381 Commits

Author	SHA1	Message	Date
Anso	cf618dd866	feat(mesh): symmetric WS dial for proxy-mode mesh peers (#1066) ... * chore(mesh): foundation for symmetric callback dial Adds the data-plane scaffolding that the symmetric callback dial fix builds on: - mesh_centrals table for peer-side bootstrap material - MeshCentralRegistry service (upsert/getActive/clear/markUsed/markRejected) - PilotTunnelManager kind discriminator and replaceOrRegisterProxyBridge - mesh_proxy_callback_bootstrap capability registration - MeshProxyTunnelDialer reason-tagged proxy-bridge-down events from a single tearDownBridge emission point - Reactive redial scheduler that skips idle and auth_failed reasons * feat(mesh): add reverse-direction activity log entries (closes R1-B) acceptReverseLocal now emits route.resolve.ok with direction=reverse on connect ack and route.resolve.fail with direction=reverse plus reason=container_not_found / connect_error pre-connect. Post-connect close/error stays silent. Reuses existing event types via the new details.direction discriminator so frontend filters are unaffected. * feat(mesh): add peer-to-central callback dial path (closes R1-A2) Closes the architectural gap where proxy-mode mesh peers could not re-establish their tunnel to central after any non-idle bridge teardown (idle close, network blip, central restart, peer reboot). Central remains the hub for the data plane; the change is purely about WS initiation. Symmetric WS initiation, asymmetric protocol roles. Central retains PilotTunnelBridge ownership; peer retains TcpStreamSwitchboard + reverseDialer ownership. Central bootstraps callback credentials over the first authenticated central-initiated mesh tunnel via a one-shot mesh_handshake JSON frame; peer persists the material in a new mesh_centrals SQLite table and dials central's new /api/mesh/proxy-tunnel-from-peer endpoint when local cross-node traffic needs a bridge and none is live. Mesh_tunnel JWT (HS256, signed with auth_jwt_secret) carries scope, audience, issuer (central instance id), peer api_token fingerprint, kid. Validation on inbound peer dial: algorithm pin, signature, scope, audience, instance, time bounds, node existence and mode, fingerprint match. Failures return HTTP 401 with a machine-readable reason; peer routes the response per a clear-vs-keep cache matrix. Triggers proactive bootstrap on mesh-enable and api_token rotation; central startup fans out to mesh-enabled proxy-mode nodes with mesh_stacks rows (throttled, fire-and-forget). Reactive redial on non-idle bridge loss. Capability-gated handshake send (mesh_proxy_callback_bootstrap) makes the upgrade path safe against older peers in mixed-version fleets. Adds peer-side /api/system/pilot-tunnels centralCallback diag block, bounded counter metrics for bootstrap and dial events. SENCHO_PRIMARY_URL preflight warning when unset on a central with mesh-enabled proxy nodes. Tested with unit suites for the validation chain, registry, manager, and both dialers; integration tests for bootstrap E2E (asserts protocol-role invariant), api_token rotation, instance id change, version skew, and pilot-mode regression. * fix(mesh): green CI on the symmetric callback branch Two independent CI failures, both surgical: 1. Backend tests (11 fails): four mesh test files called setupTestDb in beforeEach. setupTestDb does not reset the DatabaseService singleton, so the per-test afterEach rm of the previous tmpdir left the singleton connection pointing at a deleted file. The next beforeEach's line-55 write threw SQLITE_READONLY_DBMOVED on Linux. Windows file-lock semantics hid this locally. Hoist setupTestDb / cleanupTestDb to file-scope beforeAll / afterAll; per-test state resets stay in beforeEach. Matches the convention in the eight mesh test files that already pass. 2. CodeQL (4 high alerts): js/insufficient-password-hash flagged sha256(api_token) at four sites. The api_token is a 256-bit opaque bearer (sen_sk_-prefixed), not a human password; sha256 is the correct fingerprint primitive for binding the mesh_tunnel JWT to a specific token. Add the two production files plus the two test files that mint the fingerprint to the existing path-scoped query-filter for that rule. * fix(mesh): drop unused afterEach import and revert dead codeql config ESLint flagged afterEach as unused in mesh-central-registry.test.ts:1 after the previous commit hoisted setup/teardown to file-scope beforeAll/afterAll. Remove from the vitest import line. Revert the codeql-config.yml additions from the previous commit. The paths: sub-key under query-filters > exclude is not a documented CodeQL feature and silently no-ops. The four js/insufficient-password-hash alerts on api_token fingerprinting are tracked as dismissed false positives in the GitHub Security tab rather than via dead config.	2026-05-16 14:58:19 -04:00
Anso	16774ae515	feat(fleet): add node management actions to Fleet Overview (#1064) ... * refactor(nodes): extract node create/edit/delete modals into useNodeActions hook Pulls the inline Add/Edit/Delete/Pilot-enrollment modal stack out of NodeManager.tsx and into a reusable useNodeActions() hook in components/nodes/. Settings continues to consume the same modals via this hook, with an onTestResult callback used by Settings to render the existing connection-detail panel after a successful test. The hook also extends the auto-test-on-save behavior so that saving a proxy-mode remote node from the Edit dialog re-runs the connection test when the API URL or token has actually changed (skipped when only name or compose dir was edited). * feat(fleet): surface Add/Edit/Delete node actions on Fleet Overview Adds an admin-only Add node button to the right of Refresh on the Fleet header, opening the same Add Node dialog used by Settings. Each node card's three-dot menu now exposes Edit node and Delete node items (routed through the shared useNodeActions hook) alongside the existing Cordon item, so operators can manage node lifecycle without leaving the Fleet page. The card kebab is shown to admins regardless of tier; Cordon stays Admiral-only. Delete is hidden on the local default node. After any Add/Edit/Delete the Fleet overview refetches so the grid reflects the change immediately. * docs(fleet): document Add/Edit/Delete node actions on Fleet Overview Updates the Action buttons table to cover the new Add node entry point on the Fleet header, and adds a new Node actions menu section describing the per-card Edit/Delete/Cordon items, their tier and permission gating, and the auto connection test that fires after saving a proxy-mode remote.	2026-05-15 19:54:23 -04:00
