1910 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Anso	38ee4527b1	feat(git): add GitOps revision store and Direct apply transitions (#1835) ... * feat(git): add GitOps revision store and Direct apply transitions Adds the canonical GitOps revision state model: schema, store, history, approval resolution, Direct apply transitions, and a first-cut read projection. Also widens recovery capture with generation, artifact, and source-acceptance bindings, rejects credentials and query strings in new Git repository URLs, and keeps Blueprint and node-label routes on the hub. * feat(git): add create-from-Git activation and teardown transitions Adds the durable half of create-from-Git: the single transaction that persists the application, resolved commit, generation, checkpoint, and candidate together, and the teardown that tombstones a create which never reached its success boundary. Adds the staging marker and operation-owned cleanup rules that decide what a crashed create is allowed to delete. * feat(git): make create-from-Git crash-safe Wires the create path through the GitOps state model: the staging marker is written before the candidate is built, the activation transaction persists the application, generation, and checkpoint together, and the source row plus accepted pointers now commit as one success boundary. A create that fails before that boundary removes only what it staged, then tombstones itself. The managed-area sweep no longer deletes a directory it cannot prove it owns, counts in-flight creates as claimed, and is awaited at startup so an interrupted create is settled before any mutation service runs. * feat(git): settle interrupted create-from-Git at startup Adds boot-time recovery for creates a previous process left in flight. A create whose project was already committed to disk is finished, including its source row and accepted pointers. Anything earlier has its files removed first and is then tombstoned, so the stack name becomes usable again instead of staying locked by a half-created application. A source row that outlived its application is always preserved. * fix(git): close create-from-Git ownership and reporting gaps Removes two ways a failed create could destroy files it did not own: boot recovery no longer deletes a stack directory the create never recorded making, and the managed-root teardown is gated on having created that root. Cleanup now rejects a path that is not a generation directory, so a malformed row cannot widen the blast radius. A create that fails during materialization now clears its staging marker, which previously stayed behind and made the stack name uncreatable until restart. Generation paths no longer resolve through a module cycle that left them pointing at a directory that never existed. Boot recovery restores the deploy spec and manifest cache a finished create needs, settles each application independently so one bad row cannot strand the others, and distinguishes a missing directory from one it could not read. A create that succeeds now clears its checkpoint, and a failure after the success boundary says the stack was created rather than reporting a bare error. * fix(git): reap managed areas that nothing has ever claimed The boot sweep now distinguishes a missing staging marker from an unreadable one. A missing marker means no stack, no create, and no marker claims the directory, which is the ordinary orphan a crashed stack deletion leaves behind, so it is removed as it always was. An unreadable marker is evidence of a claim that cannot be verified, so the area is preserved. Without this an orphaned managed area survived every boot forever, since a completed create deletes its marker and nothing else would ever claim it. * feat(git): complete the Direct source and target transitions Adds the remaining Direct events the state model owed: an invalid fetch that advances the resolved commit without minting a candidate, a blocked candidate that is visible but cannot apply, dismissal that leaves the running workload alone, material configuration change that invalidates a staged candidate while keeping accepted and applied pointers, the two deploy failure classes, and application and target tombstones. Widens the application update to every mutable column. It previously wrote about half of them, so a transition assigning a pause, suspend, recovery, or intent field would have type-checked, appeared in the history snapshot, and been silently dropped at commit. * feat(git): record Direct Git operations in the revision state Wires fetch, apply, and detach through the state model. A pull records the fetch and, when it produces a candidate, the generation behind it, marking a blocked change plan as a blocker that cannot apply. An apply records the acceptance that binds the generation to the workload, and closes its operation on failure so a throw cannot leave the source reporting work in progress. Detach tombstones the application and its target in the same transaction that removes the source row. Every producer is a no-op for a stack with no live application, so installs whose Git stacks predate this model are untouched until migration runs. * test(git): cover the Direct Git producers end to end Adds a harness that stubs only the git transport and rollback capture, so fetch, candidate materialization, change-plan classification, apply, and detach all run for real and are asserted against the resulting revision state. Covers the seam the transition-level tests could not: that a fetch advances the resolved commit without moving the accepted generation, that the apply binds the exact candidate the fetch recorded and its acceptance proves that generation and no other, that detach tombstones while keeping configured identity as a frozen fact, that a failed fetch closes its operation and leaves every pointer alone, and that a stack with no application produces no writes. * feat(git): bind the deployed generation from the Compose adapter Makes ComposeService the sole producer of deploy events. Every deploy path funnels through deployStack, so recording it there keeps one start and one terminal row per mutation instead of each caller reporting its own. A successful deploy binds the applied generation, a failure records the class and leaves the deployed pointer alone. The class is conservative: once the compose command is handed off we cannot prove the workload was untouched, and claiming it was intact is the more dangerous error. A stack with no live application, or one with nothing applied, has no deploy identity to record and is skipped entirely. * feat(git): promote healthy and last-known-good from health verdicts A stack health run now records which generation it observed, and its verdict drives the revision state. Promotion is narrow by design: healthy and last-known-good move only when the run passed, watched the whole stack, and the generation it watched is still deployed. A stale or service-scoped verdict records history and moves nothing. Last-known-good keeps the artifact expectation only when that expectation belongs to the promoted generation. Otherwise the generation is still good and its executable identity simply is not proven, so the pointer is left null rather than borrowed from another generation. beginStack now takes the deployed generation explicitly rather than reading current state, because a verdict is only meaningful for the generation the run actually observed. Update-path callers pass null until updateStack reports what it deployed. * feat(git): bind the deployed generation on the update path Gives updateStack the same treatment deployStack has: it opens a deploy operation at the point Compose is handed the mutation, closes it on both outcomes, and reports the generation it bound. The orchestrator carries that binding through, and all five update call sites now pass it to the health gate instead of null, so a passed health run after an update promotes healthy and last-known-good exactly as it does after a deploy. The operation is opened at the compose call rather than at entry, so an update that fails during capture or classification records nothing: it never touched the workload, and reporting a deploy failure for it would make the projection claim something that did not happen. * feat(git): track linked stacks and material config changes Linking an existing stack to a Git source now brings it into the revision state: the application starts live with nothing desired or accepted, so the projection asks for a fetch rather than claiming a state it has not observed. Editing a source's material configuration invalidates its staged candidate in the same transaction that writes the row and clears the pending pull. A candidate built from a different repository, ref, or file set can no longer be applied, and clearing pending without invalidating it would leave the model offering an apply the operator cannot produce. Credential-only and policy-only edits change nothing material and leave the candidate alone. * feat(git): retire the application when a stack is deleted Stack deletion now tombstones its GitOps application and targets in the same transaction that commits the deletion. A deleted stack that kept a live application would go on claiming the stack name and block re-creating it through the unique live-application index. The tombstone is driven from the deletion service rather than from inside DatabaseService, so the store keeps its transitions and their history in one place and the two modules do not form an import cycle. * feat(git): retire node targets when a node is removed Deleting a node now tombstones the GitOps targets that lived on it, in the same transaction as the delete and while those rows still exist. Otherwise a part-way failure would leave targets pointing at a node that is gone. Applications stay live: a Direct application still describes a real stack, and a Blueprint one may have targets on other nodes. Both the local and remote node paths go through the same helper, so neither can skip the retirement. * feat(git): add proof-bound recovery transitions A restore moves a target back to an older generation, the one case where a target and its application legitimately disagree about what is current. These transitions decide what may move with it. Pointers move only when the restore is provable: the recovery point named a generation, that generation still exists, and it belongs to this application. The artifact expectation comes from what the recovery point captured, never from what the application expects now, and the acceptance is kept only if it still proves the restored generation rather than borrowing one that authorized a newer one. A last-known-good survives unless the generation behind it is gone or turns out to belong elsewhere, and then the reason is recorded so the projection can say unavailable rather than none. An unproven restore is still recorded as a real operational recovery and moves nothing, because there is no evidence to move pointers to. * fix(git): close GitOps operations that cannot be recorded Recording a transition still never fails the operation it describes, but a rejected terminal event no longer leaves that operation open. A start that never terminates reported work in flight for ever and offered no actions, and because a new fetch refuses to open a second operation, one rejection silently stopped the model tracking that stack until a restart. Startup now reclassifies operations the previous process left open, which the transition already supported but nothing called. An interrupted restore is closed there too, since only the terminal recovery events clear it. The pull records its fetch, generation, and candidate as one transaction, and the apply verifies the candidate was built from the commit being applied. Separately those two allowed an apply to accept a generation whose files were never on disk while the projection reported the older commit as current. Also: the candidate now records its own invocation rather than the one it replaces, changing material configuration is refused while an operation is in flight, a tombstoned target cannot be repopulated by a late health verdict, a deploy handle is not returned when its start was not recorded, the mutation handoff is marked only once Compose is genuinely about to receive it, and a rejected tombstone fails one deletion rather than aborting the boot sweep. * feat(git): record why unprovable evidence was dropped The projection carried a limitations array that only read-time derivation ever wrote to. When a transition cleared a pointer it could not prove, the result was indistinguishable from that pointer never having existed, and in two cases it made the target read healthier: a dropped artifact expectation silently disables the runtime drift check, and an unproven restore left every pointer agreeing with itself so the target reported as synced and healthy. Adds a persisted, fail-closed evidence record on the application and target rows. The transitions that drop an artifact expectation, a last-known-good artifact, or a source acceptance now say why, an unproven restore is marked as such, and the deriver folds all of it into the limitations the projection already exposes. Clearing a code when the evidence becomes provable again is part of the contract, so a stale doubt cannot outlive its cause. This lands before the migration matrix because migration is the largest producer of evidence that cannot be proven, and the plan requires those to surface as bounded limitation evidence rather than as fabricated pointers. * feat(git): migrate pre-existing Git stacks into the revision state Git stacks created before this model had no application at all, so every producer was a no-op for them and the projection could not describe them. They are now brought in at boot. The governing rule is that a canonical pointer is written only when the evidence proves that exact generation under the repository and ref configured now. A legacy applied commit is not that proof on its own: the manifest may be gone, unreadable, or stamped for a repository the stack no longer points at. In each of those the commit is kept as recorded limitation evidence and the pointers stay null, so the stack asks for a fetch instead of asserting a state nobody verified. Deployed, healthy, and last-known-good are never invented, because a manifest proves what was materialized, not what is running, and no source acceptance is written because nobody approved through the model. Replay is decided by scope, schema version, and configuration fingerprint. A changed fingerprint re-runs the matrix, but a stack that already has an application is skipped rather than rebuilt, so migration cannot overwrite pointers written with proof it does not have. A stack whose directory has vanished migrates to a tombstone rather than claiming a name it cannot back. * feat(git): record rollbacks in the revision state A restore now opens a recovery in the model before any file moves, so a crash mid-restore leaves a target that says what it was doing rather than one that merely looks broken, and closes it on both outcomes. The failure is classified by whether the files had already been restored, because only a failure before that leaves the previous workload provably intact. Pointers move only when the restore is provable: the recovery point named a generation, that generation still exists, and the manifest actually restored carries the same commit and manifest version. Anything less is still recorded as a real recovery, it simply has nothing to bind, and the transition marks it unproven rather than guessing. The deployed pointer is never claimed here. This path drives Compose through a callback that reports nothing back, so binding cannot be proven and applied moves without it. * feat(git): add the deferred rollout-state transitions Retry scheduling, suspension, pause, and partial rollout complete the transition store. They have no production writer by design, but implementing them now means the deriver has no branch a writer cannot reach, and the shape a future producer has to satisfy is pinned rather than inferred from the read side. None of them is a statement about health. A scheduled retry leaves the failure that caused it visible, so a stack that keeps failing does not read as merely busy. A suspended source keeps everything it had accepted, and an operation in flight is interrupted rather than abandoned so it cannot report as running for ever. A paused or partially rolled out target keeps whatever was deployed, and the partial record never stands in for a deployed pointer. * test(git): stop the Compose producer tests reading Docker from the host Both deploy cases asserted that the compose command would reject, which was only true on a workstation with no Docker daemon. On Linux the command succeeded, the promise resolved, and the assertions failed. The compose subprocess now reports an exit code each test chooses, so the adapter is what decides the outcome rather than the machine. Only the verbs that need a daemon and travel through spawn are answered; `config` still runs for real, because a host with the CLI and no daemon parses compose files exactly as CI does, and failing that call breaks every create in the file. That also makes the bound path reachable, so the deploy test now covers it: a failed compose leaves the deployed pointer alone and classifies post-mutation, and a successful one binds the applied generation, returns it for health to bind against, and clears the earlier failure. * fix(git): contain every managed-area path at the call that uses it A stack name reaches the managed root without passing through `isValidStackName` on this path, so the marker, the cleanup, and the create's root probe all built filesystem paths from unvalidated input. Each call now resolves its target against the managed area and checks containment in its own scope, which is also the form the security scan credits: it does not follow the barrier through the shared `isPathWithinBase` helper, so the check has to sit with the call it protects. `cleanupUnclaimedManagedRoot` removes a whole root recursively and gets the same check, even though it was not among the reported calls. Clearing a staging marker can now fail, so the two boot-recovery branches that dropped the checkpoint first were reordered. Losing the checkpoint while the marker survives would report the area as settled and leave the stack name uncreatable. The deploy adapter's two failure logs built their format string from the stack name; both now use a constant format with the name as an argument. The marker and cleanup fixtures stood a bare temp directory in for a managed root, so nothing exercised the invariant these checks enforce. Both now build a real managed area over a scoped data directory. * fix(git): refuse to claim a managed area whose marker cannot be read A marker that exists but will not parse is still someone's claim, yet the write path refused only a readable foreign marker and wrote straight over a corrupt one, discarding the reason and logging nothing. A transient permission error, a marker truncated by a crash between write and rename, or a full disk all read as corrupt, and each one let a second create take ownership of an area the first still owned. Every other path in the module preserves on corrupt; this one now does too, and says why. Clearing a settled create's staging marker can fail, and reporting that as a retained create sent a reader looking for an unfinished create that had finished. It reports `marker_retained` instead. The checkpoint is still kept for the retry, so its encrypted token can outlive the create while the clear keeps failing; that tradeoff is stated at the call, because the alternative leaves a marker no later create can get past. The reaper also computed why it was preserving an area and threw the reason away, so a directory could survive every boot with nothing said about it. The containment checks these paths rest on had no tests and were silently deletable, so the out-of-area read, write, delete, and reap now have them. * feat(git): bind and observe a recovered generation A proven restore could never claim the deployed pointer, because the restore path drives Compose through a callback that reported nothing back: a caller that restored some other way resolved identically, so binding on a resolved promise would have claimed a workload nobody launched. The Compose wrapper now returns what it did, and only that answer binds. With binding reachable, a bound recovery claims its health run inside the same transaction as the pointers it describes, and arms the timer once that transaction lands. Committing the two together is the point: a crash between them would otherwise leave a restored workload nothing was watching. Anything that stops the timer starting writes the run off immediately, so an observing row never outlives the timer meant to watch it, and a reservation is never armed across a restart. The reservation is handed to the transition rather than reached for, because the health gate reports its verdicts back through the transition store and importing it there would close a module cycle. Startup now