labels section.
Fix close button overlap in LabelsSection header. Add LabelsSection
settings component with full CRUD, assignment counts, and ProGate.
Add initialSection prop to SettingsModal for deep-linking. Include
screenshots for documentation.
* docs: update stack labels documentation with screenshots and corrected instructions
* fix(labels): address security and quality issues from code review
- Add NaN validation on parseInt(req.params.id) in label routes
- Scope updateLabel/deleteLabel by nodeId to prevent cross-node IDOR
- Validate labelIds belong to correct node in setStackLabels
- Add requireAdmin check on bulk action endpoint
- Replace error: any with error: unknown and proper narrowing
- Remove unused Label import from index.ts
- Remove unused isPro prop from LabelsSection
- Add strokeWidth={1.5} to Check icons per design system
* chore: update CHANGELOG with stack labels feature
* feat(nodes): add per-node scheduling and update visibility
Add Schedules and Updates columns to the Nodes table showing active
task counts, next run times, and auto-update status per node. A calendar
action button navigates to filtered schedule/auto-update views.
Backend changes:
- Add node_id to stack_update_status table (migration + unique index)
- Cascade cleanup on node deletion (scheduled_tasks + update status)
- Pre-check target node existence/status before executing scheduled tasks
- New GET /api/nodes/scheduling-summary endpoint
- New GET /api/image-updates/fleet endpoint with 2-minute cache
- Parallelize remote node fetches with Promise.allSettled
- Wrap deleteNode cascade in a transaction
Frontend changes:
- NodeManager: Schedules/Updates columns with summary data fetch
- EditorLayout: sencho-navigate event listener for cross-component nav
- ScheduledOperationsView/AutoUpdatePoliciesView: filterNodeId prop,
filter bar UI, pre-selected node in create dialog
|
||
|
Anso
|
c4e2595ded |
docs: harden public docs by removing security-sensitive details (#331)
* docs: remove security-sensitive implementation details from public documentation Generalize or remove internal architecture details that could aid targeted attacks — CVE tables, database schema, rate limit thresholds, proxy internals, encryption algorithm names, and WebSocket middleware bypass info. * test(metrics): fix flaky minute-bucket aggregation test Floor baseTime to the start of the current minute so baseTime + 5000 never crosses a minute boundary and produces 2 buckets instead of 1. |
||
|
Anso
|
2d6b4c233d |
fix(security): pre-launch security hardening audit & remediation (#320)
- Webhook HMAC: capture raw request bytes via express.json verify callback instead of re-serializing with JSON.stringify - AES-256-GCM: use NIST-recommended 12-byte IV (backward compatible with existing 16-byte IVs) - Node proxy tokens: add 1-year default expiry (previously no expiry) - Host console env filtering: pattern-based approach blocking SECRET, PASSWORD, TOKEN, KEY, CREDENTIAL keywords (previously only 4 explicit keys) - CORS: deny cross-origin requests when FRONTEND_URL is unset in production (previously fell back to allowing all origins) |
||
|
Anso
|
e587256086 |
feat(multi-node): warn when configuring remote node with plain HTTP URL (#292)
Show an inline warning banner in the Add Node form when the user enters an http:// URL, recommending HTTPS or VPN for public internet connections. HTTP remains fully supported for private networks (LAN, VPN, VPC). Also returns an optional `warning` field in POST/PUT /api/nodes responses for API-only consumers, and expands the multi-node security documentation with concrete deployment guidance (reverse proxy, VPN, private network). |
||
|
Anso
|
ffabfd1c39 |
docs: audit and refresh documentation with updated screenshots (#197)
Update 11 doc pages with accurate content and capture 14 fresh screenshots. Remove JWT_SECRET from configuration (auto-generated), fix editor container actions, add missing Settings sections, update Features Overview, and add remote alerts documentation. |
||
|
Anso
|
32a7d53b2b |
feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185)
* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro) Introduces three Pro-tier features: - RBAC: Multi-user system with admin/viewer roles, user management UI, automatic migration from single-admin credentials, viewer restrictions across the entire UI (read-only editor, hidden action buttons) - Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic rollback on health probe failure, manual rollback button, health probes added to stack updates, webhook-triggered deploys use atomic rollback - Fleet-Wide Backups: Point-in-time snapshots of compose files across all nodes (local + remote), stored centrally in SQLite, per-stack restore with optional redeploy, graceful handling of offline nodes * fix(settings): use correct ProGate prop name in UsersSection * fix(settings): remove unused isPro prop from UsersSection * fix(auth): fetch user info after login and setup so isAdmin is set correctly * feat(pricing): revise pricing strategy and enforce variant-based seat limits Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1). Add $15/mo billing option for Team Pro. Mark lifetime pricing as a 90-day early-adopter offer. Store Lemon Squeezy variant_name on activation/validation and enforce seat limits server-side per variant. * feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration Server-side checkout URL generation (POST /api/checkout) with admin email pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint (POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment lifecycle events for automatic license activation. Customer billing portal link stored from webhook events and exposed via GET /api/billing/portal. In-app checkout buttons in Settings with manual license key fallback. * fix(licensing): exempt Lemon Squeezy webhook from auth middleware The catch-all auth middleware on /api/* was blocking the public webhook endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside /auth/* and /webhooks/:id/trigger. * feat(pricing): update pricing to final live rates Personal Pro: $7.99/month, $69.99/year, $249 lifetime. Team Pro: $49.99/month, $499.99/year, $1,499 lifetime. Added personal_monthly checkout variant across backend, frontend, and website. * refactor(licensing): remove server-side checkout/webhook for self-hosted model Sencho is self-hosted — each user runs their own instance, so there is no central server to receive webhooks or hold the store API key. Replaced in-app checkout buttons with a "View Pricing" redirect to sencho.io and kept manual license key activation as the primary flow. - Delete LemonSqueezyService (checkout, webhook, HMAC verification) - Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy - Remove raw body parser and auth exemption for webhook route - Remove all LEMONSQUEEZY_* env vars from .env.example - Replace checkout buttons in SettingsModal with single "View Pricing" button - Simplify LicenseContext checkout to open sencho.io pricing page - Update licensing docs to reflect website-based purchase flow * chore: normalize em-dashes to hyphens across codebase (linter) * chore: remove accidentally tracked directories from index |
||
|
SaelixCode
|
98910c4117 |
docs: bootstrap user-facing documentation from codebase audit
- Add 5 new Tier 1 doc pages: configuration, stack-management, editor, multi-node, and alerts-notifications - Update introduction, quickstart, and features/overview to reflect current feature set and link to new pages - Restructure mint.json with Getting Started / Features / Reference / Operations navigation groups - Add Playwright-captured screenshots for all major UI screens |