Anso	d882f223f4	feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062) ... * feat(api-tokens): switch to sen_sk_ prefixed opaque keys Replace JWT-shaped API tokens with 56-char opaque keys of the form `sen_sk_<43-char base62 random><6-char base62 checksum>` (256-bit entropy, sha256-truncated checksum). Node-proxy tokens stay JWTs. Why: * The api_token path was already a sha256 DB lookup; the JWT signature was wasted work and the 400d JWT ceiling vs DB expires_at was a confusing dual bound. * Opaque tokens carry a verifiable checksum so malformed/typoed values are rejected before any SQLite lookup. * `sen_sk_` prefix is recognizable to GitHub, TruffleHog, GitGuardian and makes the on-wire shape visually distinct from node_proxy JWTs. Changes: * New `utils/apiTokenFormat.ts` (generate + checksum-verify, CSPRNG via randomInt, timingSafeEqual on the checksum compare). * `middleware/auth.ts` and `websocket/upgradeHandler.ts` route opaque tokens before any jwt.verify; 401 messages unified to avoid a token-existence oracle. * `middleware/rateLimiters.ts` short-circuits opaque tokens in the node_proxy detection and keys per-token via a non-reversible sha256 slice so each token keeps its own bucket without a DB hit. * All six existing tests migrated from jwt.sign({scope:'api_token'}) to generateApiToken(); new format-only test suite covering prefix, length, alphabet, checksum reject paths, and a 10k-iteration collision/integrity loop. * Docs (features/api-tokens.mdx, api-reference/overview.mdx) describe the shape and drop the obsolete JWT-ceiling note. * fix(api-tokens): clear CI lint and CodeQL false positives * Drop unused TEST_USERNAME import in remote-console-session.test.ts; the migration to generateApiToken() left it orphaned. * Add a CodeQL barrier model so `generateApiToken`'s ReturnValue does not flow into the `insufficient-password-hash` query. The function emits 256-bit CSPRNG opaque keys; sha256 of the raw token is the correct construction for high-entropy API tokens (bcrypt-class hashes target low-entropy human passwords). CodeQL's name heuristic was treating "Token" as a password source and flagging the standard sha256 wrapping at all 9 call sites. * ci(codeql): exclude js/insufficient-password-hash for token paths The previous barrierModel data extension was a no-op for this rule: the js/insufficient-password-hash query identifies its "password" sources via SensitiveExpr's name heuristic ("token", "secret", "key" substrings), which is upstream of the taint-tracking layer where barrierModel applies. Verified by post-push re-analysis: 9 alerts still open, all undismissed. Replace the dead extension with a path-scoped query-filter in codeql-config.yml so the rule no longer fires on apiTokenFormat, apiTokens, and the test directory. Real user-password hashing code elsewhere in the repo (auth, users, setup routes) remains analyzed. The 9 existing alerts on PR #1062 are dismissed via API as false positives with a justification pointing at this config. Future runs will not re-flag them because of the path filter.	2026-05-15 18:21:28 -04:00
Anso	3323a59003	fix(mesh): poll topology data and tighten stack-membership equality (#1059) ... Adds a visibility-aware 30s poll on the Routing tab so the graph reflects tunnel state, alias publishes, and remote-node disconnects without a manual reload. Polling pauses while the tab is hidden and wakes immediately on focus via the shared visibilityInterval helper. Tightens nodeStateEqual so a stack swap on the same node (opt out A, opt in B) is detected even when the count is unchanged. Extracts the helper, the minimap colour mapping, and the minimap colour literals to mesh-topology-layout so they can be unit-tested and to drop a now-unused isOwnerView field from MeshNodeData. Persists the Table/Graph and Tunnels/Aliases toggles to localStorage so a Routing tab session keeps the operator's last-used view. Adds a legend line to the per-stack topology sheet clarifying that consumer edges mean meshed peers that could reach the aliases via DNS; whether containers dial them depends on each consumer's own opt-in stacks. Adds unit tests for stacksKey, meshNodeStateEqual, and miniMapColorFor, plus troubleshooting entries and a refresh-cadence note to the mesh docs.	2026-05-15 09:52:10 -04:00
Anso	2e82eb44fe	feat(fleet): multi-mode topology with label grouping and persisted positions (#1054) ... The Topology view now offers three layouts so the canvas adapts to how the fleet is organised, not the other way around: - Hub: the gateway anchored on the left with remotes radiating right - Grouped (Skipper+): remotes cluster by their primary node label, with the local node in its own cluster and unlabeled remotes in an Unlabeled cluster - Free (Skipper+): drag any node; positions persist per browser via local storage Node cards gain label pills (Skipper+), a cordon banner with reason tooltip, a latency chip for online remotes, and a stale pilot-heartbeat glyph. All fields are sourced from /api/fleet/overview, which already returns cordon, latency, and pilot timestamps; no backend changes required. Community continues to see the single Hub layout (without the toolbar, no gating cues), matching the visibility principle that paid affordances are hidden from lower tiers rather than displayed as locked teasers. The backend /api/node-labels route is already requirePaid, so the data gate is honoured end to end. Includes unit tests for the layout module (hub/grouped/free coverage) and the preferences hook (round-trip plus corrupt-JSON fallback).	2026-05-15 08:59:52 -04:00
Anso	9e4b969dfb	feat(mesh): add topology graph view and per-stack drill sheet (#1052) ... Adds a Table/Graph toggle to Fleet → Traffic. Graph mode draws the fleet as a ReactFlow diagram with a second toggle that switches edge encoding between Tunnels (one edge per node pair, coloured by tunnel state) and Aliases (same edges labelled with alias counts). Clicking a node card opens the existing opt-in sheet, where each opted-in stack now has a Topology button that opens a focused side sheet showing the stack at the centre, the aliases it publishes, and the meshed consumer nodes with per-tunnel state. Reuses the existing /mesh/status and /mesh/aliases endpoints; no backend changes. Inherits the Admiral gate from the parent Routing tab. Layout helpers and the per-stack sheet are unit-tested.	2026-05-15 08:07:34 -04:00