finalizes each interrupted observation on its own instead of sweeping them with one update, so the revision state hears a verdict for every run rather than watching the rows change under it. * feat(git): add the rollout-scoped rollback transitions Completes the deferred-state set. The three aliases write the same recovery columns under the same rules as the recovery events, differing only in provenance: Direct Git recovery emits `recovery_*`, and a later rollout producer emits these. Nothing in this PR writes them, which is why they are tested directly rather than through a caller. `partial` is the one failure class they add, for a rollback that reached some targets and not others. Completing has no unproven variant on purpose: a rollback nobody can bind to a generation has nothing to complete against, so it refuses without one and refuses a generation another application owns. Also covers the recovery health reservation end to end: reserving writes and links the row without arming anything, a replay reuses the run rather than opening a second observation of the same restore, arming inserts nothing and supersedes a conflicting stack gate, an unarmed reservation is written off once, and a reservation that outlived its process is finalized rather than armed. The per-row startup sweep is pinned too, since one row whose write fails leaving the others finalized is the entire reason it replaced a bulk update. * feat(git): add the Blueprint source and deployment transitions The first slice of the Blueprint work: the store side, with no production caller yet. The routes and the reconciler are wired to these next, and pinning the contract first means a caller cannot quietly satisfy a different one. What these enforce is that a terminal event names the request it answers. A deploy records the intent and candidate it was launched for, and a terminal is accepted only against that same request, matching stage and identity on one side rather than either in isolation. Without that pairing a deploy could be acknowledged out of an in-flight withdraw, or one request's intent stored against another's candidate. An acknowledgement carries the candidate from the matched request rather than from its own payload, for the same reason. Releasing an operation now releases its identity with it, and a resolved interruption is retired rather than left to match again. Both were leaking through the shared helpers: a stale identity let a later start resurrect a superseded intent as live, and a surviving interruption both reported completion as unknown for ever and let a late acknowledgement regress the target after two later deploys had succeeded. Fixing the helpers fixes the Direct paths too. A start refuses to displace an unrelated operation, which would otherwise abandon it with no terminal event and no history saying so. Observations write the latest stage, since the placement facet reads it to decide whether a stateful deployment is waiting on confirmation, and history alone could never reach a reader. Minting is left to the caller. A no-op Blueprint edit must mint no intent, because a fresh identity would invalidate acknowledgements that are still accurate. * feat(git): record Blueprint create, edit, pin, and delete Wires the Blueprint routes to the revision state. Each producer writes the Blueprint source row and its GitOps rows in one transaction, so an operator never sees a Blueprint that exists with nothing describing what it means, or an intent for a Blueprint that failed to save. The question these answer is when an edit invalidates what the fleet already acknowledged. Changing the name, the compose content, the selector, the drift mode, or whether it is enabled changes what nodes run or where, so each mints a new intent and candidate. Changing the description or the classification changes how the Blueprint reads and nothing a node can observe, so it updates the source row alone: minting there would make every acknowledgement report as stale over a reworded sentence. An edit is measured by value, not by which fields were submitted. The editor sends every field on every save, and the source layer decides what to invalidate from which keys are present, so only the keys that genuinely differ are passed down. Without that the two disagreed: rewording a description advanced the revision past the one the current intent describes and cleared the approval, while this layer classified it as metadata and minted nothing. Selectors compare by value too, so reordering a list that names the same nodes is not a placement change. That measurement also changes one behaviour: a save that alters nothing now leaves the approval alone, where before any save cleared it. Nothing changed, so nothing is invalidated. Pinning revises placement the same way a selector edit does, and re-pinning the node already pinned is not a change. Deleting tombstones the application and its live targets so the Blueprint stops claiming its slot, and withdraws nothing itself, because the route has already done that and doing it twice would record removals that never happened. The required node set is stored in a canonical order, so reordering it is not mistaken for a placement change. A Blueprint that predates the model has no application yet and is left for migration rather than given a first intent here, which would claim a starting point for deployments nobody has reconciled. Desired nodes are passed in rather than computed here: the reconciler that knows how to compute them reaches this layer, and importing it back would close a module cycle. * feat(git): record the placement a label or cordon moves A label and a cordon say nothing about any one Blueprint, but both change which nodes a selector matches. Each now revises placement for whichever Blueprints the change actually moved, by comparing the desired nodes either side of the write rather than reacting to the event. That comparison is the whole point. Labelling a node no selector mentions, or cordoning one no Blueprint wanted, moves nothing, and minting an intent for it would invalidate every acknowledgement in the fleet over an edit no node can observe. The same comparison covers a Blueprint pinned to a cordoned node: a cordon governs automatic placement only, so the pinned target still wants that node and its set does not move, without needing a case of its own. Nodes are compared as a set, so the same nodes returned in a different order is not a change either. Each route wraps its existing write and the recording in one transaction, so a recording failure cannot leave a fleet selecting on a label nothing recorded. The write itself is untouched, which keeps label validation and the per-node limit where they already live rather than restating them in a producer. Node deletion already retires its targets, so this adds nothing there. * feat(git): record Blueprint deployments by what caused them Every production write to a Blueprint deployment row now goes through one funnel that records the cause. The cause is carried rather than inferred from the resulting status, because several causes land on the same one: a deploy that failed and a withdraw that failed both read `failed`, and they mean opposite things about whether the deployment is still on the node. Recording is skipped when the status did not move, so a reconciler tick that re-asserts a state it already reported does not append a second event describing the same fact. The write still happens either way. A terminal answers the request the target says it was given, not whatever the Blueprint currently wants: an acknowledgement matched against the current intent would accept work for a revision that node was never sent. The first deploy to a node creates its target, since a Blueprint application has no targets until something is sent somewhere. Recording never fails the deployment. The rollout already happened, and turning a bookkeeping problem into a stuck rollout would be the worse outcome. The four reconciler observations record what was seen and nothing else. Preview cleanup stays outside this path deliberately: it reverses a projection nobody deployed, so recording it would report removals that never happened. * fix(git): record an Inline Blueprint coming into existence Creating a Blueprint inserted its application row directly, so the history began at the first intent and described an application nothing recorded coming into existence. Every other application-creation path emits the activation event, and the event's own definition covers this case: an Inline Blueprint inserts the application, the first intent, and the first candidate. Activation goes through a transition now, which also enforces the one thing the direct insert could not: a Blueprint gets one live application, refused rather than silently duplicated. No target is created. A Blueprint application has no targets until something is deployed somewhere, unlike a Direct one which always has the node its stack lives on. * fix(git): file withdraw failures as withdraw failures Four of the five withdraw failure paths were recorded as failed deploys. Only the thrown one was tagged correctly, and it is the rare case: a delete-lock conflict, a network error, a remote 409, and a remote non-200 all return rather than throw, and all four were filed under deploy. That inverted the thing this funnel exists to prevent. Recording a deploy failure clears the in-flight operation, so a routine "another operation is already in progress" wiped the withdraw that had just started and left the target reporting a failed deploy while the deployment was still on the node. A withdraw refused because the on-disk stack is not ours is now its own cause too, rather than borrowing the deploy-side name conflict. The status guard no longer suppresses starts. A start writes the identity that terminals are matched against, so skipping one because the row already read `deploying` let a later acknowledgement answer a request that had been superseded, reporting a node as converged on a revision it was not running. The guard now covers observations only, which is where repetition is the reconciler re-asserting a state it already reported. A newer deploy supersedes an older one so a redeploy of a stuck request can take over; anything else in flight is still refused rather than displaced with no terminal event. A rejection is logged differently from an infrastructure error, because a target the model keeps refusing holds its active slot and stops recording anything further, and that is worth seeing. * feat(git): migrate pre-existing Blueprints into the revision state Blueprints that predate the model are brought in at boot: an application, an intent describing what the Blueprint currently asks for, and a candidate marked as coming from the legacy inline record. None of it is an acknowledgement. The Blueprint revision is carried for display and nothing else, because a revision number is not evidence that any node is running what it names, and recording it as agreement would report a fleet as converged on an intent nobody verified. No targets are created for the same reason, and the candidate's required set is empty: migration records what is asked for, never which nodes currently satisfy it. An approval authorizes the intent it was given for, so a Blueprint that was never approved, or edited since, is recorded as needing reapproval rather than left blank. Blank would read the same as an approval that is merely absent. Replay is decided by the same scope, schema version, and fingerprint the Git migration uses, and a Blueprint the new path already described is skipped outright, since its rows were written with proof this pass does not have. Blueprints migrate in their own pass. Coupling them to the Git migration would let one unreadable Git stack keep every Blueprint outside the model. * fix(git): contain the blueprint stack-directory probe at its call The ownership probe resolved a path from the blueprint name and checked it through the shared helper, which the security scan does not credit as a barrier. The check now sits with the call it protects, matching the form used elsewhere for the same reason. The path was already validated, so this changes no behaviour. It surfaced now because an earlier commit in this branch rewrote the file's line endings, which made every line read as new and brought a pre-existing call into the scan's changed-code window. * feat(git): read GitOps history and carry revision state on source reads Adds the instance-local history API and the additive revision fields the source reads have been missing. `GET /api/git-sources` and `GET /api/stacks/:stackName/git-source` now carry `gitopsRevision` and `stackResourcePresent`. Only the instance that owns the files can say whether a stack directory is really there, so that answer travels with the response rather than being inferred by a reader that has never seen the filesystem. It is read through the strict stack listing: the lenient one answers a failed directory read with an empty list, which here would read as every stack having vanished and would turn an unreadable disk into an empty audit trail. Two history routes land with them: `GET /api/git-sources/history` across stacks, and `GET /api/stacks/:stackName/git-source/history` for one. Both page on `(created_at, id)` so rows written inside the same millisecond survive a page boundary, and both bound how far one request will scan. A malformed cursor or an unusable filter value is refused rather than ignored, because answering "show me the failures" with everything reads as an answer instead of a non-answer. Authorization is decided per row. A row reduces to a stack read only when it names a stack, its application is live, and the stack is present on disk; anything unprovable stays with Admin. The cross-stack routes classify every row, while the per-stack route is authorized whole by name, so reading a stack shows its full history including entries from an earlier application. That distinction is carried in the scope type rather than a flag, so skipping the row classifier without pinning the query to the authorized stack cannot be expressed. History entries record the fields each transition moved rather than a whole revision, so lifecycle for the classifier comes from the owning application row. That keeps authorization off the recorded payload entirely: an entry whose detail cannot be read still returns its identity, stage, and outcome with a stated limitation, and the decode failure is logged rather than passed over in silence. * feat(git): let auditors read GitOps history they cannot tie to a stack A history entry that cannot be tied to a readable stack fell to Admin, which left the auditor role seeing exactly what a viewer sees on the one surface it exists to read. History entries are an audit trail: insert-only, and recording the actor, trigger, stage, and outcome of every transition. The request audit log is already gated on the audit permission, so an entry whose audience cannot be narrowed now falls there too. Withholding it protected nothing in any case, since the request log already records that a Git-source mutation happened and who made it. The source collection deliberately keeps its Admin fallback. Those rows are live Git configuration, not a record of events, and a mandate to audit does not extend to reading the repository, ref, and credentials policy of stacks that were deleted or never finished being created. The fallback is now part of the requirement type rather than a role comparison, so each surface states which audience it falls back to and the compiler requires every case to be answered. * feat(git): correct remote node identities on GitOps reads A remote instance numbers its own nodes and has never heard of the hub's numbering, so every node id it reports is a statement in its own namespace. Read straight through, a hub joining two nodes showed two different machines as the same node. Four GETs now take a second hop that buffers the response and corrects those identities: the git-source list and detail, and both history routes. Everything else keeps streaming exactly as before, which is the reason this is a separate hop rather than a mode of the existing one: logs, downloads, and event streams must never be buffered, and the enumerated positions rewritten here do not appear in them. Only JSON numbers are replaced. A null node is preserved, since "no node" is a fact the remote is entitled to state and inventing one there would claim a placement that does not exist. Strings, application ids, and stack names travel untouched. The hub re-authorizes what comes back. A remote authorized its rows for the machine account the hub proxies with, which says nothing about the person behind the request, so every row is classified again against the signed-in user. To make that possible without the hub holding another instance's database, each history entry now carries the lifecycle of its owning application alongside the stack-presence answer already there. Both are validated fail-closed, and a verdict a remote might volunteer is ignored: the hub decides, the remote supplies evidence. Asking one node for another node's history is refused before the hop rather than forwarded, because the remote would answer about itself and the page would read as an answer to a question nobody asked. When the node asked for is the node being talked to, the hub translates that into a flag the remote resolves to its own default node. Only the hub may set that flag, and a remote honours it only on a proxied hop. Every way this hop can end converges on one terminal answer: rewritten, passed through, too large, undecodable, failed upstream, or abandoned by the client. A body the hub could not read never borrows the remote's success status. * test(git): assert the unlinked git-source response field by field The detach test compared the whole response to `{ linked: false }`, which stopped holding once that route started carrying the additive revision fields. The equivalent backend route test was updated when those fields landed; this one was missed. Asserted field by field rather than loosened to a partial match, so the two new fields are actually checked: a detached stack has no application to project while its directory is still on disk. * feat(git): carry GitOps revisions on blueprint, node, and drift responses Completes the additive JSON half of the revision-state read contract, so the Blueprint, node, and drift surfaces report GitOps state through the same projection the Git-source routes already return instead of leaving it unreadable. Blueprint list, detail, create, update, and pin carry gitopsRevision. Node-label add, cordon, uncordon, and node delete carry gitopsRevisions, ordered by blueprint id and covering only the Blueprints the mutation actually moved: an edit no selector reacts to reports an empty list rather than invalidating the whole catalog. Node deletion reads its Blueprint owners inside the deletion transaction and before the tombstone, which is the last moment a target row can be traced back to an application, and an orphaned target is logged rather than being silently indistinguishable from a Direct one. Both DELETEs that answered 204 still answer 204. The drift GET and re-check gain the same field alongside the existing ledger, which is untouched; no GitOps class is written into stack_drift_findings. Reads and mutations treat a projection fault differently, on purpose. On a read the revision is part of the answer, so a fault surfaces. On a mutation the write has already committed, so the revision is decoration and is built defensively: letting it throw would answer a successful cordon or a completed node deletion with a 500, sending the operator to retry a hard delete that already happened and be told the node does not exist. It degrades to an empty list and logs. Because both drift routes answer with that projection, the identity hop now intercepts them too, matching its route table per method instead of rejecting every non-GET. Left as they were, one object would carry the hub's node numbering or the remote's depending only on which route asked for it. The allowlist names a single mutation rather than opening a verb, and the hub's collection filter still keys off the git-source paths alone, so drift payloads are rewritten without being re-authorized: they are per-stack and already authorized by name before the hop. Tests cover the exact shapes, the preserved 204s, revision ordering, the empty-list cases, node deletion reporting its tombstoned Blueprints and surviving a projection failure, and the proxy's new route matching, drift rewrite, and filter exclusion. * fix(git): resolve every application a GitOps surface can own Three gaps found while building the additive JSON, all the same shape: an id or a sentinel stood in for a row, so "there is nothing here" and "the thing that should be here is unreachable" collapsed into one answer nobody could tell apart. A Blueprint application is stored with stack_name NULL, so no lookup by stack name could reach it, while the reconciler materializes every Blueprint as a stack directory of that name. A stack's Drift tab and Git panel therefore