Anso	946db9df52	fix(mesh): accept node_proxy at the proxy-tunnel WS upgrade (#1050) ... The mesh proxy-tunnel WS handler was gated on full-admin api_token scope only, so node_proxy JWTs (the credential the Add Remote Node dialog tells operators to generate via Settings -> Nodes -> Generate Token) were silently rejected with HTTP 403. Operators followed the dialog's instructions, enrolled the node cleanly, saw reachableMode='proxy' with no negative badge, opted a stack into mesh, watched the redeploy complete, and only then discovered no bytes flow. node_proxy already authorizes every /api/* surface on the remote (deploy, exec, host console, filesystem), which is a strict superset of what the mesh proxy-tunnel does. Gating mesh more strictly was theatre, not security, and it created a UX trap with no in-product signal pointing at the scope mismatch. Change the upgrade dispatcher to accept any machine-to-machine credential: node_proxy JWT or full-admin api_token. Session cookies and restricted api_token scopes (read-only, deploy-only) remain rejected through the same paths as before. Adds positive/negative coverage in upgrade-order.test.ts for all four credential shapes so the gate stays pinned against future re-tightening. Updates user-facing copy in the mesh docs and Settings -> API Tokens description so the documented path matches the actual code. If we ever introduce a demoted node_proxy variant (audit-only, read-only fleet member), the right move is differentiated node_proxy scope claims inside the tunnel JWT (tracker F-A3), not requiring a separate token type for mesh.	2026-05-14 23:26:41 -04:00
Anso	a38a3e0226	feat(mesh): route mesh traffic over Distributed API remotes (#1048) ... * refactor(mesh): extract shared TCP stream switchboard Pull the `tcp_open` / `tcp_open_ack` / `tcp_open_reverse` / `tcp_close` + `TcpData` handling out of the pilot agent into a reusable module so a second caller (the upcoming proxy-mode WS handler) can run the same frame parser, stream allocator, idle timers, and Compose-label resolver. One parser, two callers, zero drift on a security-sensitive protocol surface. The pilot agent keeps its public `openMeshTcpStream` API and delegates to a per-connection switchboard constructed in `connect()` and torn down in `cleanupAfterDisconnect`. Existing reverse-stream and resolver tests are rewritten to exercise the shared module directly. * feat(mesh): route mesh traffic over Distributed API remotes Sencho Mesh now works against remotes in Distributed API mode in addition to Pilot Agent mode. Central opens a short-lived WebSocket tunnel to the remote's new `/api/mesh/proxy-tunnel` endpoint on demand and tears it down after 5 minutes of idle (configurable via `SENCHO_MESH_PROXY_TUNNEL_IDLE_MS`). Mesh dispatch is mode-agnostic at the routing layer; `PilotTunnelManager.ensureBridge` resolves an existing tunnel or asks the new `MeshProxyTunnelDialer` to dial. The Routing tab badges now use a `reachableMode` classifier: `★ Local` for local, `pilot offline` red badge for a pilot with a down tunnel, and a new `unreachable` red badge surfacing the specific reason (missing token, scope not full-admin, TLS failure, remote does not support proxy mesh). Distributed API remotes with valid credentials show no negative badge; the tunnel opens on first dial. Auth: the proxy-tunnel WS upgrade requires an `Authorization: Bearer` API token with the `full-admin` scope. Lower-scoped tokens are rejected at upgrade time so a leaked read-only token cannot reach the mesh data plane. Bidirectional: the proxy-mode WS handler registers itself as the local `MeshService` reverse dialer (compare-and-swap), so meshed containers on a Distributed API remote can dial cross-node aliases via `tcp_open_reverse` over the same tunnel. Cross-node relays (`PilotTunnelBridge.acceptReverseRelay`) await `ensureBridge` so proxy-to-proxy mesh works without standing tunnels. * docs(mesh): describe Distributed API mesh and unreachable troubleshooting Refresh the user-facing mesh documentation to reflect that mesh works over both Pilot Agent and Distributed API remotes. Adds a Troubleshooting accordion entry for the new `unreachable` Routing tab badge so operators can match a tooltip reason ("api token rejected (scope must be full-admin)", "remote does not support proxy mesh", "TLS handshake failed", "api_url not set", "api token missing") to a concrete fix. * refactor(mesh): apply /simplify review findings Five cleanups surfaced by the post-implementation code review pass. No behaviour change for fleets running on `main`; only internal structure improves. - **Deterministic container IP shared.** Extract the compose-default network preference (`pickContainerIp`) and the conventional-name fast path (`lookupContainerIp`) into `backend/src/mesh/containerLookup.ts`. Both `MeshService.resolveContainerIp` (existing same-node fast path) and the switchboard's `resolveByComposeLabels` (proxy/pilot inbound dial) now use the same logic. Earlier the switchboard helper grabbed the first `Object.values(Networks)` IP, which could flip across daemon versions on multi-network containers; fixed. - **WS URL upgrade extracted.** New `backend/src/utils/wsUrl.ts` exposes `httpUrlToWs(baseUrl)` that maps `http://` to `ws://` and `https://` to `wss://`. Used in both `pilot/agent.ts` and the proxy-tunnel dialer. The previous inline `replace(/^http/, 'ws')` silently downgraded `https://` to `ws://` (cleartext). - **`computeReachable` takes the pre-fetched node.** `getStatus` already iterated `db.getNodes()`; the helper previously re-queried by id per node (N+1 reads). Pass the row in. - **Reachable-reason ternary -> const map.** Replace the nested ternary in `MeshService.computeReachable` with a `Record<DialFailureCode, string>` lookup keyed on the dialer's failure code. - **Activity-type ternary -> const map.** Same flattening inside `MeshProxyTunnelDialer.logActivity`. All mesh tests pass (85/85). Full backend suite green (2126/2126). * fix(mesh): cache proxy dial failures and contain WS handshake errors `ensureBridge` now consults the recent-failure cache before dialing so a continuous mesh workload against a misconfigured proxy-mode remote does not produce one upgrade attempt per cross-node TCP open. `recordFailure` emits at most one activity-log entry per cache window per (nodeId, code) so a connect-loop on a single bad remote cannot flush the ring buffer. Failure messages run through `redactSensitiveText` before reaching the log so any embedded Bearer / JWT / inline-URL credentials are scrubbed. `stop()` clears the inflight map and `dial()` checks `this.stopped` between awaits so a shutdown does not leak a half-opened bridge. When `awaitOpen` rejects (401, 4403, TLS), the dialer attaches a noop 'error' listener before calling `ws.close()`. Without it the ws library emits a tail 'error' on a still-CONNECTING socket that propagates as an unhandled exception. Surfaced by a live-network test against a real proxy-mode peer. Adds `mesh-proxy-tunnel-live.test.ts` (skipped