reported no GitOps at all for a stack GitOps was actively managing, while the Blueprint page reported a live application for the same thing. Stack surfaces now bridge the two through the deployment row for the asking node. The deployment row is what makes it safe: Blueprint and stack names share one namespace, so matching on name alone would let a Blueprint claim an unrelated stack of the same name on a node it never targeted. A retired application was unreachable for the same reason, because every entry point filtered to the live rows. Tombstoning deliberately keeps the configured identity and SHA pointers as frozen facts so the projection can still say what an application was, and the source deriver has a not_live status waiting for exactly that, but nothing could hand it one. A detached Blueprint or stack now reports what it was instead of reading as one that never existed. The not-applicable projection was typed so it could not carry a reason, which made a row that vanished between resolving it and re-reading it by id identical to a stack the model was never asked about. That one field widens to hold limitations, and the missing case now says so with the id as evidence. Every other missing-row path in the deriver already worked this way. Also logs, rather than silently skipping, a live application whose blueprint row is gone: with cascade off that is a real integrity fault, the placement did move, and the response would otherwise report that nothing had. Cordon and uncordon are deliberately left reporting nothing. A cordon governs whether new placements may be made, not what a Blueprint asks for, and the reconciler applies it only to new placements, so revising intent for it would invalidate acknowledgements fleet-wide over a change that evicts nothing. Two comments implied otherwise and now state the contract. * fix(git): keep stack-state resolution out of the Git-source read path Review of the previous commit found the fallback it added had reached further than intended. The resolver is now split by the question it answers. projectStackRevision answers "what Git source is attached to this stack" and stays Direct-only. projectManagedStackRevision answers "what manages this stack" and is what the drift routes use. The Git-source routes must not be answered with another application's identity, and there was a second reason: the row classifier takes the stack name from the Git-source row but the lifecycle from whatever the projection resolved, so a Blueprint application arriving there would have turned an Admin-only row into one any stack grant could read. The Blueprint that unlocked it could be the very one holding name_conflict because of that stack. The Blueprint-to-stack bridge also needed the right predicate rather than a present deployment row. name_conflict is written precisely when a stack of that name already exists on the node and Sencho does not own it, so guarding only against withdrawn admitted exactly the collision the bridge exists to prevent. It now requires last_deployed_at, which proves this Blueprint wrote the directory, and excludes name_conflict and withdrawn: the same predicate the delete and withdraw paths use. Only a live Blueprint application qualifies, since a retired one has no claim on the directory. The detached fallback no longer resolves deleted applications. Detached means the files are still on disk and still describe that stack; deleted means the stack is gone, so any directory of that name now belongs to something else and reporting the old repository and SHA against it would disclose one stack's Git identity through another's name. The authorization side already refused deleted rows for that reason, so the two now agree. Ordering breaks ties on rowid rather than a random UUID, and two partial indexes cover the new lookups, which the existing live-only unique indexes could not serve. The not-applicable variant's limitations are readonly, so pushing onto the shared frozen instance is a compile error again rather than a runtime throw. Tests cover a Blueprint claiming a stack it never deployed onto and one it hit a name conflict on, a detached Direct source projecting not_live, and a deleted one staying unresolved for a reused name. Drift fixtures move to afterEach so a failing assertion cannot leak state into the next test. * fix(git): stop the stack resolver falling through proven ownership A second review round found the resolution chain could answer with the wrong application, and that part of the previous commit was reading a state nothing writes. The Blueprint bridge returned one value for two different facts. Once the deployment row proved a Blueprint had written the directory, a missing application row for it still answered "no Blueprint here", so the chain continued to the detached-Direct lookup. A stack that once had Direct Git, was detached, and whose directory a Blueprint later took over would then report the old Direct application's repository, ref, and SHA as that directory's state. The bridge now separates "not mine" from "mine, but broken": the second logs and returns its own limitation, so the fault is visible and no unrelated identity is offered in its place. A Blueprint projection also carried the whole placement roster into a route authorized by a grant on one stack name. Targets are now scoped to the node being asked about, which is both the safe answer and the accurate one, since the question is what manages this directory here. The detached-Blueprint lookup, its index, and its fallback are removed. Blueprint retirement writes deleted, never detached, and the only detached writer is the Direct detach path, so the getter could never match and the index covered an empty set. The test that seemed to cover it built the state by hand and was green against something the product cannot produce; it now drives the real delete route and asserts what that path actually writes. The Git-source resolver goes back to live applications only. Detach removes the source row in the same transaction that tombstones the application, so a source row beside a detached one is not producible, and the route's row classifier takes its stack name from the source row but its lifecycle from the projection. Keeping that resolver narrow is what stops a resolution change from quietly moving who may read a row. The comment saying so is restored and now explains why it must stay true. * refactor(git): share the GitOps application fixture across the route tests Two test files carried near-identical 58-line GitOpsApplicationRow literals that differed only in a repo URL nothing asserted on. Both now import one helper. The drift tests also repeated a Blueprint seed and its activation across four cases, and re-imported DatabaseService per test; those become local helpers and one hoisted import, which lets the cleanup hook go synchronous. Node lookup throws on a missing default instead of casting. projectBlueprintRevisions is module-private again: its only caller is the committed-projection wrapper beside it. A third copy of the same fixture remains in git-source-routes.test.ts. It is left alone deliberately: it pins timestamps at 1 rather than now, and that file has ordering-sensitive history assertions that would need auditing first. * feat(git): mirror the GitOps revision contract on the frontend Adds the client-side read contract for the GitOps revision projection, with no consumers yet. types/gitops.ts is a hand-written mirror of the backend read contract, in the same convention as the other domain type files: the frontend never imports backend. The projection's two arms are named separately so a component can take the live one as a prop without re-narrowing, and the absent arm keeps its absent keys rather than nulls so reaching for a lifecycle status without narrowing is a compile error. The limitation code stays an open string, since the backend adds codes without a schema bump and an exhaustive switch would silently stop rendering the newest ones. lib/gitopsState.ts is the one place a facet status becomes words and a colour, so a state reads the same in a sidebar tooltip, a panel banner and the drift tab. Both maps are keyed on the closed status unions, so widening the mirror without naming the new state fails this build. Every line of copy states the condition the deriver actually tests, which is not always what the status name suggests. recovery_required is a recovery already running rather than one that is needed. candidate_ready is reached only when review is not required, so it is ready to apply, not ready to review. synced_and_healthy is also reached with the health gate switched off and never compares the deployed generation against the accepted one, so it claims neither. never_reconciled means nothing has been accepted; a fetch that produced no materialization still records its commit. pendingSourceStatus keys "an update is waiting" on the candidate pointer rather than the status name, because source_reconcile_required is reachable both from a stale candidate and from an accepted generation with no candidate at all. Retirement is excluded first: tombstoning keeps the candidate pointer as a frozen fact, so a stack detached mid-review still carries one. absentFault separates the two facts the empty projection carries. Empty limitations means the model was never asked about this stack and the right rendering is nothing; a non-empty list means an application that was expected could not be reached. A live application's limitations are caveats on state that is being reported, not faults, so they are deliberately excluded. * feat(git): name the Git source state on the stack and sidebar surfaces The sidebar indicator and the anatomy source row both read a raw pending commit pointer, so a candidate blocked by local conflicts, held for review, or stale against the configuration in force all render identically to one that is ready to apply. The projection distinguishes them; nothing was reading it. refreshGitSourcePending now derives each stack's state from the projection and the pending map carries that state rather than a boolean. Presence in the map still means exactly what it meant before, because it is keyed on the candidate pointer rather than the status name: source_reconcile_required is reachable both from a stale candidate and from an accepted generation with no candidate, and only the first is something to review. One narrow fallback remains, for a row with no projection at all: a failed GitOps write is logged and swallowed while the pending commit still commits, so the flat pointer is the only thing that can answer there. Wherever a projection exists it is the sole authority. The sidebar keeps one indicator, in the same slot, at the same size and colour, with the same position in the priority ladder. Only the tooltip changes, so a blocked plan now says so instead of reading as an ordinary update. A test asserts the rendered indicator is identical across states, which is what keeps the rendered sidebar unchanged. The anatomy source row keeps its pulsing dot alone for the ordinary case and adds the state word only for the states the dot cannot express. Inline rather than in a tooltip, since this is the reason something is stuck. * feat(git): surface derived GitOps state in the Git source and Drift panels The Git source panel's pending banner had two things it could say, read from a raw commit pointer and a single blocked boolean. It now names which of four states the candidate is actually in, so a plan blocked by local conflicts, one held for review, and one gone stale against the configuration in force stop rendering as the same ordinary update. The short commit sha stays. A new card above it reports an application the projection could not reach. That case renders as nothing at all today, which is indistinguishable from a stack the model was never asked about. Empty limitations stays silent, because that is the ordinary answer for most stacks and a header over an empty block would be worse than nothing. The summary block gains one row naming the source state. It is the first place the panel can show applying, retry scheduled, suspended, recovering, or a detached source, none of which have a pending commit and so never reach the banner. Both existing rows are untouched and the last applied commit stays a display fact. The revision lives in its own state rather than on the Git source type, because the PUT that saves this panel answers with a bare source and no revision. A save drops it instead of rendering a state the write has already moved. The Drift tab gains a third block below the two it already has. The compose versus runtime card and the since-last-deploy card keep their exact positions and copy; the new block answers a different question, which generation this node was asked to run and whether it got there. A Blueprint-owned stack shows its target rows and no source card, since a Blueprint application has no Git source and inventing one would be a claim the model never made. The drift class list renders against the type and expects no rows, because nothing populates it yet. * feat(git): declare revision fields on the blueprint and node clients Types first. The blueprint list, detail, create, update and pin responses all carry a GitOps revision, and the node label add, cordon, uncordon and delete responses carry a list of them. None of that was modelled, so the fields were being dropped silently and the next reader would have taken these for bare records. Most of it is declared and deliberately unread, with the reason written where the type lives. Create, update and pin are followed immediately by a re-read of the catalog or the detail that carries the same projection, so rendering the mutation's copy would show the same fact twice with one of them stale. Cordon and uncordon always answer with an empty list by design, because a cordon governs whether new placements may be made rather than what a Blueprint asks for, and the reconciler leaves existing deployments where they are. The comment on that type is the point: the risk there is a future reader building a consumer for a list that is never populated. Two places do report something. Deleting a node and adding a node label both re-place Blueprints, and both now say how many. The count only, and only when it is not zero: an empty list means both that nothing moved and that the projection faulted after the write had already committed, so it can never be reported as the first. Blueprint detail gains the same unreachable-application card the Git source panel has. A Blueprint with no live application row is a fact nothing in the product could previously express, which is a different problem from having two ways to say the same thing. * fix(git): close the gaps review found in the GitOps frontend consumers Six defects, each verified against the code before being fixed. The pending-map read assumed every /git-sources row carries a projection. That route is proxied, so a node predating the model answers rows without one, and dereferencing it threw inside the loop. The catch swallowed the throw, the map was never set, and every stack's Git indicator froze at its previous value for as long as that node was selected. The field is optional now and a row without one falls through to the same branch as a row with nothing to project. That fallback also branched on the arm alone, so a projection reporting an unreachable application plus a stale commit pointer was reported as a candidate ready to apply. It now excludes a faulted projection: a fault means an application was expected and could not be read, so the pointer is not evidence that anything is ready, and naming a state there would be a guess. Detaching a Git source cleared the source but not the revision, and the pending card is derived from the revision alone. The panel kept advertising a waiting commit for a stack Git no longer managed, behind a Review button that silently did nothing. A read that threw had the same problem across stacks: the panel is reused, so stack A's state could render under stack B's header. The panel also lost the flat-pointer fallback the sidebar keeps, so the two surfaces disagreed: the sidebar would show an indicator and clicking through showed no card. Both now apply the same rule. Node delete parsed the success body unguarded. The delete has already committed at that point, so a malformed body would have reported a completed deletion as a failure and skipped the refresh, leaving the deleted node on screen. Tests: five mutations that previously survived now fail. The zero-pixel claim compared the wrong element and passed when the indicator vanished entirely; the stale-read test asserted during the loading window, when the body is skeletons regardless; the sidebar passthrough test proved only that an indicator existed, not that the state reached it. Added coverage for the drift row, an unknown node, the not-applicable source guard, the save clearing, the Review button, and a live application carrying a caveat, which must not read as a fault. The fixture set drops two source statuses whose identity defaults describe a state they cannot be in, and gains a drift-item builder. * refactor(git): share the GitOps fault card and live-facet derivation The unreachable-application card was built inline on three surfaces, and the copies had already drifted: the Git source panel used one icon while the Drift tab and the Blueprint sheet used another, so the same failure rendered two different ways. It is one component now, which also owns the state key and the test id those surfaces assert on. Deriving the live source facet was likewise repeated, along with the two semantic decisions behind it: the absent arm has no facets, and a source facet of not applicable means a Blueprint owns the stack rather than that something is missing. Both now live next to pendingSourceStatus, which already encoded the same exclusion. The Git source panel's seven derived values collapse to three, with the pending-commit rule extracted to a named function so the four cases read straight through instead of as nested ternaries. Behaviour is unchanged in every case. The two flat-pointer fallbacks are deliberately not unified: they look alike but the panel also treats a live application whose source facet is not applicable as unanswered, and merging the predicates would change what that case renders. * feat(git): count and announce committed GitOps transitions Every history row that is actually inserted now produces one metric increment and one state-invalidate event, so the surfaces that read GitOps state hear about a change instead of waiting for the next poll. Announcement is buffered and drained on a macrotask rather than fired inline. better-sqlite3 is synchronous, so waiting for the macrotask puts the drain after the transaction that wrote the row, and after any outer transaction wrapping it, without having to detect which nesting depth it is in. The drain confirms each row is still present before announcing it, so a rolled-back transaction says nothing on its own, and the insert declines to queue a dedupe replay, so a retry says nothing either. The broadcaster is injected at startup rather than imported, keeping the GitOps layer free of a cycle back into the notification stack. Counters are process-local and in-memory, and their keyspace is finite by construction: history stages are now a closed union that the build enforces, and outcomes were already a closed set. The payload names no stack, node, repository, or actor, because a counter carrying those would be an audit trail with no retention rules and no per-row authorization, which is what the history routes provide. GET /api/gitops-metrics is Admin-only and instance-local, so selecting a node answers with that node's counters. On the client, a gitops-scoped invalidate refreshes the derived state through a 250ms trailing window, matching the existing stack refresh. One operation commits several transitions in a row and a first-boot migration commits a great many, so refetching per event would thrash the API for a picture that only settles at the end. * feat(git): show GitOps source state on the stack dashboards The dashboards list every stack on a node, which is where a fleet-wide reading of Git state is most useful and where, until now, a Git-backed stack looked exactly like a local one. Each row that the model has something to say about carries a chip naming its source state. The chip reads from the same status vocabulary the panels and the sidebar use, so a stack cannot be "pending update" in one place and something else in another. It sits beside the stack name rather than replacing the source column: the column says where the files come from, the chip says what GitOps makes of them, and those are different facts. The label is a word and the title is a whole sentence, so the state never rests on colour alone; the phone rows keep the word on screen, since touch has no hover. The join is by stack name, which is what the dashboards have, and its source is the same proxied route the sidebar reads. A row without a revision, a Blueprint-owned application, and a projection fault all leave the stack