unless MESH_AUDIT_URL and MESH_AUDIT_TOKEN_FILE env vars are set) covering both the happy path and the auth-rejected path against an actual remote Sencho. * feat(mesh): instrument proxy tunnel observability Adds three counters to `PilotMetrics`: - `proxy_bridges_total` (incremented on `registerProxyBridge` success) - `proxy_dials_failed` (every failed dial attempt, not deduped) - `proxy_idle_closes` (idle-sweep teardowns) All three surface automatically via `GET /api/system/pilot-tunnels` since the route returns the full `Counters` snapshot. Gates two pre-existing always-on `console.warn` calls in `tcpStreamSwitchboard.ts` (mid-stream socket errors and Docker resolve failures) behind `isDebugEnabled()`. Both fire on per-stream events and would otherwise violate the diagnostic-log safety rule under load. Adds `mesh-tcp-stream-switchboard.test.ts` covering the forward `tcp_open` path: real localhost dial, resolver errors (no_target, denied), per-tunnel cap saturation, frame-routing fall-through invariants, `tcp_close` socket teardown. Drops `MESH_CONNECT_TIMEOUT_MS` from the public surface; only the switchboard itself uses it. * fix(mesh): tighten Routing tab unreachable handling `RoutingNodeCard.tsx`: the **Add stack to mesh** button now disables when `reachableMode === 'unreachable'`, matching the existing TogglePill behavior. Without this, an operator on an unreachable node could open the opt-in sheet, confirm, and watch the redeploy proceed against a target whose mesh data plane will silently fail to route. Also drops the leftover `status.nodeId !== -1` guard on the pilot- offline badge. `MeshService.ts`: renames `isMeshReachable` to `isMeshConfigured` with the new predicate that returns true for proxy-mode remotes whose creds are valid (the tunnel is opened on demand). `getRouteDiagnostic` now distinguishes "routable" (configured) from "pilotLive" (live tunnel state, only meaningful for pilot mode); without the split, every idle proxy-mode route would report `tunnel down`. `MeshService.setReverseDialer` warns when the unconditional install path silently overwrites a non-null current dialer. By topology a Sencho is either pilot or central, so the branch flags a misconfigured deployment rather than an expected race. Drops the dead `export { ReverseTcpStreamHandle }` re-export from `pilot/agent.ts`; its only consumer imports straight from `mesh/tcpStreamSwitchboard.ts`. Fixes a stale doc comment in `MeshService.ts` that referenced the wrong source file. Adds `mesh-proxy-tunnel-handler.test.ts` covering the WS handler lifecycle: pilot-mode 404 rejection, post-upgrade reverse-dialer install, concurrent-upgrade 1013 rejection (single-tenant slot), and error-path teardown. Updates the troubleshooting accordion in the user docs to mention the disabled-state behavior. * fix(mesh): close ESLint and CodeQL findings on the proxy-tunnel diag logs Remove the unused `reverseDialer` local in `meshProxyTunnel.ts`; the closure target is `localDialer` above and this assignment was always dead. Strip line breaks inline on the three `MeshProxyTunnelDialer` diag log lines so CodeQL `js/log-injection` data flow recognises the sanitisation that `sanitizeForLog` already performs. No behaviour change; the diag logs render the same characters they do today.	2026-05-14 20:51:42 -04:00
Anso	69b6ac1f3b	fix: harden stack file explorer operations (#1028) ... * fix: harden stack file explorer operations * fix: update Docker toolchain to Go 1.26.3 * fix: repair Dockerfile tr argument split across lines * fix: bump protobufjs to clear npm audit high-severity advisories	2026-05-12 15:49:51 -04:00
Anso	19cdb3681d	fix: harden blueprint deployment guardrails (#1027) ... * fix: harden blueprint deployment guardrails * fix: update Docker toolchain to Go 1.26.3 * fix: repair Dockerfile tr argument split across lines * fix: bump protobufjs to clear npm audit high-severity advisories	2026-05-12 15:49:19 -04:00
Anso	693f9b4495	fix(fleet): drop tier gate from stack and container list endpoints (#1012) ... Community tier opened the Fleet Overview drilldown (node card → stack list → container list) but two read-only metadata endpoints in fleet.ts kept their requirePaid gate. Stack names still rendered because they ride on the un-gated /api/fleet/overview payload, but expanding a stack always re-fetched containers and hit the orphan gate, surfacing as a "Failed to load containers for X" toast on every node card on Community. Drop requirePaid from GET /node/:nodeId/stacks and GET /node/:nodeId/stacks/:stackName/containers. Both handlers stay behind authMiddleware, validate inputs, and proxy to the per-node api_token for remote nodes. Paid mutations (bulk update, scheduled snapshots, label bulk actions, Fleet Actions cards) keep their gates in fleetActions.ts. Add positive Community-tier tests in fleet.test.ts and clear the stale "Requires Skipper or Admiral license" line from the OpenAPI descriptions.	2026-05-09 01:55:56 -04:00
Anso	23bbee4f45	feat(mesh): replace host-mode with shared sencho_mesh Docker network (#1009) ... * feat(mesh): replace host-mode with shared sencho_mesh Docker network Phase D of the mesh redesign: drop the operator's `network_mode: host` requirement and the `host-gateway` extra_hosts pattern that did not work on cloud iptables-restrictive distros (OCI, etc.) or Docker Desktop. Each Sencho creates a shared `sencho_mesh` Docker bridge network on boot (default subnet 172.30.0.0/24, override via SENCHO_MESH_SUBNET), pins itself at `<network>+2`, and attaches every meshed user service to the same bridge. Compose overrides now emit IP-based `extra_hosts` plus a top-level `networks` block declaring `sencho_mesh` external. Override delivery: central renders for local stacks; for remote stacks it sends the fleet alias list to the remote's new `PUT /api/mesh/local- override/:stackName` endpoint, which renders against the remote's OWN local senchoIp and writes under its OWN DATA_DIR. Each node may use a different subnet without coordination beyond the env var. Opt-in / opt-out now trigger an automatic redeploy of the affected stack via the existing deploy code path (local: ComposeService; remote: HTTP POST through proxyFetch). The frontend opt-in sheet shows a confirmation modal (ConfirmModal) before the mutation. Failed redeploys emit both a mesh activity event and a durable audit-log row. Hardening: - Reserve port 1852 at opt-in (prevents user containers from racing the Sencho API listener). - ensureMeshNetwork refuses to continue if `sencho_mesh` exists with a mismatched subnet rather than silently routing to the wrong IP. - Idempotent network connect/disconnect helpers in DockerController. - optInStack