unbadged rather than inventing a state for it. State arrives by announcement rather than by poll, since it only moves on a transition, and a node switch blanks the map first: stack names repeat across nodes, so a slow answer for the node just left is discarded rather than allowed to label the wrong stacks. * feat(git): say which part of a GitOps state could not be proven Eighteen conditions can qualify a live projection: a manifest that does not match the branch configured now, an approval that could not be restored after a recovery, an artifact record that has gone. Every one was already recorded and none of them reached the operator, so a state with a hole in it read exactly like one without. Each now has operator wording under the state it qualifies, checked against the site that emits it rather than against the code's name, since several names describe something narrower or wider than the condition actually tested. The stored messages stay out of the UI: they are written for a log reader, and some are raw decoder errors. The presentation is deliberately quiet. A caveat is not a failure: the state above it is real, and one piece of evidence behind it is missing, so the reader learns which part to distrust without being told the whole thing is broken. Faults keep their own card, because those replace the state rather than qualifying it, and the two arms are read through separate helpers so neither can be rendered as the other. A code with no wording names itself rather than vanishing, so a node running ahead of this build degrades to something honest instead of reporting full confidence in a state its own backend flagged. * fix(git): record a stateful first placement and keep a half-built Blueprint editable Two faults that today's product cannot reach, and that the Git-backed Blueprint mode would reach immediately. The live-application lookup answers with an application that is active or still being created, because its other callers ask whether the Blueprint already holds the live slot, where a half-built row counts. Three producers passed that answer straight into transitions that accept only an active application and reject anything else by throwing, inside the caller's own transaction. A Blueprint edited or pinned while its application was still being created would have failed with a server error and rolled the Blueprint write back with it. The producers now narrow to what they actually require, through one shared predicate, leaving the slot check honest. Separately, a stateful placement is held for operator review before anything is deployed, so no target exists when that hold is recorded, and the observation was dropped for want of one. The hold left no trace: no history row, and nothing on the target to say the node had been asked to hold anything. First contact now creates the target, exactly as the first deploy does. Nothing else changes with it: no intent, no generation, no operation, and connectivity stays unset, because a node that has only been asked to hold something has not been contacted. Observations that follow a deploy already have a target, so they are unaffected, and a drift or evict report for a node nothing was ever sent to is still dropped. * fix(git): keep the Git source panel's state after a save The save answers with the source row and no revision, so the panel had nothing to replace its copy with and dropped it. The result was a stack that had just been reconfigured showing no GitOps state at all until the panel was reopened, which reads as a stack the model knows nothing about rather than one whose state has just moved. It re-reads instead. Keeping the old copy was not an option either: a material configuration change clears the staged candidate server side, so the state genuinely has moved and the panel would have gone on offering a commit that is no longer there. Only the server can say what replaced it. The alternative was returning the revision on the save itself. That route is proxied, and the identity hop rewrites node numbering for an enumerated set of routes, so adding a revision to a response outside that set would hand back a remote node's numbering unrewritten. Re-reading costs one request on a low-frequency action and needs no change to the hop. * docs(git): document what GitOps state means for an operator A commit SHA says which files Sencho wrote. It does not say whether that commit was accepted, whether something newer is waiting, or whether an operation was interrupted halfway, and until now the docs had no words for any of that. Git Sources gains a source-state table and a section on what happens when part of a state could not be proven, since a stack with missing evidence looks identical to one with complete evidence unless the product says otherwise. Drift Detection gains the gitops section and explains why it answers a different question from the two signals above it: those compare files and containers as they are now, this reports what has been proven over time. The dashboard page describes the state chip and, importantly, that it and the row tint are independent, so a healthy row carrying "pending update" is not a contradiction. The Blueprint page now separates its revision counter from GitOps state. The counter labels the spec; it says nothing about whether a given node has got there, and reading it as fleet truth is the mistake the note prevents. The tutorial's verification step names the source state it should show, so a reader can tell the difference between files written and a commit accepted. Audited and left unchanged: health-gated updates and fleet federation. Neither presents a SHA or a revision as canonical GitOps truth, so neither needed correcting. * docs(git): name which saves actually clear a staged commit The note claimed saving the form always clears the staged commit and moves the state to reconcile required. Only a change to what gets materialized does that: the repository, the ref, the compose paths, the project directory, or the env sync. Changing the token or the apply behavior leaves a staged commit alone, because neither changes what would be written, and telling an operator otherwise would have them pull again for nothing. * fix(git): say when a committed transition has nobody to announce it to Two silences worth breaking, both found reviewing the error paths in this slice. A server that never installs the event sink still counts every transition and still writes every history row, so the only symptom is that no client ever refreshes and the UI is quietly as stale as it was before any of this existed. It now says so, once rather than per row, since a boot migration would otherwise fill the log with one fact. The dashboard's source-state fetch dropped a non-ok response without a word. A refusal there freezes every badge at its last value, which looks exactly like a fleet where nothing has changed, so the status code is logged rather than inferred from badges that stopped moving. * fix(git): close the defects review found in the announcement slice Five findings, two of them able to reach an operator. The event sink was installed one line after the deletion reconcile, which tombstones applications and targets and awaits inside its own loop. A drain therefore landed while the sink was still absent, so those boot-time transitions were counted and never announced, and the warning added for an unwired sink would have fired on every boot with a prepared deletion intent: the fastest way to teach an operator to ignore it when it means something. The sink now precedes every reconcile and migration pass. The first-placement target was created outside the transition that records it. The observation runs in its own savepoint and can refuse, and the caller deliberately lets the deployment commit whatever the record says, so a refusal left an active target with no generation, no stage and no history: a placement relationship the model never established, which the delete path would later tombstone as if it were real. Both writes now succeed or fail together. The badge looked its status up in a map closed at compile time, behind two casts, while the value arrives over a proxy from a node that may run a newer vocabulary. An unmapped key dereferenced undefined inside a stack row and would have taken the whole table down with it. The facet and its status are now a discriminated union, the lookup is optional, and an unrecognised status renders nothing, which is what the join already does for a stack it has no state for. The dashboard's source-state loop derived each row inside the shared try, so one row in an unexpected shape abandoned the loop and froze every badge at its last value with nothing on screen to say so. Each row is now guarded on its own and the count of unreadable ones is logged. Two tests claimed things they did not check: both asserted a word was on screen with a matcher that also matches screen-reader-only text, so a compact badge would have kept them green, and one compared a label by containment where the shorter label is a prefix of the longer. Both now assert the visible node by equality. Added coverage for the window event the dashboard actually refetches on, an unknown status, a row that cannot be read, node-switch blanking, and a caveat recorded twice. One fixture built a status pair the deriver cannot emit and was corrected. Also: the guard narrowing Blueprint producers to an active application excludes nothing today, because every Blueprint-mode application is inserted as active and only Direct mode can be creating. The guard stays, since the getter's slot semantics and the transitions' requirement have drifted apart once already, but its rationale and its tests now say plainly that they pin a defensive guard rather than reachable behaviour. * refactor(git): make three runtime guards visible to the compiler Type review found the same shape three times: a correct guard whose necessity was asserted in a comment the type system could not see. This project does not set noUncheckedIndexedAccess, so each of these read as dead code to anything that trusts the types, and the guards protect the behaviours that matter most here. The limitation copy map typed its values optional, so the fallback for an unrecognised code is now something the compiler requires rather than something a comment explains. The badge reads its status through partial views of the two vocabularies, so a miss is a fact TypeScript derives: deleting the guard that stops one unknown status taking down a stack list now fails the build, where before it compiled. Neither needed a cast. The event payload has to be a type alias rather than an interface, because only the former gets an implicit index signature and the broadcaster takes an open envelope. That requirement now fails at the declaration instead of surfacing in the startup wiring as an unexplained index-signature error. Also added the reverse of the copy-coverage check: a code retired from the backend leaving stale wording behind was invisible, since the fallback only fires for entries that are missing rather than ones that linger. * fix(git): make the state cards survive an unknown status, and correct the copy Comment review found the protection added for the dashboard chip was claimed more widely than it held. Five other surfaces indexed the status vocabularies directly and passed the result straight to a card that dereferences it, so the exact input the comments said would take a list down still threw in the Git source panel, the Drift tab, the sidebar tooltip and the stack anatomy row. The card now takes an optional state and renders nothing without one, which also means a new surface cannot reintroduce the dereference by rendering a card the ordinary way, and the remaining four read through the lookups. Copy corrections, each against the site that emits it rather than the name of the code: The manifest-identity caveat said the manifest named a different repository or branch. It also fires when the manifest has no identity block at all, or identifies another node or another stack, so it now says it does not identify this stack on this node from the repository configured now. The last-known-good artifact caveat covered a mismatch but not the row being gone, which is the other half of the same condition. Doc corrections: a Blueprint-delivered stack was described as carrying the dashboard chip and a source state on the Drift tab, and it carries neither, because a Blueprint has no Git source of its own. Per-node Blueprint state was attributed to the detail sheet's GitOps section, which only reports what could not be read or proven; the Deployments table is where per-node status lives. Clearing a staged commit was said to always land on reconcile required, but a stack that has never had a commit accepted lands on never reconciled. The caveat lines were described as sitting under the state when they render above the form. And the pending banner was still documented as webhook-only, which this branch changed: it now appears for any staged commit and its heading is the source state. Also corrected two claims in the code: the observation branch does not skip for a Blueprint that migration brought in, because migration creates no targets, and the only refusal reachable from that call site is a tombstoned target. * refactor(git): simplify the announcement slice without moving any behaviour A simplification sweep over the new code, all of it behaviour-preserving and re-checked by breaking each guard afterwards. The drain now separates policy from mechanism: it decides whether a row survived, counts it, and either warns or hands it to a small announce helper that owns the envelope and its error handling. The row-to-state pass in the dashboard hook lifts out of the fetch, so one function does the request and another does the derivation. The caveat dedupe collapses to a set, which preserves first-insertion order and so keeps the ordering its own docstring promises. The badge renders one span with a conditional class rather than two that differed only by class. The metrics service drops an internal type that was byte-identical to the one it exports. One assertion goes: the observation branch tested membership and then re-asserted the same fact to index the stage map, and a type predicate lets the compiler carry it instead. Everything the sweep was told to leave alone is intact: the buffered drain, the row-existence re-check, the injected sink, the one-shot warning, the partial-view lookups and their guards, the optional copy map with its fallback, and the generation counter with its per-row guard. * fix(git): close audit findings in the GitOps revision model Five corrections from the pre-merge audit of this branch. Migration no longer certifies a commit it cannot prove. The manifest read now carries its resolved commit, and a manifest that names a different commit than the source row records as applied is refused: the applied directory materializes one commit while the row names another, so trusting them together would mint a generation pointing at files that are not the ones it claims. A manifest that names no commit at all, which is what adoption writes, is a separate answer rather than a disagreement, because reporting it as one would name a commit the manifest does not contain. Both are recorded as evidence and the projection asks for a fetch. Create cleanup proves containment against the real filesystem before it deletes. Every check on these paths was lexical, so a symlink or Windows junction above the target read as contained while the recursive delete followed it out of the managed area. Resolution keeps "is not there" apart from "could not be read": only a genuinely missing path lets the walk climb to an ancestor, because treating an unreadable one as absent would infer containment for the single path whose link status could not be established. Both sides are resolved, so relocating the data directory onto another volume keeps working, and an area that does not exist at all is nothing to delete rather than a suspected escape. The marker write takes the same barrier as the marker delete, so a link cannot be written through and then refused on the way out, wedging the stack name. Startup stops while an interrupted create is unresolved, matching the restore reconcile above it. A create that could not be settled leaves a stack directory the deploy path cannot tell apart from a finished one, so the alternative to stopping is letting a scheduler, webhook or operator act on a half-built stack. Only that blocks: once the staged directories are gone the create is torn down, and a staging marker nobody could unlink is reported rather than thrown, so one failed unlink is not the difference between an instance that boots and one that does not. Per-stack history no longer exposes a predecessor through a reused stack name. The grant covers the application holding the name now, which is what keeps a stack's own entries readable while it is still being created; every other row on that name is classified per row, so entries belonging to an application that held the name earlier need the audit permission, as they already did across stacks. A detached predecessor is still readable, which is the classifier's own standing decision about detach rather than a gap here, and is now pinned by a test. Blueprint observations reach a reader. The reconciler recorded state review, evict blocked, drifted and correcting against the target and nothing projected them, so a deployed Blueprint could report itself as never applied. The runtime facet now projects all four, below the states a live or failed mutation puts the target in and above the pointer checks, and any later transition supersedes the observation. The map is declared total over the stages the reconciler can record, so a stage added without a projection fails the build rather than silently reading as never applied again. * fix(git): confine managed-area cleanup to each stack's own location Cleanup proved only that a resolved path landed somewhere inside the managed area. That is satisfied by every other stack and every other node in it, so a link from one stack's generations directory into another's passed the check while the delete took a generation belonging to someone else. The check is now positional: the managed area is resolved once, so relocating the data directory onto another volume still works, and every segment below it must be reached without redirection. The create-path sinks use it on the write as well as the delete, so a claim cannot be written through a link and then refused by the hardened delete, and the manifest service's pre-existing deletion sinks (generation pruning, boot-sweep orphan reaping, detach staging and finalization, and whole-area removal, including after a restored snapshot) run it before their recursive deletes too. Each of those sinks also keeps a literal containment comparison beside the positional check, because static analysis credits only a comparison at the call and reports the delete otherwise. A refusal names both paths in the log, because it can hold the boot gate. Boot recovery dropped the checkpoint of an application that had left the creating state without first clearing its staging marker. That left a claim on the stack name with nothing to retry it, and every later create for that name was refused by a marker nothing could remove. The settled branches now share one exit, so the marker ordering holds for all of them. A detached application's history was readable on a stack grant because its files are still the stack standing at that name. Nothing in these tables can prove it still is: a Blueprint successor records the name off the application row, and a plain Compose stack recreated at the name leaves no trace at all, so no detection-based allowance can be made sound. Detach now moves an application's trail to the audit audience outright, the same answer deleted and creating predecessors get, while reading the stack itself stays where it was. * fix(gitops): close four audit findings in revision state and identity proxy A1: derive runtime and health against target desired_generation_id - deriveRuntime returns 'applied_not_deployed' when desired != deployed, so a stale deployment stays deploy-pending instead of reading synced_and_healthy - deriveHealth judges against desired_generation_id falling back to deployed when null; control case proves null-desired rows unchanged - collectRuntimeDrift emits the plan-pinned runtime drift item for exact/ qualified observation mismatches; equal/non-comparable observations emit nothing; ordering pin keeps deploy question first A2: stop upstream 304 responses from bypassing hub rewrite and reauthorization - identity proxy answers no-store on every terminal (rewrite, 204, 304, generated failures); validators (etag, last-modified, cache-control, expires, vary) no longer forwarded - conditional request headers (if-none-match, if-modified-since, if-match, if-unmodified-since) stripped on the identity-hop branch of the shared proxyReq handler; streaming hop untouched (optimistic-concurrency file writes depend on If-Match/If-Unmodified-Since) - supertest integration test drives the real middleware through a loopback capture server and asserts if-none-match absent while accept survives S1: migrate legacy query/userinfo URLs via secret-free path - parseLegacyRepoUrl strips userinfo, query, fragment instead of refusing; parseHttpsRepoUrl remains the strict gate for user-driven paths - migrationDirectSourceIdentity uses the tolerant parser; operational stack_git_sources.repo_url untouched; fingerprint convergence proven - trusted-manifest-on-legacy-URL test covers the worst real-world instance S2: emit runtime artifact drift for current evidence - top-level drift array carries the seven-class runtime item; frontend comments updated to reflect backend now emits runtime drift All regression tests added and passing. CI green (7,374 backend + 2,790 frontend tests; only pre-existing Windows EBUSY teardown failure unrelated). * test(frontend): fix DriftPanel drift item rendering test Update test assertions to match the new backend drift item format. The function now renders artifact_set expected identities as 'artifact <id> · <qualification>' and runtime_artifact observed identities as the raw identity string. * fix(gitops): emit a runtime drift item for desired-versus-deployed mismatch The projection reported applied_not_deployed with no entry in drift, so the canonical drift list contradicted the runtime facet it travels with. collectRuntimeDrift now emits the r27 generation-mismatch item for that state: desired generation as expected, deployed generation as observed, ComposeService as owner. The action mirrors what availableActions offers: deploy, unless an application-level fetch or apply is in flight or a recovery is in progress, which withhold deploying without removing the fact of the mismatch. The item clears once the desired generation deploys. The stale-deployment test pins the exact item shape, its stability across re-derivation, its convergence removal, and the withheld-action case; the ordering pin keeps the artifact observation suppressed while the deploy question stands. Frontend fixture aligns its artifact-mismatch example with the backend's none action. * fix(gitops): keep generation drift visible across failure and pause states The desired-versus-deployed drift item was keyed to the applied_not_deployed runtime status, but paused, failed, recovering, interrupted, and in-flight statuses all outrank the pointer comparison in the deriver. A failed deploy of a new generation over a running older one therefore dropped the drift report exactly while the old workload was still serving. The item is now judged from the pointers themselves: known and different means reported, whatever presentation status the target carries. Retired targets are excluded because nothing can rebind them, so their surviving pointer divergence would be permanently unresolvable noise. The action follows what the payload offers: deploy only when no application-level operation or recovery withholds it and availableActions lists deploying, none otherwise. The failed-redeploy regression test pins the exact item shape after a pre-mutation deploy failure, its stability across re-derivation, continued artifact suppression for the replaced workload, and convergence removal; a second pin keeps retirement silent. * fix(gitops): complete the available-action legality matrix The action list transcribed only part of the approved rules. An interrupted apply offered apply without checking that its recorded generation was still the current candidate; deploy fired for any target reading applied_not_deployed regardless of target mode, with no retry for an interrupted Direct deploy and none of the Blueprint interruption rules; approve_legacy sat in the type union with no producer, leaving a pending Inline placement review permanently unactionable through the projection; and drift items inherited whatever deploy recommendation any sibling target earned. Actions now follow the matrix. Deploy is decided per target through one predicate shared by deriveActions and the drift items: a paused or failed sibling can no longer inherit another target's legal deploy, a Blueprint-mode divergence never advertises Direct deployment, an interrupted Direct deploy retries against the generation still applied, and an interrupted Blueprint deploy or withdraw repeats only while its recorded intent revision and rollout candidate still equal what the application requires, where an absent pair matches because inline Blueprints carry no candidate until the later-phase producer lands. Interrupted apply requires the recorded generation to still be the current candidate and the source not to have been suspended meanwhile. A reachable Inline placement review now offers approve_legacy. Six tests pin the matrix: sibling isolation across failed and paused targets, the Blueprint mode guard, vacuous and matched Blueprint retry identities plus the superseded case, matching-versus-stale Direct deploy and apply interruptions, and the legacy review action. * fix(gitops): withhold apply retry while the candidate is blocked The interrupted-apply retry checked that the recorded generation still matched the current candidate and that the source was not suspended, but a later classification can also block that candidate, and applyStarted refuses a blocked one outright. The retry is offered only when every precondition the transition enforces still holds. * fix(gitops): prove apply preconditions and limit fetch to Direct The interrupted-apply retry checked identity, suspension, and blockage but never loaded the candidate generation, so apply could be recommended for a row that was missing, owned by another application, or built from a superseded materialization fingerprint; applyStarted refuses all three, and the positive fixture itself described a state no transition would accept. The gate now proves existence, ownership, and fingerprint before offering apply. Its fixture is rebuilt around a transition-legal candidate whose projected action is executed against applyStarted, with negatives for every refusal including suspension. Fetch was offered to any application whose source looked unreconciled, but the approved rules reserve fetch for live Direct applications; a Git-backed Blueprint divergence now advertises nothing of the sort. Controls pin both modes against equivalent source state. * fix(gitops): fail closed when a candidate row is missing or foreign Ordinary candidate_ready checked a fingerprint only when the candidate generation row existed, so a dangling id or one owned by another application fell through to ready and offered an apply that applyStarted would refuse on sight. The source now requires the row to exist under this application before readiness, records a limitation for the anomaly with its operator copy mirrored in the frontend, and reports reconcile-required instead. The Blueprint retry test also pins that a superseded rollout candidate alone, with the intent still matching, suppresses deployment. * fix(gitops): fail accepted-generation derivation closed The acceptance branch compared fingerprint and sha only when the accepted generation row loaded, so a dangling id or one owned by another application fell through and reported application_generation_accepted with no evidence behind it, while also withholding fetch as the recovery. The source now requires the row to exist under this application before any comparison, records an accepted_generation_invalid limitation naming the pointer with its operator copy and inventory entry mirrored on the frontend, and reports reconcile-required instead. Five scenarios pin valid, missing, foreign, fingerprint-mismatched, and sha-mismatched acceptances. * fix(gitops): enforce canonical state in dismiss, reconcile, and pulls - Route dismiss-pending through the canonical dismissed transition so a refusal while an operation is in flight surfaces as 409 instead of clearing staged state behind the model's back - Treat tombstoned targets as authoritative in both reconciler decision surfaces so ticks never redeploy onto a placement the model severed; an explicit deploy revives the target and records the revival delta - Keep application-level rows in node-scoped history pages so proxied hub views do not read as if the application never came into being - Expose repoIdentity and configuredRef on history items to match the server-side identity filters - Stand down when a pull resolves to exactly the live candidate (same commit, source fingerprint, plan verdict); pulls after an acceptance still open a fresh staging generation as the apply target * fix(rbac): classify git-source manifest reads as stack:read GET /stacks/:name/git-source/manifest had no rule in the hub route classifier, so proxied requests were refused with 403 before reaching the remote node even for callers holding stack read access. * fix(gitops): surface an error toast when dismiss is refused as in-flight Dismissing a pending Git update while a fetch or apply is still running now returns 409 OPERATION_IN_FLIGHT, but the frontend handler had no else branch for a non-2xx response, so the refusal was swallowed with no operator feedback at all. Add the same error-toast pattern already used by the sibling apply handler, and order the success toast before its side effects so a downstream failure cannot invert the outcome.	2026-08-27 10:25:27 -04:00
Anso	c3c6c1b0c1	fix(dashboard): use balloon-adjusted memory percent on the Memory tile (#1847) ... * fix(dashboard): use balloon-adjusted memory percent on the Memory tile When balloon fields are present, the Memory tile hero, tone, and gauge bar now use effectiveUsagePercent so they match the used/total bytes. Health and host RAM alerts still use working-set usagePercent. * fix(dashboard): align health banner and Memory tile on balloon-adjusted memory The health banner read the raw working-set percent while the Memory tile showed the balloon-adjusted one, so a hypervisor ballooning an otherwise healthy VM could flag it critical. Both now use effectiveUsagePercent, falling back to the raw percent when balloon fields are absent. Host RAM alerts keep the working-set percent: ballooned pages are reclaimed by the hypervisor and cannot be recovered by the guest on demand. Adds guarded context lines to the Memory tile: Current VM Memory (guest retained), Current pressure (effective used over retained), Balloon reclaimable, and, for ZFS nodes, Current memory in use (used plus ARC reclaimable) above ZFS ARC reclaimable. Validated with unit tests for both components including boundary cases, type checks, lint, and visual regression comparison confirming no change outside the Memory tile.	2026-08-24 05:57:06 +00:00
Anso	600cde7586	docs: document LinuxServer socket-proxy ALLOW_LOGS (#1848) ... LinuxServer socket-proxy gates container logs behind ALLOW_LOGS. Document those extras on top of every profile that includes log viewing, keep archive/changes/export/top disabled, and point Editor and Global Logs troubleshooting at the self-hosting section.	2026-08-21 19:27:25 -04:00
dependabot[bot]	a59f77acfd	chore(deps): bump golang from 1.27rc2-alpine to 1.27rc3-alpine (#1840) ... Bumps golang from 1.27rc2-alpine to 1.27rc3-alpine. --- updated-dependencies: - dependency-name: golang dependency-version: 1.27rc3-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anso <dev@saelix.com>	2026-08-20 10:25:10 -04:00
dependabot[bot]	eb0550eb59	chore(deps): bump the all-npm-backend group in /backend with 6 updates (#1842) ... Bumps the all-npm-backend group in /backend with 6 updates: | Package | From | To | | --- | --- | --- | | [cron-parser](https://github.com/harrisiirak/cron-parser) | `5.7.0` | `5.10.0` | | [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.41.0` | `1.41.4` | | [openid-client](https://github.com/panva/openid-client) | `6.8.4` | `6.8.5` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | | [@aws-sdk/client-ecr](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr) | `3.1106.0` | `3.1111.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1106.0` | `3.1111.0` | Updates `cron-parser` from 5.7.0 to 5.10.0 - [Release notes](https://github.com/harrisiirak/cron-parser/releases) - [Changelog](https://github.com/harrisiirak/cron-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/harrisiirak/cron-parser/compare/v5.7.0...v5.10.0) Updates `isomorphic-git` from 1.41.0 to 1.41.4 - [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases) - [Commits](https://github.com/isomorphic-git/isomorphic-git/compare/v1.41.0...v1.41.4) Updates `openid-client` from 6.8.4 to 6.8.5 - [Release notes](https://github.com/panva/openid-client/releases) - [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/openid-client/compare/v6.8.4...v6.8.5) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) Updates `@aws-sdk/client-ecr` from 3.1106.0 to 3.1111.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-ecr) Updates `@aws-sdk/client-s3` from 3.1106.0 to 3.1111.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-s3) --- updated-dependencies: - dependency-name: cron-parser dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: isomorphic-git dependency-version: 1.41.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: openid-client dependency-version: 6.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: "@aws-sdk/client-ecr" dependency-version: 3.1111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anso <dev@saelix.com>	2026-08-20 10:25:06 -04:00
dependabot[bot]	dfae3913e1	chore(deps): bump the all-actions group across 1 directory with 4 updates (#1844) ... Bumps the all-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/autobuild` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 09:31:18 -04:00
dependabot[bot]	d7ffe57716	chore(deps): bump the all-npm-frontend group in /frontend with 8 updates (#1843) ... Bumps the all-npm-frontend group in /frontend with 8 updates: | Package | From | To | | --- | --- | --- | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.2` | `12.11.3` | | [motion](https://github.com/motiondivision/motion) | `13.0.0` | `13.1.0` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `7.0.0` | `7.0.1` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.3` | `14.6.4` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` | | [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` | | [rollup-plugin-visualizer](https://github.com/btd/rollup-plugin-visualizer) | `7.0.1` | `7.1.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` | Updates `@xyflow/react` from 12.11.2 to 12.11.3 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.3/packages/react) Updates `motion` from 13.0.0 to 13.1.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v13.0.0...v13.1.0) Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/jest-dom/compare/v7.0.0...v7.0.1) Updates `@testing-library/user-event` from 14.6.3 to 14.6.4 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.3...v14.6.4) Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.3...v0.5.4) Updates `globals` from 17.9.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0) Updates `rollup-plugin-visualizer` from 7.0.1 to 7.1.1 - [Changelog](https://github.com/btd/rollup-plugin-visualizer/blob/master/CHANGELOG.md) - [Commits](https://github.com/btd/rollup-plugin-visualizer/compare/v7.0.1...v7.1.1) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@xyflow/react" dependency-version: 12.11.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: motion dependency-version: 13.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@testing-library/user-event" dependency-version: 14.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: rollup-plugin-visualizer dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 09:31:15 -04:00
dependabot[bot]	d5d0dbef0e	chore(deps-dev): bump the all-npm-root group with 2 updates (#1841) ... Bumps the all-npm-root group with 2 updates: [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) and [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional). Updates `@commitlint/cli` from 21.2.1 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/cli) Updates `@commitlint/config-conventional` from 21.2.0 to 21.2.2 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/cli" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-root - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-root ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 09:31:11 -04:00
Anso	a07401f564	fix: bump moby/go-archive to v0.3.0 in Docker CLI and Compose builds (#1845) ... Trivy fails the image scan on CVE-2026-17106 (HIGH) in github.com/moby/go-archive v0.2.0, where a crafted tar archive can write outside the directory it is extracted into. The dependency reaches both Go binaries baked into the image: the Docker CLI pulls it directly for build-context handling and `docker cp`, and Compose pulls the same code transitively through buildkit. Both builder stages already bump vulnerable transitive modules before building, so this adds one more to each list. A fixed version exists, so this is a bump rather than a suppression.	2026-08-20 09:26:56 -04:00
Anso	01ffbdbfc7	fix: untag reviewed image names during prune (#1836)	2026-08-20 07:53:57 -04:00
Anso	c6f36575b7	docs: expand pull request template for public contributors (#1837)	2026-08-18 21:58:03 -04:00
Anso	7746cf50cc	docs: refresh README screenshots, links, and capability list (#1833) ... Add Tutorials and Roadmap to the header link row, plus a Roadmap status badge. Replace the dashboard hero with the stack detail view showing the Drift tab, and retake every screenshot at 1920x1080 in Dim, OLED, and Light. The Dim grid stays visible by default; OLED and Light sit in collapsible sections so the page stays short. All captures share one appearance baseline: clean headings, signature charts, motion and effects off, maximum ambient glow, blue accent. Add three shipped capabilities that were documented but absent from the list: Fleet Secrets and Fleet Sync under Fleet, and the host console under Operations.	2026-08-14 15:49:27 -04:00
Anso	3c4c057467	feat(git): classify managed-file changes before apply (#1832) ... * feat(git): classify managed-file changes before apply Pull now builds a fingerprint-bound plan of adds, modifies, deletes, and local conflicts. Apply refuses stale or blocked plans instead of overwriting live files, and promotion stays the only filesystem mutator. * fix(git): contain stack-dir probes before filesystem access The missing-stack and root-.env existence checks now resolve against the compose base and refuse paths that escape it before lstat or existsSync. * fix(git): address managed-file change plan audit blockers Wire build-context live inventory into the planner, reject special file nodes without readFile, fingerprint configured project env files, enrich plan metadata, and compute the create plan before promotion. Redact drift ledger service keys for managed-path conflicts and clear pending plan columns on revision reset. * fix(git): unblock change-plan CI sinks and fifo test Hash stack files through a contained open plus fstat on the same handle so CodeQL no longer flags the lstat/read race, and create fifo fixtures with mkfifo instead of mkfifoSync. * fix(git): preserve unowned context files and align candidate validation Inspect prior and candidate build contexts together, delete only owned paths, reject context-root symlinks before walking, and validate with the env-file model deploy will use after promotion. * fix(git): contain live context and candidate env path sinks Inline resolve and startsWith at the lstat and access calls so containment is checked at the filesystem sink. * fix(git): resolve live context walks from the compose root Rebuild readdir, lstat, and access paths from the compose directory at each sink so containment is checked against a known-safe base. * fix(git): validate synced env removal against post-promotion files A managed .env that the next revision omits must not be used for candidate validation or invocation, because promotion deletes it. Context walks now bound directory entries and skip descendants under nested symlinks. Plan fingerprints bind review metadata and secret-path matching covers .env.* names. * docs(git): capture classified change-plan review screenshots Replace the old Monaco pull-preview images with the classified operation list used by Apply. * fix(git): treat invocation drift as reviewable, not a file conflict A live Compose command-line change is not a managed-file conflict. Reviewed apply records the incoming invocation; webhook auto-apply still refuses.	2026-08-14 09:53:31 -04:00
Anso	4c93947004	fix: stop compose-ps spam after deleting a stack (#1831) ... * fix: stop compose-ps spam after deleting a stack A live logs WebSocket kept calling docker compose ps against the removed stack directory every 2s. Missing cwd surfaces as spawn ENOENT, which was logged as Docker CLI unavailable. Skip compose when the dir is gone and idle the log stream instead of retrying. * fix: contain stack directory stats inside the compose root Resolve the stack path against the node's compose directory and refuse paths that escape it before calling fs.stat, matching the existing filesystem containment pattern at other sinks.	2026-08-14 09:24:48 -04:00