rolls back the DB row if the just-inserted stack's override push fails (no half-states surviving across calls). - regenerateOverridesForNode runs in parallel and skips the just- pushed stack on opt-in. Operator template: drop `network_mode: host`, restore `ports: ["1852:1852"]`. Mesh now works identically on Linux LAN, OCI, and Docker Desktop without firewall changes. Docs: rewrite docs/features/sencho-mesh.mdx around the shared bridge network, document SENCHO_MESH_SUBNET, surface the host-network-service opt-in restriction, and cross-link with the Pilot Agent docs. BREAKING CHANGE: the operator's `docker-compose.yml` no longer uses `network_mode: host`. After upgrading, redeploy any meshed stacks once so they pick up the new IP-based override and join `sencho_mesh`. * fix(mesh): wrap stackName with path.basename in local-override fs ops CodeQL flagged js/path-injection on the new applyLocalOverride and removeLocalOverride methods because they are publicly reachable and its data-flow model does not recognize isValidStackName / isPathWithinBase as sanitizers. The validation IS sufficient (the allowlist regex blocks path separators, the path-prefix check blocks escape), but path.basename is a model CodeQL recognizes and is purely defensive: for any input that already passes isValidStackName, basename is the identity.	2026-05-09 00:11:09 -04:00
Anso	ccad5c925b	feat(nodes): hide hub-only views when active node is remote (#1007) ... * feat(nodes): hide hub-only views when active node is remote Fleet, Schedules, Audit, Logs, and Auto-Update operate on hub-owned state (node registry, fleet schedules, centralized audit, fleet-wide log aggregation, fleet-wide update preview). When the active node is remote, proxying those surfaces would show that remote's own disconnected state instead of the hub's. Hide them from the nav strip and force-redirect to Home if one was open during the node switch. Backend hubOnlyGuard middleware sits between nodeContextMiddleware and the remote proxy and rejects /api/scheduled-tasks, /api/audit-log, and /api/notification-routes with 403 + HUB_ONLY_ENDPOINT when nodeId resolves to a remote, closing the script-bypass path the UI gating cannot reach. Settings sub-sections were already gated via the hiddenOnRemote registry; this extends the same model to top-level views. * docs(nodes): note hub-only visibility on Fleet, Schedules, Audit, Logs, Auto-Update Each of the five hub-only feature pages now points readers to the canonical "What top-level views show when a remote node is active" section in multi-node.mdx, so users landing directly on a feature page understand why the nav item disappears when they switch to a remote node.	2026-05-08 22:54:58 -04:00
Anso	1803512f70	feat: drop stack labels and network topology to Community tier (#995) ... * feat(labels): drop tier gate to Community for organization endpoints Stack Labels CRUD and per-stack assignment are now Community-tier features: list, create, update, delete labels, and assign labels to a single stack. The two automation surfaces stay Skipper+: per-label bulk deploy / stop / restart (POST /api/labels/:id/action) and the Fleet Actions tab's bulk-assign card (POST /api/fleet-actions/labels/bulk-assign). Tier story is now organize free, automate paid. Add a route-level test that proves the CRUD endpoints succeed on a Community license while the bulk-action endpoint still returns 403. Update overview, licensing, and stack-labels docs to reflect the new tier placement and to note that bulk actions on a label still require Skipper or Admiral. * feat(topology): drop tier gate to Community for network topology view The Resources tab's Networks > Topology view is now available on every tier. Drops requirePaid from GET /api/system/networks/topology, removes the isPaid wrapper around the List | Topology toggle in ResourcesView, and removes the PaidGate around the topology graph. CapabilityGate stays in place so a node running on a build without the network-topology capability still renders its lock card instead of the graph. Add a route-level test that proves the endpoint returns 200 on a Community license. Update licensing and resources docs to reflect the new tier placement. * fix(labels): expose Settings > Labels tab on Community tier The settings registry entry for the Labels tab still carried tier: 'skipper', which kept the tab hidden in the Settings sidebar even though the underlying CRUD endpoints now serve Community. Drop the tier flag so Community users can discover and reach the section that backs the already-Community-tier label endpoints.	2026-05-08 15:24:25 -04:00
Anso	0be479100c	docs: v1 docs refresh (#966) ... * docs(introduction): rewrite intro page and refresh screenshots Rewrite the Getting Started introduction to reflect the current product: adds the Mesh, Blueprints, Pilot, Fleet, Resources concepts up front; restructures capability sections around Stacks, Fleet (now including Fleet Actions), Mesh, Blueprints, Monitoring, Resources, Security, Automation, and Pilot/Remote ops; cross-links every claim to the matching feature page. Replaces the dashboard hero shot with a fresh capture against the redesigned cockpit chrome and adds three inline shots (running stack with anatomy and logs, fleet command deck, resources hub with reclaim header). All screenshots taken at 1920x900, dark theme, with node names, usernames, IPs, and home paths neutralized. Drops outdated claims: stale "190+ templates" count, the "viewer accounts" RBAC summary, and the "atomic" deployment label that did not match the actual rollback mechanism. * docs(introduction): add Federation and Fleet Secrets Federation has shipped (Admiral) with cordon and pin policy as operator overrides on the blueprint reconciler. Fleet Secrets is landing as a Skipper+ tab for versioned env-var bundles encrypted at rest, with diff preview and target push. Mirror those in the Run-one-machine-or-many bullet list and in the Tiers paragraph so the introduction matches the current product. * docs(introduction): re-shoot screenshots against v0.72.0 production Re-capture all four introduction screenshots from the upgraded production node so the fleet view shows the current full tab strip (Overview / Snapshots / Status / Deployments / Traffic / Federation / Fleet Actions / Secrets) instead of the older Overview / Snapshots / Status only. Same 1920x900 dark-theme capture and the same PII scrub applied (node names, usernames, IPs, home paths neutralized). * docs(quickstart): rewrite around v0.72.0 cockpit and add screenshots Replaces the bare install snippet with a five-minute walkthrough that matches the redesigned UI. Leads with a docker-compose.yml block (the bare docker run command is collapsed in an Accordion), keeps the 1:1 path rule, and adds two new sections that show the user what happens on first boot. Adds two screenshots at 1920x900 dark theme: - setup-cold-start.png: the Cold start card with Username, Password, Confirm password fields, and the Initialize console button. - dashboard.png: the post-sign-in dashboard captured against v0.72.0 with the full top nav (Home, Fleet, Resources, App Store, Logs, Auto-Update, Console, Audit, Schedules) and the populated Stack health table sorted by load. Where-to-next now uses CardGroup cols=2 to match the introduction page's pattern. * docs(configuration): align env var reference with current backend Bring docs/getting-started/configuration.mdx up to date with the v0.72.0 backend: - Remove PORT from the optional env vars table. The listen port is hardcoded to 1852 in backend/src/helpers/constants.ts and is never read from the environment. Replace it with a Listen port section that explains the fixed port and host-port remapping. - Document API_RATE_LIMIT (default 200) and API_POLLING_RATE_LIMIT (default 300), both applied in production only. - Note the /app/compose fallback default for COMPOSE_DIR while still pointing readers at the 1:1 path rule. - Point the SSO env var section at the new SSO Quickstart page and keep the SSO feature reference as the deeper dive. - Tighten First boot and cross-link to Quickstart so the screenshot is not duplicated. - Add a Where to next CardGroup matching the refreshed Introduction and Quickstart pages. Drop stale PORT=1852 and JWT_SECRET=your-secure-jwt-secret-here lines from .env.example so the example no longer contradicts the docs (PORT is hardcoded, JWT_SECRET is auto-generated and persisted to the database during initial setup). * docs(configuration): replace em-dash-substitute hyphens in prose Three sentences used ` - ` (space-hyphen-space) as an em-dash substitute. Replaced with the punctuation that fits each case: - "How Sencho organizes your compose directory": semicolon between the two related clauses. - Data directory Warning: parentheses around the parenthetical insertion. - 1:1 path rule explanation: comma before the contrastive clause. Heading slugs and YAML code-block comments are unchanged. * docs(sso): refresh setup guide and drop misleading "one-click" wording Brings the SSO Setup Guide in line with how SSO actually works in the current build, and corrects misleading copy across both SSO docs pages. - Setup Guide: explains the env-var-seeds-once / DB-is-authoritative config model up front, replacing per-section "Restart Sencho" wording that implied a restart was always required. - Setup Guide: promotes the per-provider Test Connection button out of the LDAP-only paragraph into a generic intro callout, and adds a self-signed LDAPS tip. - Setup Guide: notes that all OIDC providers accept a *_DISPLAY_NAME override for the login button label, and adds a commented LDAP TLS toggle to the full compose example. - Setup Guide: adds two screenshots of the redesigned Settings > SSO panel (overview + LDAP card expanded with form). - Both pages: replaces "one-click presets" / "one-click configuration" with "preset providers". The Skipper-tier presets still require an OAuth app provisioned in the provider's console; what they actually buy is provider-aware defaults and a branded login button. The old wording overpromised. * docs(features-overview): regroup catalog and add 17 missing features Restructure the Features Overview into the same six groups the docs sidebar uses (Stacks & Deployments, Observability, Fleet & Multi-Node, Security & Identity, Automation, Platform) plus a short Reference tail. Add catalog entries for 17 shipped features that the previous overview never mentioned: Stack Activity, Stack File Explorer, Deploy Progress, Deploy Enforcement, Blueprints, Git Sources, Global Search, Pilot Agent, Sencho Mesh, Fleet Federation, Fleet Actions, Fleet Sync, Fleet Secrets, Two-Factor Authentication, CVE Suppressions, Auto-Heal Policies, Stack Sidebar. Fix two factual inaccuracies: - Fleet View blurb wrongly gated search, sort, filter, and stack drill-down behind Skipper. The deep-dive is explicit that those are available on every tier; only the bulk Update All action inside the Node Updates modal is paid. - Auto-update entry was titled and described as a scheduling system. The deep-dive page is the Auto-Update Readiness board (risk tags, changelog previews, rollback targets); the scheduler lives under Scheduled Operations. Add three hero screenshots captured from production at 1920x900, illustrating the redesigned cockpit visual language: Home dashboard, stack anatomy, and fleet topology. * docs(stack-management): refresh page around v0.72.0 cockpit and add screenshots Updates the Stack Management page to match the current UI: sidebar with filter chips and label groups, bulk mode, restructured kebab menu, two-tab anatomy panel, and three-source New stack dialog (Empty, From Git, From Docker Run). Adds sections for Filter chips, Pinned and label groups, and Bulk mode. Restructures the Stack context menu around the inspect, organize, lifecycle, and destructive groups with their keyboard shortcuts. Documents the From Git tab and cross-links Git Sources for the full sync flow. Replaces every existing screenshot with fresh captures from the current UI and adds eight new captures for the new sections. Cross-links Stack Activity, Stack Labels, Stack File Explorer, Compose Editor, Atomic Deployments, Scheduled Operations, Auto-Heal Policies, Auto-Update Policies, and Alerts and Notifications for features documented on their own pages. * docs(stack-activity): refresh page around v1 cockpit and recapture screenshots Realign the page with the current Anatomy panel tab strip and the StackActivityTimeline component: - Frame the Activity tab as a sibling of Anatomy under the right-hand panel, with files/edit actions belonging to the strip. - Expand the category guidance: list the five iconized categories and call out that other stack-scoped notifications (deploy failure, available image updates, auto-heal triggers, monitor alerts, scan findings) flow into the timeline with a generic icon. - Tighten the actor-attribution rule to match the component: omitted for events without an actor and for system-driven events. - Add the day-format example to the relative-time row. - Recapture both screenshots from a populated stack (Today + Yesterday + Earlier with three distinct icons) and an empty stack. - Convert troubleshooting blurbs to H3 for anchor links and consistency with the v1-refresh sibling pages. * docs(stack-activity): wrap troubleshooting