dependabot[bot]	6a610562a2	chore(deps): bump the all-actions group across 1 directory with 5 updates (#1826) ... Bumps the all-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | Updates `github/codeql-action/init` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/autobuild` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-13 15:51:19 -04:00
dependabot[bot]	6a40f0ff3d	chore(deps): bump the all-npm-backend group in /backend with 9 updates (#1825) ... Bumps the all-npm-backend group in /backend with 9 updates: | Package | From | To | | --- | --- | --- | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.1` | `8.6.2` | | [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.40.0` | `1.41.0` | | [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` | | [@aws-sdk/client-ecr](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr) | `3.1101.0` | `3.1106.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1101.0` | `3.1106.0` | Updates `better-sqlite3` from 13.0.2 to 13.0.3 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](https://github.com/WiseLibs/better-sqlite3/compare/v13.0.2...v13.0.3) Updates `express-rate-limit` from 8.6.1 to 8.6.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.6.1...v8.6.2) Updates `isomorphic-git` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases) - [Commits](https://github.com/isomorphic-git/isomorphic-git/compare/v1.40.0...v1.41.0) Updates `ws` from 8.21.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/8.21.1...8.21.3) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.8.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1) Updates `typescript-eslint` from 8.65.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint) Updates `@aws-sdk/client-ecr` from 3.1101.0 to 3.1106.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1106.0/clients/client-ecr) Updates `@aws-sdk/client-s3` from 3.1101.0 to 3.1106.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1106.0/clients/client-s3) --- updated-dependencies: - dependency-name: better-sqlite3 dependency-version: 13.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: express-rate-limit dependency-version: 8.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: isomorphic-git dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: ws dependency-version: 8.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-backend - dependency-name: typescript-eslint dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: "@aws-sdk/client-ecr" dependency-version: 3.1106.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1106.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-backend ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-13 15:51:08 -04:00
dependabot[bot]	64f4363355	chore(deps): bump the all-npm-frontend group in /frontend with 8 updates (#1824) ... Bumps the all-npm-frontend group in /frontend with 8 updates: | Package | From | To | | --- | --- | --- | | [@dagrejs/dagre](https://github.com/dagrejs/dagre) | `3.1.0` | `3.1.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.31.0` | | [motion](https://github.com/motiondivision/motion) | `12.43.0` | `13.0.0` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.1` | Updates `@dagrejs/dagre` from 3.1.0 to 3.1.1 - [Release notes](https://github.com/dagrejs/dagre/releases) - [Changelog](https://github.com/dagrejs/dagre/blob/master/changelog.md) - [Commits](https://github.com/dagrejs/dagre/compare/v3.1.0...v3.1.1) Updates `lucide-react` from 1.28.0 to 1.31.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react) Updates `motion` from 12.43.0 to 13.0.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.43.0...v13.0.0) Updates `@testing-library/user-event` from 14.6.1 to 14.6.3 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.3) Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.8.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1) Updates `typescript-eslint` from 8.65.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint) Updates `vite` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite) --- updated-dependencies: - dependency-name: "@dagrejs/dagre" dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: motion dependency-version: 13.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-npm-frontend - dependency-name: "@testing-library/user-event" dependency-version: 14.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: typescript-eslint dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-13 15:50:57 -04:00
dependabot[bot]	4579f28c87	chore(deps): bump node from e88a35b to aadf416 (#1823) ... Bumps node from `e88a35b` to `aadf416`. --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-13 15:50:46 -04:00
Anso	cb1f6b1166	fix(security): refresh overview when image-update checks toggle (#1827) ... Security Overview kept a stale Check again affordance after toggling image-update checks because it ignored the settings event and could reuse a cached overview GET.	2026-08-13 14:10:53 -04:00
Anso	93a5ba9f21	fix(editor): dispose compose DiffEditor models after widget reset (#1828) ... Closing the compose or git diff dialog threw a Monaco console error because the library disposed TextModels while DiffEditorWidget still held them.	2026-08-13 10:32:26 -04:00
Anso	f5178889eb	feat(recovery): complete authored-project atomic rollback generations (#1819) ... * feat(recovery): capture complete authored Compose project for atomic rollback Replace the root-compose-only backup slot with staged recovery generations that record the managed inventory, exact Compose invocation, and prior image identity, and wire the same engine through deploy, update, manual rollback, and Git apply. * fix(recovery): satisfy CodeQL path barriers and update-guard mock Inline resolve+startsWith checks at generation/inventory fs sinks and stub getCurrentStackUpdateRecovery in UpdateGuardService tests. * fix(recovery): drop unused FileSystemService import in generation store test * fix(recovery): harden authored-project rollback for upgrade and restore safety Preserve legacy UUID backup rows, restore Git deploy state with files, make multi-file restore recoverable, evaluate policy on the restored target, and fail closed when Git capture cannot cover an apply. * fix(recovery): unblock Git apply unit tests and CodeQL pre-restore TOCTOU Mock recovery capture in git-source-service tests after fail-closed apply capture, and re-resolve live paths immediately before pre-restore snapshot reads. * fix(recovery): fall back to authored inventory when Git manifesto is missing First Git apply captures before promote, so a missing managed-project manifesto must not block rollback capture when the live stack already has authored files. * fix(recovery): make authored-project rollback atomic across Git state Restore the managed-project manifesto with files, keep nullable Git identity on first-apply captures, persist Git side-state in restore intents for startup reconcile, compensate legacy materialize failures, and refuse directory collisions before mutation. * fix(recovery): satisfy CodeQL path and TOCTOU barriers on manifesto restore Add inline resolve barriers for manifesto read/clear sinks and remove the access-then-read race when restoring a generation manifesto snapshot. * fix(recovery): close third-audit rollback generation blockers Fail closed on incomplete Git inventory fallbacks, execute captured Compose invocation during recovery, refuse startup and mutations while restore intents remain unresolved, propagate legacy stale-delete failures, and add Docker-level exact prior-image coverage plus regression tests. * fix(recovery): mark acquired before handoff in prior-image Docker test Match the production updateStack CAS sequence so the exact prior-image integration test does not fail handoff from the captured phase. * fix(recovery): close fourth-audit rollback safety blockers Evaluate policy against held images, use index-based pre-restore snapshots, hold the shared stack lock across Git apply, replay Mesh and empty captured invocations exactly, restore POSIX modes with fail-closed sensitive permissions, keep case-sensitive paths, and link Git auto-deploy health gates. Add regression coverage for these cases. * test(recovery): fix mocks for health-gate link and authored compose args Add linkGateOrRetain to the Git apply recovery mock, and mock authoredComposeArgs so the case-collision inventory test is not masked by a missing getComposeDir stub. * fix(recovery): close fifth-audit rollback safety blockers Share git_apply locking for webhook auto-apply, fail closed on malformed recovery service records, refuse mixed-image capture, and require exact probe counts with hold-tag eligibility checks. * fix(recovery): close sixth-audit rollback safety blockers Preserve the legacy backup slot during generation capture, encrypt sensitive pre-restore snapshots, revert files on a failed health probe without committing Git, fail closed when an absent-file revert would delete a directory, skip Compose one-offs, route manual and scheduled backup through the current generation, and persist runtime image platform identity. * fix(recovery): close seventh-audit rollback safety blockers Fleet snapshot restore and restore-all now capture a recovery generation under the stack lock before any authored file write, including on remote nodes. * fix(recovery): keep pre-deploy generations during health-gate observe Link deploy recovery generations to the observing gate so backup cannot replace them mid-observe. Distinguish missing hold tags from probe failures, refuse generation release when services metadata is corrupt, classify mixed-replica and coverage refusals, and toast the backend rollback message. * fix(recovery): wrap webhook deploy case for eslint const bindings in an unbraced switch case trip no-case-declarations. Match the pull case block.	2026-08-13 03:48:09 -04:00
Anso	6d57147330	fix: bump golang.org/x/net to v0.56.0 in Docker CLI and Compose builds (#1829) ... CVE-2026-46600 (dnsmessage denial of service) affects the transitive x/net dependency in both the docker CLI and docker-compose binaries bundled into the image.	2026-08-12 19:20:37 -04:00
Anso	2d35013671	fix(pilot): preserve tunnel JWT across upgrade 401 reconnects (#1818) ... Stop deleting pilot.jwt on any WebSocket 401 and falling back to an already-consumed enroll token. Attempt enroll recovery only on upgrade 401/404 when SENCHO_ENROLL_TOKEN is still fresh, restore the in-memory tunnel credential if that attempt fails, and surface a clear re-enrollment prompt instead of looping silently. Closes #1817	2026-08-12 15:06:41 -04:00
Anso	fcd44f5693	fix(security): tie fixable CVE posture to image-update evidence (#1815) ... * fix(security): tie fixable CVE posture to image-update evidence Stop treating Trivy fixed_version alone as an Update affected images CTA. Reuse persisted ImageUpdateService status so Security only offers Review update when an applicable image update is confirmed, and otherwise surfaces waiting or uncertain remediation with truthful affordances. * fix(security): move image-update recheck helper out of OverviewTab Satisfy react-refresh/only-export-components so Frontend lint passes. * fix(security): preserve posture reason image targets in Images drill-down Carry affected image refs on overview reasons so public exposure and related CTAs open a clearable targeted Images list instead of an unfiltered hunt. * fix(security): attach Networking exposure intent to posture targets Preserve stack/service context and intentional classification on network-exposed Security reasons without suppressing risk or claiming Internet reachability. * fix(security): persist Images exposure intent and triage scope Standing image summaries carry Networking intent context with cap-safe aggregates, Anatomy Networking links, and scan-sheet triage that defaults to the current image. * fix(security): clear CI lint errors for exposure helpers * fix(security): stop intentional exposure from forcing Action needed Separate exposure fact, intent correctness, and vulnerability drivers so package fixed_version cannot recreate a permanent public_exposure blocker. * fix(security): define Monitoring residual-risk narrative * fix(security): define Secure via residual Crit/High triage Replace triage-blind raw Crit/High Secure gating with residual material risk so accepted and ignored stay Monitoring, while not_affected, false positive, and fixed can clear residual without claiming no detections. * fix(security): exclude rollback-hold images from Security scans Hold-only sencho-rb tags are recovery state; keep them out of Trivy node scans, Security inventory, and Overview posture while dual-tagged images remain under their registry tag. * fix(security): keep authoritative no-update rows after preview Opening a stack page must not delete ok+false stack_update_status evidence; Security treats a missing row as uncertain and would flip waiting-upstream to unknown.	2026-08-12 15:02:14 -04:00
Anso	c47b8eb8e9	perf(frontend): overlap stack list and status hydration requests (#1820) ... * perf(frontend): overlap stack list and status hydration requests Fire /stacks and /stacks/statuses concurrently while committing the list first, so list_visible stays progressive and statuses overlap the list fetch instead of serializing behind it. The visible list now renders as soon as it commits (isLoading clears at list commit, not at status completion), and an atomic HydrationEvidence record derived at render time fails closed on node switches, list changes, and partial status payloads: lifecycle actions across the sidebar menu, editor toolbar, mobile editor, bulk bar, and deferred dialogs recheck a ref-backed readiness predicate immediately before any mutation. Status payloads are validated (bulk object format with typed fields, legacy string maps with recognized values); the legacy per-stack fallback targets the captured node and tracks coverage, so a total fallback failure escalates to a hard error instead of masquerading as ok. Pending, error, stale, and incomplete hydration states render distinctly in rows, filter chips, and the mobile masthead. Measured on the SEN-531 workload contract (local node, 6 stacks, Dev Mode ON): hydration gap 52.5ms median to 0ms, full hydration ~146ms to ~84-100ms (~42% improvement). 2590 frontend tests, visual regression 12/12, backend tsc clean. * fix(frontend): recheck hydration readiness in deferred lifecycle executors Deferred continuations (pre-deploy advisory proceed, external-network continue, update-readiness proceed, service-update proceed) dispatched against the node captured when the dialog opened, without rechecking readiness at the actual mutation boundary. A dialog opened on node A could therefore mutate node A after the operator switched to node B. Each executor now rechecks the ref-backed readiness predicate before starting any operation, releasing the pending deploy guard and surfacing a toast when blocked. Plain Save stays independent of status readiness (mobile editor and diff-preview plain-save mode are no longer gated); only Save & Deploy / Save & Reapply requires authoritative runtime evidence. Adds two-node delayed-response tests proving late prior-node list and status results cannot replace the current node's files, statuses, evidence, or loading ownership, plus deferred readiness-loss regression tests for the update and service-update dialogs. * fix(frontend): bind deferred executor readiness to the captured node The previous readiness rechecks validated the CURRENT node, but deferred continuations (pre-deploy advisory proceed, external-network continue, update-readiness proceed, service-update proceed) still dispatched with the node captured when the dialog opened. A dialog opened on node A could mutate node A after the operator switched to node B and B finished hydrating. The executor-boundary predicate now also requires the captured operation node to equal the current active node (effect-updated ref), so a fully-hydrated node switch still blocks the stale continuation. Adds ready-after-switch regression tests for the deploy continuation, stack update, and service update (switch to node B, hydrate, invoke the stored proceed, assert no operation session starts), plus focused plain Save vs Save & Deploy tests for the mobile editor and the diff preview. Restores the unrelated frontend lockfile metadata drift. * fix(frontend): guard external-network creation and reactive retry by node ownership The missing-external-networks dialog's createAndContinue posted network creation requests to the captured node before any ownership check, and the reactive 409 retry callback started a deploy directly without the executor guard. A dialog opened on node A could create Docker networks or deploy on node A after the operator switched to node B. Both paths now recheck hydrationReadyForNode before any mutation: the proactive dialog closes with the pending guard released and a toast when blocked, and the reactive retry refuses to start an operation session. Adds ready-after-switch regression tests for both flows asserting no /system/networks POST and no operation session after a switch to a fully hydrated node B. * fix(frontend): bind policy bypass, delete, and take-down confirmations to their opening node Three deferred confirmation paths remained unsafe across node switches: the policy-bypass retry validated current readiness but dispatched to the policy block's captured node; Delete and Take Down dialogs stored only a stack name and derived the operation node live at confirmation time, so a dialog opened on node A would mutate node B's same-named stack after a switch. Delete and Take Down targets now carry the opening node id in the overlay state (deleteTarget / takeDownTarget), and their confirm handlers verify hydrationReadyForNode against that id before mutating. The policy-bypass retry uses the same predicate against the block's captured node. The reactive 409 regression test now reaches the reactive path: the proactive preflight reports no missing networks, the deploy POST returns the 409, and the reactive refetch opens the dialog, after which an ownership change during network creation blocks the retried deploy. Also restores the unrelated frontend lockfile drift again. * fix(frontend): validate legacy fallback payloads and target stale refreshes at the current node The legacy per-stack fallback counted any successfully decoded JSON body as authoritative coverage, including a 200 non-array body or an array with malformed entries, which could authorize lifecycle actions on non-authoritative evidence. The fallback now requires a container array whose entries satisfy the minimal container shape; malformed responses fail closed and contribute zero coverage. A refreshStacks callback captured on node A and invoked after the operator switched to node B mixed a live list request (localStorage target) with node A statuses and evidence. refreshStacks now reads the current node from its render-synchronous ref, and the list request is targeted explicitly so both requests always share one authoritative node. Adds malformed-fallback regressions (non-array, malformed-array, partial-invalid) and a stale-callback-after-switch test asserting both requests target the current node and its state stays authoritative.	2026-08-12 11:54:29 -04:00
Anso	866d784316	feat(notifications): customizable per-channel JSON payload templates (#1805) ... Add an optional Edit Payload editor to every notification channel (Discord, Slack, Webhook, Apprise, ntfy). A saved template replaces the built-in payload for that channel, with {{level}}, {{message}}, {{category}}, {{timestamp}}, {{stack_name}}, and {{actor}} substituted as JSON-escaped values (variables may stand alone or be mixed into strings). Templates are validated on save: known variables only, no unterminated tokens, valid JSON after substitution, 8000 characters max. Apprise keeps urls/tag managed by the channel fields and merges them server-side at dispatch. ntfy publishes JSON instead of plain text when templated. Test dispatch uses the editor template.	2026-08-11 10:25:29 -04:00