entries in Accordion blocks Match the foldable troubleshooting pattern established by docs/features/deploy-progress.mdx so the page stays compact and readers can scan to their issue. This is the canonical formatting for the /features section's troubleshooting blurbs going forward. * docs(editor): refresh page around v1 cockpit and recapture screenshots Rewrites the page around the dual-mode right panel (Anatomy by default, Monaco when the user clicks edit), the redesigned Command Center action bar, the new container row layout with status badges and live stats, the Structured / Raw terminal logs toggle, the Git Source toolbar button, and the opt-in diff preview. Drops the obsolete persistent embedded terminal section. Preserves the #diff-preview-before-save and #log-viewer anchors referenced from settings.mdx and global-observability.mdx. Replaces editor-overview.png and container-exec-modal.png with fresh captures against v0.72.0 production at 1920x900 dark theme; renames container -actions.png to containers-list.png; adds command-center.png and editor-edit-mode.png. PII scrubbed (host paths normalized) and the compose-diff-preview/diff-modal.png shared asset is left untouched after visual diff against the live UI showed no chrome change. * docs(features): wrap troubleshooting accordions in AccordionGroup Wraps the loose <Accordion> blocks in editor.mdx and stack-activity.mdx in a single <AccordionGroup> to match the troubleshooting design used by fleet-federation.mdx. Structural only; no content changes. * docs(stack-file-explorer): refresh page around v1 explorer and add screenshots Full rewrite to match the live two-pane Files tab. Replaces the false 'Edit' toolbar flow with the read-only chip + always-on Save model, fixes the protected-files list (5 names) and dedicated-tab redirect list (3 names), drops the fabricated 100 MB download cap, and corrects the upload claim to single file at a time. Adds sections for New File, Rename, Permissions, the type-to-confirm protected-file delete flow, the non-empty folder delete confirmation, the 500-entry tree display cap, and the symlink rendering. Restructures troubleshooting around <AccordionGroup> + <Accordion> to match fleet-federation.mdx, and adds two new entries (display cap, 403 on Community admin write). Ships nine screenshots captured against v0.72.0 production at 1920x900 in dark theme: overview, two-pane layout, protected-tree-marker, viewer-edit-mode, new-file-dialog, context-menu-folder, context-menu-file, permissions-dialog, delete-protected-confirm. * docs(deploy-progress): rewrite around current modal + capture v1 screenshots Aligns the page with the v0.72.0 implementation and standardizes the troubleshooting layout with the rest of the docs refresh. Setting and gating - Renames the Settings field to "Deploy progress modal" and quotes the current helper text verbatim. Documents that the toggle is off by default, lives under Settings > Appearance > Display, is stored in localStorage, and syncs across tabs in the same browser. Modal anatomy - Names every visible UI string: header verbs, status indicator (with the "closes in <n>s" countdown that was previously undocumented), empty-body strings, footer toggle that flips between "Raw output" and "Hide raw", and the destructive border on ERR rows vs the softer warn tint on WARN rows. - Replaces the vague "after a few seconds" with the actual 4-second auto-close timer; documents hover-to-pause and the leave-hover-restarts-the-countdown behavior. - Documents the truncated error message in the failed-state header and the manual close-only requirement. - Notes that the pill is portal-mounted and survives navigation. Stage badges - Keeps the 9-badge table but adds an honest note that most lines render as LOG because the badges are gated on Compose's "[+]" progress prefix, which Compose only emits in TTY mode and Sencho spawns it without one. Entry points - Splits the supported actions into the four that produce a populated structured-log body (Deploy, Update, Install, Git Apply) and the two that bypass compose and finish with 0 lines (Restart, Stop). Drops the "Down" claim from the user-facing list since no UI control currently triggers it; mentions the down route as an automation surface only. Troubleshooting - Wraps the existing accordions in an <AccordionGroup> matching the pattern used by the editor and stack-activity refreshes. Adds two new entries: one explaining the Restart/Stop "0 lines" outcome, one explaining the LOG-everywhere case for non-TTY compose output. Screenshots (six PNGs in docs/images/deploy-progress/, 1920x900, dark theme, captured against the upgraded production node) - setting-toggle.png: the Display section with the toggle enabled. - modal-streaming.png: a real update in flight at 19s, 554 lines. - modal-succeeded.png: succeeded state with the live closes-in countdown visible. - modal-raw-output.png: structured rows with the Raw output panel expanded beneath. - pill.png: minimized pill anchored bottom-center on a stack editor view. - modal-failed.png: failed state with the truncated error in the header and ERR rows highlighted. * docs(resources): refresh Resources Hub page for v1 redesign and feature additions Rewrite the page to match the shipping UI and replace stale screenshots with fresh captures of the redesigned chrome. - Document the admin-only Reclaim hero and clarify the per-tile Sencho-only vs. All Docker (includes external) split in Quick Clean. - Add coverage of the Scan history toolbar button and the per-row severity badge plus shield-icon scan dropdown in the Images tab; cross-link to the vulnerability scanning page. - Correct the Volumes column list (no Size column; size lives on the Largest 5 landing card) and call out admin gates on browse and delete. - Spell out the List/Topology view-mode toggle and that Create Network is admin-only and List-mode only. - Rewrite the Unmanaged tab section around the project-grouped layout, the Select all + Purge Selected (N) admin-only multi-select, and the empty state copy. - Replace screenshots: resources-reclaim, networks-list, create-network, network-inspect, network-topology, network-topology-toggle. Add fresh resources-volumes-tab and resources-unmanaged-tab captures. * docs(app-store): refresh page around v1 deploy sheet, scan integration, and registry settings Rewrites the App Store reference to match the current cockpit: - Documents the weekly-rotated featured banner picked from the top-5 by GitHub stars and the star-descending grid sort. - Adds the deploy-sheet structure (breadcrumb, meta line, About panel with Read more) and splits the Advanced tab into Ports, Volumes, Environment