Anso	578ce7684d	feat(git): complete-project materialization with a managed-project manifest (#1786) ... * feat(git): add managed-project manifest types and DB cache columns Introduces the canonical managed-project manifest contract types (schema v1) and the stack_git_sources cache columns manifest_version / manifest_state / manifest_generation. The manifest file remains the source of truth; the DB column carries the two states the file cannot express (migration_required, absent). * feat(git): add vendored Docker .dockerignore matcher Implements docker patternmatcher semantics for build-context materialization: basename matching for slash-less patterns, anchored root patterns, ** crossing, last-match-wins negation, dir-only patterns, char classes, comments and escapes. Table-driven tests cover the full rule set. * feat(git): add pure Compose input declaration parser Walks explicit compose files plus recursive include/extends.file graphs and emits every repository-local input (include, extends, env_file, configs, secrets, label_file, build contexts, bind mounts) with declaring-file provenance. Side-effect free: file contents are injected via a read callback. Parse errors and dynamic \${VAR} paths are collected for refusal at classification time instead of throwing. * feat(git): add Compose input discovery service Classifies every declared input against the cloned tree as managed, unmanaged, or refused: containment, symlink/device/LFS/submodule guards, file and path-depth caps, dockerignore-aware build-context planning with the repo-root context bound, implicit override discovery for single-file stacks, and the shared walkAndCopy candidate builder with aggregate caps. * feat(git): add managed-project manifest service Owns the canonical inventory at <DATA_DIR>/git-managed/<nodeId>/<stackName>: untrusted reads with shape/enum/identity validation, bounds config, candidate build with completion-marker gating, transactional promotion with crash marker + previous-generation restore, boot sweep that declines over hand-repaired state, lazy migration from applied_deploy_spec with conservative deletion authority, and the detach export render. * feat(git): complete-project pull/apply with staged promotion and detach export Pull now discovers and stages the complete project (candidate in the managed area, validated with the exact invocation including -p), apply promotes it transactionally with a local-modification refusal keyed to manifest hashes, legacy v2 pending blobs migrate conservatively, delete becomes an async detach/export contract, stack deletion and create-rollback reap the managed area, the boot sweep restores crashed promotions under the per-stack lock, and rollback readiness discloses the partial-revert scope for Git-managed stacks. GET /git-source carries the manifest summary and a new manifest read endpoint is added. * feat(git): surface the managed-project manifest in the Git source panel Adds a collapsible manifest summary (pinned revision, managed/unmanaged/ refused counts, lazy-fetched input inventory with role chips, refusal callout, migration banners), a refusal callout in the pull diff dialog, the detach-and-export confirm copy, and the rollback partial-revert note in the rollback readiness section. * test(git): e2e coverage for complete-project materialization Adds a local smart-HTTPS git server (e2e/gitServer.helper.ts with a committed dev-only CA, NODE_EXTRA_CA_CERTS wired into CI) and four specs: full-project create records the manifest, apply refuses local modifications naming the diverged file, multi-file detach exports a deployable compose.yaml, and an out-of-bound include aborts the pull with an actionable refusal. * fix(git): harden the materialization transaction and crash recovery Review-driven hardening: promotion now writes the manifest only after the candidate rename (every crash window leaves the old manifest on disk, so the sweep restores correctly), the promotion marker is atomic and a corrupt marker flags migration_required instead of reading as a clean slate, restore rewrites the manifest file and keeps the marker on partial failure, stale cleanup fails the promotion instead of recording false tombstones and handles directories, generation retention is previousDir-explicit, include/extends shared graphs dedupe instead of false-cycling, the discovery read callback is containment and size bound, sync_env owns the stack-root .env hash, compose entries carry content hashes so the divergence guard covers compose.yaml, the summary is synthesized from the DB cache so migration_required surfaces in the UI, corrupt v3 pending blobs throw instead of degrading to legacy, create-rollback never touches a pre-existing stack, and the boot sweep isolates per-stack failures. * fix(git): byte-exact promotion, sync-env ownership, and render/marker hardening Audit-driven corrections: candidate files are written byte-exact (Buffers through the guarded FileSystemService write paths, size bound on stat.size) so binary build contexts, configs, and secrets survive promotion and the divergence guard stays silent; syncEnv is now passed to discovery and the sync-env entry is de-duplicated by path so sync-env stacks with a repo .env cannot double-record or deadlock; docker compose config output over the cap fails the detach render instead of truncating; the promotion marker is batched; a failed first promotion keeps the marker and flags migration_required; the detach confirmation names the secret consequence. Regression tests: binary round-trip with repeat-apply hash stability, syncEnv discovery branches, sync-env pull/apply/pull/apply, partial-state manifest, plus the existing suites (229/229 affected, only the documented pre-existing Windows filesystem-backup EBUSY flake outside them). * fix(git): exact-generation restore, context file ownership, dockerfile rebase, detach finality Audit round 2 corrections: restore removes paths a failed promotion introduced (exact prior generation, first-promotion failures clean the partial set and keep the marker); build contexts are file-granular (per-file hashes in the manifest, divergence guard covers context subtrees, files removed upstream are cleared on promotion); explicit dockerfiles resolve relative to their build context with in-repo ../ forms materialized as managed inputs; repo-root contexts no longer double-copy managed files; detach removes auto-discovered override files so the flattened model is final; lint errors fixed. Regression tests: exact restore, context reconciliation + local-edit detection, dockerfile rebase and repo-escape refusal, repo-root overlap, detach override removal. 213/213 affected backend tests. * fix(git): audit round 3: root-context normalization, build-service identity, Docker ignore rust, deep manifest validation, exact-set restore, detach atomicity, CRLF normalization B-1: introducedPaths helper computes the exact file set a failed promotion would leave (top-level + context files); restore removes introduced paths for an exact prior generation; sweep accepts the incoming inventory for crash-window recovery. B-2: repo-root context (build: .) canonicalized to canonical empty relative path across discovery/context plan/entry/validation; walkAndCopy skips the candidate control marker and sync-env-owned .env so root contexts never copy Sencho metadata into the live stack dir. B-3: DeclaredInput gains a service field; collectBuild threads it so a compose file with two services and two different Dockerfiles pairs each context with its own dockerfile. Additional contexts never inherit the service dockerfile. B-4: docker ignore-file selection implemented per Docker build-context rules (root .dockerignore, with Dockerfile-specific <name>.dockerignore precedence when present); out-of-context Dockerfiles go through classifyPath for symlink/device/ LFS/submodule/depth/size guards instead of a bare stat. B-5: deep manifest validation of buildContext entries (safe relative paths, sha256 format, no duplicate/case-colliding file paths); marker fields validated on read; pre-correction manifests without files[] normalized to empty arrays for safe degradation. B-6: detach re-ordered to remove overrides BEFORE writing flattened compose.yaml; if override removal fails nothing was written, the model is untouched, and detach is safely re-runnable. S-1: ComposeService.ts LFs normalized to repository convention. All 213 affected backend tests pass; tsc + lint clean both sides. * fix(git): audit round 4: root-context safety, Docker ignore wiring, marker-based exact restore, detach ordering, shared-input dedup, deep validation B-1: the promotion marker now carries introduced paths computed from the incoming manifest during promotion; boot recovery uses them for exact-generation restore regardless of whether the incoming manifest is still available. `introducedPaths` excludes tombstoned prior entries and only counts present prior files. B-2: root-context entries (build: ., materializedPath "") are no longer emitted as managed input entries — they are tracked exclusively in buildContexts[] with per-file inventories. `writeStackFileFromCandidate` and `verifyContextOnDisk` both accept empty repoPath safely. B-3: Dockerfile-specific .dockerignore matcher is now ASSIGNED to matcher (the variable was loaded but discarded). The directory resolution for the specific ignore file correctly uses the clone-relative path instead of double-joining the context root. B-4: detach now writes the flattened compose.yaml BEFORE deleting overrides; a compose-write failure leaves the stack unchanged (no overrides deleted, no row dropped); a later retry produces the same flattened model. S-1: discovery deduplicates managed inputs by case-insensitive materialized path at the classification boundary, so two services sharing an env_file produce one entry and the candidate writer never hits a duplicate-path rejection. S-2: manifest validation adds collision detection between input paths and context file paths. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 5: root-context collision fix, marker-based recovery, Docker ignore root case, context divergence, detach rollback B-1: root-context files that collided with managed input paths (compose.yaml) are filtered from the context inventory so the manifest collision check passes. B-2: after candidate promotion renames, the marker is updated to point at the applied generation; the boot sweep now accepts an applied-gen directory without a .candidate-complete marker as valid for recovery. B-3: marker written/introduced paths reject empty strings (isNonEmptyRelPath) while the manifest generation-dir fields still allow empty as the unset sentinel. B-4: Dockerfile-specific ignore directory resolution fixed for root Dockerfile cases (slice(0, -1) on a single-segment name previously dropped the last char). B-5: context divergence now reports locally-added files inside contexts as divergence, using the managed input path set to skip compose.yaml/.env/files that have a non-context owner. B-6: detach now snapshots the prior compose.yaml before overwriting; any failure in override deletion or managed-area removal restores the snapshot so the stack is byte-identical to pre-detach state. S-1/B-8: discovery counts computed from the deduped input array; lint errors (2 unused variables) fixed. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 6: root-context promotion, recovery ordering, context-file merge, divergence precision, detach rollback B-1: root-context files now explicitly promoted from the candidate via a context-file loop after the managed-input promotion step. Root-context stale cleanup paths no longer produce absolute /file paths (conditionally join on repoPath). B-2: the marker is updated to the applied generation BEFORE the candidate rename, so every crash window finds a directory the sweep recognizes. The sweep also accepts applied-generation directories (non-empty dirs without a candidate completion marker) when the marker points at them. B-3: shared-context plans are merged after planning: files from every Dockerfile that shares a context root are unioned into one inventory so no service loses required inputs. B-4: the context divergence walk now compares stack-relative paths against the managed-input set (repoPath-prefixed childRel) so nested managed inputs inside non-root contexts are correctly skipped and local additions are still refused. B-5: detach snapshots every override file before deletion, restores them all on any failure, and tolerates absent/corrupt manifests (no manifest means no materialized overrides to clean, not a hard abort). All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 7: root Dockerfile containment, inventory-driven context copy, file-only marker recovery, detach transaction B-1: root-context Dockerfile containment check fixed for root contexts ("" or "."). Any repo-relative Dockerfile without ../ is in-context. B-2: context copy now reads from the plan inventory (plan.context.files) instead of re-walking the source with the first matcher. Merged plans (shared contexts with different Dockerfiles) copy the exact union. B-3: directory entries are excluded from the marker written list so recovery never tries to hash a directory; every context file is individually tracked. Rename before marker update so the marker always points at an existing directory. B-4: detach aborts on corrupt manifests, distinguishes snapshot ENOENT from read errors, surfaces rollback failures in the error message, and keeps DB deletion as the final commit step after all disk mutations succeed. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): sanitize log messages and fix CodeQL log-injection finding The one genuine CodeQL alert (log-injection + format-string at line 1002) is resolved by wrapping stackName with sanitizeForLog(), matching existing precedent in ComposeService.ts and routes/stacks.ts. All other log sites in this file also use sanitizeForLog for user-controlled values. * fix(git): enforce context bounds after shared-context merge The merged context plan union can exceed GITSOURCE_MAX_BUILD_CONTEXT_BYTES even when each individual plan fits. Recheck the cap against the unionized inventory after merging. * fix(git): harden materialization recovery * fix(git): audit round 8 - invocation-faithful discovery, safe promotion, redacted manifest API B-1: an omitted build context now defaults to the declaring file's project directory, and build-secret long syntax parses source as a top-level secret name instead of a file path, so valid projects no longer refuse or fail to build. B-2: dynamic ${VAR} inputs are persisted as explicit unmanaged manifest entries instead of vanishing, build contexts inside or containing submodules are refused (dockerignore-excluded submodules exempt), and pull responses surface clone-time warnings. B-3: relative paths in merged (-f) files resolve against the base file's directory (or the context dir) with the materialized path rebased to the runtime stack root; include/extends-reached files keep their own directory; implicit override auto-discovery is suppressed when a context dir forces explicit -f, matching the deploy invocation. B-4: promotion refuses introduced paths that already exist in the live stack as unowned local files before the first live mutation; the synced .env and fresh-stack creation stay exempt. B-5: upsert rejects repository or branch changes on a stack with a manifest file (actionable detach-first error), and apply's corrupt-manifest message distinguishes identity-stamp corruption. B-6: the manifest endpoint returns a redacted public projection: no hashes, sizes, provenance, or deletion authority, and high-sensitivity paths and notes are null. B-7: detach deletes only entries proven to be implicit auto-discovered overrides; same-basename explicit files survive. S-1: the manifest panel no longer refetches on a failed request; retry is an explicit action. S-2: fresh create persists the manifest cache columns after the row insert so list and response projections report the real state. S-3: git-sources.mdx matches the corrected detach, submodule, and dynamic-path behavior. * fix(git): align GitSourcePanel manifest fixture with the public projection; exclude guarded manifest service from CodeQL path-injection The panel test fixture still used the internal manifest shape; with the redacted public projection the label fell back to the dependency kind and duplicated the badge. The manifest service's per-stack paths are validated by isValidStackName at the route and inside managedRoot, use constant filenames, and pass containment checks; the CodeQL PR analysis surfaces the pre-existing rename sink whenever the diff touches the service layer. * fix(git): restore ComposeService.ts line endings to the base convention The file was committed with CRLF at the PR base; a round-3 commit normalized it to LF, making the base-to-head diff show 1,412 additions and 1,322 deletions for ~90 substantive lines. Restoring CRLF collapses the diff to the functional changes only. * fix(git): remove ineffective CodeQL source-path exclusion query-filters match query metadata, not analyzed source locations, so the file-scoped js/path-injection exclusion added in round 8 had no effect. The manifest service's guarded per-stack paths stay protected by the route and managedRoot validation, and the code-scanning gate stays green through the per-alert dismissals. * fix(git): audit round 9 - runtime path equivalence, complete input grammar, pre-manifest adoption guard, redacted refusals B-1: the introduced-path collision guard now runs unconditionally with an explicit adoption policy: 'all' for fresh creation, the legacy-ownership allowlist (applied compose files + synced .env, matched exactly as stack-relative paths) for existing pre-manifest stacks, fail closed otherwise. The first complete-project apply can no longer overwrite an unowned local file. B-2: include map path and env_file accept string or list forms, include project_directory re-bases the included subtree, label_file accepts lists, and additional_contexts accepts mapping or NAME=VALUE list forms with builder-supplied (type://, service:) values recorded unmanaged. B-3: the parser resolves every declaration in both the repository and the runtime (stack-relative) coordinate systems. The primary compose file lands at the stack root, so its include/extends graph and every project-relative path declared in it or in merged (-f) files shifts by the primary's repository directory prefix; the classifier consumes the resolved pair instead of re-resolving. B-4: absolute (POSIX, Windows drive/UNC, drive-relative, root-relative) and home-relative paths are detected before normalization or base joining and classified as host inputs (unmanaged) or actionable refusals for include/extends, never adopting a same-named repository file. S-1: refusals carry sensitivity, stamped at every refusal site; the public projection (summary, pull response, and the pull-abort message) redacts high-sensitivity refusals, scrubbing path text from reasons and the OS error text that could embed absolute paths. Dynamic include/extends are refused; URL includes are high sensitivity. S-3: ComposeService.ts line endings restored (separate commit). S-2: invalid CodeQL source-path filter removed (separate commit). * chore: bump nanoid to 3.3.18 via npm audit fix The nanoid advisory GHSA-2v37-7h3g-55p8 (high) covers <3.3.17 and was published after the last green CI run; both lockfiles pinned 3.3.16. npm audit fix bumps the transitive dependency to 3.3.18. * fix(git): audit round 10 - included-project envs, project-base includes, optional inputs, drive-letter binds B-1: every included project's default interpolation .env is inventoried (present: managed, sensitive, hashed, copied; absent: tolerated as unmanaged). interpolation: false and same-base includes skip the entry. B-2: include, include-env, and extends.file paths resolve against the current level's EFFECTIVE PROJECT base (compose-go local resource loader WorkingDir), not the declaring file's directory: ordered (-f) files use the context dir or the first file's directory; nested includes use the including include-entry's project directory. Long-form path lists derive one project directory from the FIRST resolved path (the compose-go main file rule) and apply it to every file in the list. Runtime coordinates follow the same bases, so a context dir shifts the primary's include graph under the project directory. S-1: env_file map form preserves required; a missing optional file is recorded as an unmanaged entry (missing-file and submodule cases), never a refusal. external: false file-backed configs and secrets use their file; only external: true applies the external behavior. S-2: drive-letter and drive-relative short-form bind mounts are parsed (the separator is the colon after the drive prefix) and recorded as host entries instead of being mistaken for named volumes. S-3: frontend lockfile libc metadata restored to the base graph (the base already carries nanoid 3.3.18). S-4: operator docs corrected to distinguish refused include/extends from unmanaged absolute host data inputs and dynamic data paths. * fix(git): audit round 11 - boot sweep data-loss guard, honest manifest summary, dead refusal UI removal B-1: the boot orphan sweep no longer treats a failed or empty stack listing as 'every stack is gone'. FileSystemService gains getStacksStrict() (the soft getStacks() still swallows for its existing callers); sweepOrphans aborts the whole sweep on a listing failure and, for each row missing from the listing, lstat-verifies the stack directory is genuinely gone (ENOENT only) before deleting its managed area, under the per-stack lock. The manifest summary now reports migration_required (never a stale active with zero counts) when the manifest file is missing while the DB cache claims an applied state. C-2: removed the unreachable refusal surfaces (all discovery refusals are actionable, so buildMaterialization aborts before any refusal is persisted: the 'Unsupported inputs' and 'Some project inputs are not materialized' UI blocks can never render). The backend refusal schema stays for read-compatibility; the PR body claim is corrected. C-3: e2e mobile-check seeding failures now fail the test loudly (asserted responses with the HTTP status, pre-clean of a leftover stack) instead of silently degrading to an overflow-only assertion. * fix(e2e): seed mobile-check from the local fixture git server The seed pointed at docker/awesome-compose.git with compose_paths ['compose.yaml'], but that repository has no root compose.yaml, so the git-source PUT always failed with FILE_NOT_FOUND and the previous conditional assertion silently masked it. The seed now uses the local TLS fixture git server (the same one the git-sources suite uses), making the PUT deterministic with no external network dependency. * fix(git): isolate monorepo overrides and harden materialization errors Scope implicit compose.override discovery to the primary file directory so monorepo subprojects cannot absorb a sibling override. Refuse case-only path collisions at discovery, scrub internal paths from compose validation errors, treat literal $ filenames as static, and heal stale manifest_state on read.	2026-08-10 17:12:55 -04:00
Anso	017ac57654	perf(frontend): coalesce concurrent stack statuses fetches (#1816) ... * perf(frontend): coalesce concurrent stack statuses fetches Sidebar and dashboard both requested GET /stacks/statuses for the same node; share one in-flight promise keyed by explicit nodeId so boot and invalidate overlap stop doubling the hot path. * fix(frontend): clear statuses coalescer by entry id Avoid Promise identity checks that CodeQL flags as missing await. Numeric entry ids still protect a newer in-flight fetch after logout clear.	2026-08-10 14:57:17 -04:00
Anso	27fe0ae837	fix(auth): honor SSO-only CLI recovery without restart (#1810)	2026-08-09 23:48:44 -04:00
Anso	55ca82abb2	perf(statuses): align stack-status cache TTL and invalidation with polling (#1814) ... The 3s stack-statuses cache TTL never survived the 10s dashboard poll, so every ordinary poll recomputed. Raise the TTL to 15s and move the git-source label and self-identity enrichment inside the cached payload so cache hits serve fully decorated statuses with zero per-request work. Invalidation closes the gaps the longer TTL would otherwise widen: - DockerEventService drops stack-statuses:<nodeId> on container state events so the UI's state-invalidate refetch recomputes instead of hitting a stale entry. The narrow key only: container events do not reshape stack identity or file roots, and the stats key self-refreshes on its own 2s TTL. - git-source link and unlink invalidate node caches before responding, so the source label stays fresh without waiting for the TTL. - a payload whose enrichment degraded (identity probe failure or git-source scan failure) is never cached, so a mislabeled not-self or 'local' badge cannot persist for a full TTL window. Running outside Docker is not degradation, so host installs cache normally.	2026-08-09 23:13:59 -04:00
Anso	9798700401	feat(resources): add search, filters, and sort to Rollback generations (#1788) ... Collapsible search, All/Current/Superseded filter pills matching Images/Volumes, sortable columns defaulting to newest-first, and move the long help copy behind an info tooltip.	2026-08-09 20:45:29 -04:00
Anso	e9901aa24b	fix(whats-new): add RBAC entry and a zoomable screenshot lightbox (#1806) ... RBAC is the largest capability change in this release, so it leads the list. Every entry's screenshot now opens full-viewport on click; the overlay is portaled to document.body so it isn't capped at the modal's own frame, dismissible via backdrop click, a close button, or Escape.	2026-08-09 19:24:23 -04:00
Anso	88fc5470e8	fix(hydration-timing): report list hydration relative to the foreground attempt (#1813) ... The headline listVisibleMs was boot-relative, so a navigation or node switch minutes after boot reported page age as the foreground hydration duration. The developer-mode report now distinguishes boot-, node-session-, and attempt-relative durations (schema v2), the collapsed chip shows the attempt-relative foreground value with its anchor, and superseded, aborted, or failed attempts can never become the reported success. The report schema bumps to v2 with explicit anchors: bootAgeMs and the boot->auth/nodes/shell durations, sessionAgeMs and session-relative list visible/hydrated, and lastAttempt* fields resolved from the newest committed list_visible event in the active node session (event-derived, so a later stack-detail attempt cannot steal the headline). listVisibleMs is retained as the raw boot-relative compatibility field. The repeatable performance baseline scenario matrix is documented in the local internal docs (docs/internal/performance/hydration-timing-baseline.md); the post-hot-path-fix baseline capture is a follow-up evidence step.	2026-08-09 19:19:00 -04:00
Anso	600367e66c	perf(stacks): remove repeated self-identity discovery from statuses hot path (#1811) ... * perf(stacks): hoist self-stack identity resolution out of statuses enrichment GET /api/stacks/statuses resolved the self-stack identity once per stack on every request, including cache hits. The fallback path in isSelfStack lists every container on the node, so a cache hit still paid N container-list calls. Measured on a Docker-shaped local container with 6 stacks: cache hits took 161-168ms with dockerMs=null; the enrichment alone was ~160ms. Resolve the identity once per request (boot-cached compose project name plus a single container-labels read) and compare stack names against it in the response loop. isSelf semantics are unchanged: project-name match, then labels project match, then working-dir basename match, with the same fail-safe false on identity failure. Also expose an enrichmentMs subspan in the developer-mode timing line so cache-hit cost stays decomposable. Measured after the change in the same environment: cache hits 20-34ms (enrichment ~20-33ms, a single listContainers call), computed 44-59ms. Cache-hit latency improved roughly 5-8x; per-stack Docker identity discovery is eliminated (N calls down to 1). * test(stacks): cover the empty-stacks statuses path The statuses handler skips self-stack identity resolution entirely when a node has no stacks. Pin that branch: an empty response still returns 200 with {} and never resolves identity, so a future refactor cannot silently reintroduce a node-wide container-list call on empty-node polls.	2026-08-09 17:32:45 -04:00
sencho-quartermaster[bot]	4119be6e86	chore(main): release 0.97.1 (#1794) v0.97.1	2026-08-09 00:25:42 -04:00
Anso	12d80c5ca7	fix(resources): exclude rollback-held images from reclaimable figure (#1808) ... The Resources disk footprint and reclaim banner counted rollback-hold images (sencho-rb/*:hold) as reclaimable, but every prune path refuses to remove held images, so the advertised figure exceeded what any prune could actually free. getDiskUsage now supports an opt-in held-image exclusion wired into the docker-df readout and both prune estimate paths, so the banner, the plan, and the result agree. The docs state the exclusion explicitly.	2026-08-09 00:18:33 -04:00
Anso	4aae09db4a	fix(resources): center rollback state badges in their column (#1807) ... The State header and its badges (Current, Superseded, Recovery required) in Resources > Rollback were left-aligned. Add text-center to both the header and the cell so the column reads as a unit, matching the Actions column's header/cell alignment pairing.	2026-08-08 23:23:52 -04:00
Anso	fe003d5c49	fix(whats-new): backfill entries for unannounced 0.97.0 features (#1804) ... * fix(whats-new): backfill entries for unannounced 0.97.0 features entries.json shipped empty in the What's New scaffolding (#1767), so the top-bar icon stayed hidden through the 0.97.0 release despite several notable features going out. Add entries for the ones that read as genuine news: SSO-only auth, itemized fleet prune plans, the Audit Log, Fleet Secrets, ntfy notifications, and the resizable file explorer. * fix(whats-new): add screenshots to the backfilled entries Each entry now carries a screenshot captured live against a running Sencho instance, cropped to the relevant panel. Real usernames, the client IP, and the real ntfy topic were scrubbed before capture.	2026-08-08 17:51:54 -04:00
Anso	0d5ff26a8f	fix(fleet): reject negative or non-finite remote reclaimableBytes in prune estimate (#1803) ... A remote node returning HTTP 200 with a negative reclaimableBytes value passed the typeof-only validation in the fleet prune estimate fan-out and was folded into the per-node sum and the fleet total, silently shrinking the estimate. Extend the invalid-response check to reject non-finite and negative values, matching the existing guard for destructive prune plans. Adds route-level tests covering negative, mixed partial, non-finite (1e999 to Infinity), and zero-valued remote estimates.	2026-08-08 17:47:19 -04:00
Anso	4f30db3abc	fix: truncate long error text in fleet prune estimate per-node rows (#1802) ... Unreachable nodes rendered their error string in a shrink-0 span with no width bound, so a verbose daemon or proxy error pushed the row past the card edge. Bound the error span to 55% and ellipsize, matching the existing pattern in the label-and-stop card; the full message stays available via the row title tooltip.	2026-08-08 17:39:20 -04:00
Anso	5014ad20a6	fix(nodes): return conflict on duplicate rename (#1801) ... * fix(nodes): return conflict on duplicate rename PUT /api/nodes/:id left name uniqueness to the SQLite UNIQUE constraint, so a colliding rename surfaced the raw database error as a 500. Add a pre-flight shape guard and collision check (409, matching POST /) plus a catch remap for the concurrent-rename race. Tests cover collision, same-name, case-sensitivity, blank/null, partial updates, and the remap path. * test(nodes): drop unused variable in case-sensitivity test	2026-08-08 17:33:56 -04:00
Anso	454e647a3c	docs: write Give a Teammate Deploy Access to One Stack tutorial (#1800) ... Adds a new Tutorials entry (not part of the original 14-page batch) covering scoped RBAC permissions: create a Viewer account, grant a Deployer scope on one stack, and verify the boundary from both the teammate's session and the audit log.	2026-08-08 13:12:45 -04:00
Anso	512370e3f4	docs: v1 docs refresh (batch 8) (#1797) ... * docs(rbac): refresh Users panel screenshots to current build Recapture users-list, add-user-form, role-selector, and delete-confirm against the live app so they reflect the current Community RBAC parity UI. Update alt text to match. * docs(sso): refresh SSO settings screenshots and document last-provider lockout guard Screenshots were captured against a stale build; refresh with current UI. Also documents the guard that blocks disabling or removing the last enabled SSO provider while SSO-only mode is active, and corrects the Recovery settings path (Operations, not System). * docs(sso): refresh SSO quickstart screenshots to current build Screenshots were captured against a stale build; recapture the provider overview and the LDAP test-connection failure state against current UI. Page text already matched the implementation, so no content changes. * docs(alerts): refresh Alerts and Notifications for current RBAC and retention behavior Verified every claim against current backend/frontend code and the live app. Corrected two factual errors: stack alert rule add/delete visibility now follows the stack:edit permission (roles renamed since the last refresh, not an admin-only gate), and the notification_history cap is a 500-row per-stack / 1000-row per-node-unattached pair enforced on the monitor's 30-second cleanup pass, not a flat 100-row per-node cap evicted on insert. Added the stack_taken_down category (also part of the built-in bell quieting rule, previously undocumented) and the seven history-only categories that are filterable but never dispatched externally. Noted the two vulnerability-scan retention controls now sharing the Data Retention page, with a cross-link to their own doc. Recaptured all eight screenshots against the production node. * docs(fleet-sync): remove stale Admiral gate claim, refresh replica screenshots Fleet Sync's replication, anchor, and demote mechanics have been free on Community since the paid gates were dropped from sync-status and reset-anchor; the Prerequisites table still claimed the control instance needed Admiral. Also documents the one-click "Reset anchor on peer" recovery banner on Settings -> Nodes, verified live against a real control/replica pair, and replaces all four screenshots with current captures.	2026-08-08 13:12:11 -04:00
Anso	b23c413768	docs: correct webhook and registry tier claims in OpenAPI spec (#1799)	2026-08-08 09:53:54 -04:00
Anso	cc2d215b2d	docs(self-hosting): document Docker socket proxy permission profiles (#1798) ... Adds a "Docker socket proxy" section to self-hosting that maps Sencho features to the Docker Engine API groups a proxy must allow. Three profiles (monitoring / minimum management / full) with literal flag values, a feature-to-API reference table, a keep-disabled list, and the self-update caveat: helpers always mount the host Unix socket, so a TCP-only proxy does not carry update traffic. Also adds a production-hardening checklist item pointing at the section, cross-links from the feature pages whose behavior depends on mutating Docker access (mesh, file explorer, resources, remote updates, stack management, scheduled operations), and a pointer from Compose Doctor's proxy findings to the sizing guidance. Closes #1796	2026-08-08 03:17:56 -04:00
Anso	de7ecee497	docs: tutorials batch 1 (#1656) ... * docs: scaffold Tutorials tab and write enroll-a-remote-node Adds the Tutorials tab to docs.json with 15 stub pages across three groups (Fleet & nodes, Deploy & automate, Secure & integrate), and writes the first full tutorial: enrolling a remote node via Pilot Agent mode, verified end to end against a live control instance and a second host running an existing Jellyfin Compose stack. * docs: write Schedule an Operation tutorial * docs: fix MDX parse error in Schedule an Operation tutorial * docs: write Set Up SSO with Custom OIDC tutorial Registers an OAuth client in a self-hosted identity provider (Keycloak worked example), configures Sencho's Custom OIDC settings, tests the connection, and verifies a real end-to-end login with auto-provisioning from two independent surfaces. * docs: drop unused SSO tutorial screenshot sso-settings-empty.png isn't referenced by the tutorial content. * docs: write Set Up Fleet Federation tutorial Migrates a Blueprint-managed workload from one node to another using pin and cordon, with the confirm-before-mutate rollout in between. Corrects the published feature page's claim that pin requires the global admin role; the code gates cordon and pin identically, scoped to the target node. * docs: write Create and Approve a Blueprint tutorial Covers labeling a target node, authoring a stateless Blueprint, walking through the create-then-approve rollout flow, verifying from the Deployments tab and the audit log, and recovering from a port-conflict deploy failure. Cross-links with Move a Blueprint Deployment to a New Node in both directions. * docs: write Automatically Patch a Stack With an Auto-Update Label tutorial * docs: write Configure Auto-Heal Policies tutorial Adds the full step-by-step content for the Configure Auto-Heal Policies stub: an nginx+redis scenario stack, adding a service-scoped policy, and a live verification that breaks a container's healthcheck, confirms the policy restarts it, and recovers it. * docs: write Set Up Deploy Enforcement tutorial Covers configuring a block-on-deploy scan policy against a stack running a deliberately outdated nginx image, reading the block dialog, and overriding it as an admin with the bypass confirmed in the audit log. Includes a stack-pattern mismatch as the most likely first-time failure. * docs: write Configure Environment Guardrails tutorial Covers the Block deploy on missing required env vars guardrail end to end: deploy a Postgres stack with a required password, enable the guardrail, watch a real update get refused with a named-variable message, fix it, and verify from the Activity and Environment tabs. * docs: write Deploy a Stack Automatically From Your CI Pipeline tutorial * docs: write Catch and Fix a Container That's Drifted From Its Compose File tutorial Covers reading a real Drift finding after an out-of-band container change and resolving it by redeploying through Sencho. * docs: write Connect a Git Source tutorial * docs: write Push a Shared Environment File to Every Node tutorial Writes the Fleet Secrets tutorial: create a bundle, target nodes by label, read the push preview/results, verify via the audit log, and recover from a stack-name typo. Removes the three unwritten placeholder stubs (RBAC, Sencho Mesh, private registries) that had no scheduled content.	2026-08-08 01:49:21 -04:00
Anso	bb98cba1f2	fix(compose-doctor): recognize Docker socket proxy topologies (#1791) ... * fix(compose-doctor): recognize Docker socket proxy topologies Classify dedicated socket proxies separately from direct docker.sock mounts so Doctor no longer recommends adopting a proxy the stack already uses. Closes #1790. * fix(compose-doctor): widen socket proxy detection and flag writable proxy sockets Close the remaining gaps in socket proxy topology handling: a service that points at a proxy through a tcp:// endpoint on its command line (how Traefik and friends do it) now gets the client note, proxy API group flags are read for any truthy value rather than a literal 1, and underscore or dot separated proxy names are recognized. Two cases that previously slipped through now surface: a service classified as a proxy purely by name or image but mounting docker.sock read-write is reported as high, and a proxy on the implicit default network or on a network the rendered model does not describe counts as non-internal. A direct socket mount alongside an existing proxy now names that proxy in its fix. * fix(compose-doctor): require corroboration before a service name classifies a socket proxy A service name is free text the author controls, so on its own it could move a writable docker.sock mount out of the high direct-mount finding. A known proxy image is an artifact identity and still stands alone; a proxy-shaped name now counts only alongside an observable fact, a read-only socket or a scoped API group key. * fix(compose-doctor): tighten socket-proxy detection against live upstream behavior Require proxy API flags to be exactly 1 (matching tecnativa and linuxserver images), count only those enabled flags when classifying a proxy, extract tcp hosts from DOCKER_HOST instead of treating key presence as a proxy client, and correlate each client note to one proxy instance by both name and shared network. Soften the published-port finding so it claims reachability rather than Docker API exposure for unrelated ports.	2026-08-08 01:32:26 -04:00
Anso	5c52ae26eb	fix(rbac): make complete built-in RBAC available on Community (#1793) ... Open all five built-in global roles and stack/node scoped assignments on Community. Remove paid fences from user role create/update, scoped assignment CRUD, permission evaluation, and the Users settings UI. Admiral continues to own extended audit governance, LDAP directory integration, and other organizational assurance features. Built-in scoped RBAC is no longer marketed or enforced as paid-only.	2026-08-07 23:50:53 -04:00
Anso	e084ad424c	fix(sso): forward RFC 9207 iss parameter in OIDC callback (#1785) ... * fix(sso): forward RFC 9207 iss parameter in OIDC callback The Custom OIDC callback only forwarded code and state from the query string to the token exchange, silently dropping the iss parameter that issuer-identification-aware providers (Keycloak 22+, and others) add to the redirect. openid-client rejects the exchange as an invalid response once discovery advertises support for that parameter, so login failed for any such provider. * fix(sso): forward RFC 9207 iss parameter in OIDC callback The Custom OIDC callback only forwarded code and state from the query string to the token exchange, silently dropping the iss parameter that issuer-identification-aware providers add to the redirect. openid-client rejects the exchange as an invalid response once discovery advertises support for that parameter (confirmed on Keycloak 26), so login failed for any such provider. Also logs the underlying openid-client error cause on callback failure instead of only the generic message it collapses specific validation errors into, since that cause carries the actual diagnosis. * refactor(sso): dedupe iss-forwarding test setup Extracts the shared callback-with-stubbed-service setup used by both new regression tests into one helper.	2026-08-07 23:04:27 -04:00
Anso	89b16b97d1	chore: bump nanoid via npm audit fix (#1795) ... Resolves GHSA-2v37-7h3g-55p8 (nanoid custom generators can loop indefinitely when size is zero), a newly published advisory for nanoid <3.3.17. Transitive dev dependency of postcss (via vite) in both packages: - backend: nanoid 3.3.16 -> 3.3.18 - frontend: nanoid 3.3.16 -> 3.3.18 npm audit --audit-level=high now passes clean on both packages.	2026-08-07 20:14:24 -04:00