variables, Custom variables, and Security subsections. - Documents the Trivy-gated Security checkbox, atomic vs non-atomic deploys by tier, and the rollback semantics driven by error class. - Adds a Watching the deploy section linking to the deploy-progress modal. - Rewrites the Custom registry section against the new two-panel settings layout (Default + Custom) with the URL validation rule and the using default / using custom hint. - Adds a four-entry Accordion troubleshooting block in the house style. - Replaces three screenshots and adds two (Advanced tab, Settings registry panel) captured against the production node. Permissions wording aligns with current backend (admin only); the broader stack:create gate will land in a follow-up fix branch. * docs(app-store): describe inline port-conflict messaging on deploy sheet Update the deploy-sheet section to match the visible port-conflict behavior: the Essentials tab surfaces a Port-conflict warning that replaces the defaults hint when any default port is already bound, and the Advanced tab shows an inline "in use by {stack}" message next to the container port instead of a hover-only tooltip. Refresh the screenshot alt-text and the troubleshooting Accordion to match. * docs(app-store): align permissions note with stack:create gate Pairs with the backend gate swap in fix/templates-deploy-rbac (#986) which moves POST /api/templates/deploy from requireAdmin to requirePermission('stack:create'). Updates the Note block under 'Watching the deploy' so the docs match the new behavior: admin and node-admin can deploy templates from the App Store; viewer, deployer, and auditor cannot.	2026-05-07 23:44:13 -04:00
Anso	3d9489648e	fix(pilot): harden outbound reverse-tunnel against resource exhaustion (#979) ... * fix(pilot): cap tunnel frame size, concurrent streams, and stream idle time Pilot tunnels carry every HTTP, WS, and Mesh-TCP byte for a remote node through a single multiplexed WebSocket. A buggy or compromised peer that sent oversized frames, opened streams in a tight loop, or left streams parked indefinitely could exhaust gateway memory. Three protocol-level limits applied symmetrically on both ends: - MAX_FRAME_SIZE_BYTES (8 MB): set as the ws maxPayload on the gateway-side WebSocketServer and the agent-side WebSocket client, plus a defense-in-depth length check in decodeBinaryFrame and decodeJsonFrame. - MAX_STREAMS_PER_TUNNEL (1024): bridge refuses new loopback HTTP / upgrade / TCP allocations with 503 once at the cap; the agent rejects new incoming http_req / ws_open / tcp_open with the appropriate error frame. - STREAM_IDLE_TIMEOUT_MS (10 min): every stream gets a per-stream timer refreshed on each inbound or outbound activity. Expiry tears down the local half and notifies the peer. The constants are colocated in pilot/protocol.ts so any future agent build picks them up via the protocol module. * fix(pilot): rate-limit pilot enrollment endpoints to 10 per minute Pilot enrollment mints a JWT and writes a pilot_enrollments row, both privileged operations that should not share the global API budget (200/min). Add a dedicated express-rate-limit instance keyed by user or IP at 10/min in production (100/min in dev so the local enrollment test loop is not throttled). The limiter is applied directly on POST /api/nodes/:id/pilot/enroll. On POST /api/nodes the limiter's skip function reads the parsed body and exempts proxy-mode creates; only requests that resolve to mode=pilot_agent count against the enrollment budget. * fix(pilot): cap concurrent pilot tunnels system-wide The PilotTunnelManager held an unbounded Map of bridges. A reconnect storm, runaway enrollment, or operator misconfiguration could grow the map without limit, even though every tunnel still carries a valid JWT. Cap at 256 concurrent tunnels per primary instance: - Soft warning at 128 (logged once per crossing). - Hard refusal at 256: registerTunnel throws PilotTunnelCapacityError and the upgrade handler closes the WebSocket with 1013 (Try Again Later) so the agent backs off rather than tight-looping. A node that already has a registered tunnel does not consume a new slot when it reconnects; the existing bridge is closed first. * fix(pilot): release backpressure as soon as the tunnel buffer drains Previously the bridge paused HTTP request bodies when the tunnel WebSocket's bufferedAmount climbed above 4 MB but never resumed them explicitly; the next data event re-checked the threshold, and TCP streams only saw a 'drain' fan-out on the 30 s ping cycle. Slow-consumer peers held buffered bytes for tens of seconds longer than needed. Replace both with an on-demand drain check: when at least one stream is paused, sample bufferedAmount every 100 ms; once it drops below the high-water mark, resume every paused request and emit 'drain' to every accepted TCP stream, then stop the timer. Dormant when no stream is paused, so steady-state cost is zero. * fix(pilot): trust internal CAs via SENCHO_PILOT_CA_FILE Self-hosted deployments often terminate TLS with an internal CA. The only previous escape hatch was NODE_TLS_REJECT_UNAUTHORIZED=0, which disables verification across every outbound connection in the agent process and is the wrong shape of fix. Add SENCHO_PILOT_CA_FILE: when set, the agent reads the file as a PEM bundle and passes it to ws as the `ca` option for the tunnel WebSocket. rejectUnauthorized remains true. Failure to read the file exits with a clear error so the operator does not silently fall back to the default trust store. There is no flag to disable TLS verification entirely; that would defeat the credential trust model. * fix(pilot): gate frame-rate-adjacent logs behind developer_mode The agent's malformed-frame warning fires per inbound frame and could flood logs under attack or against a buggy primary. The bridge swallowed parse errors silently, leaving operators blind to protocol drift, and the manager had no signal at all on tunnel registration. Route per-frame and per-tunnel diagnostic logs through the existing isDebugEnabled() helper (same pattern used by middleware/auth, RBAC, and websocket/logs). Production stays quiet by default; the toggle is the existing developer_mode setting in global_settings — no new env var, no new dependency. * feat(pilot): expose per-tunnel metrics via /api/system/pilot-tunnels Operator support had no signal beyond raw logs to answer "is this tunnel flapping?" or "is one bad node hiding behind the aggregate?". Add an in-process counter set covering tunnels_total, tunnels_replaced, tunnels_rejected_capacity, enroll_acks, frame_decode_errors, plus a per-node array carrying the connectedAt and bufferedAmount so a single tunnel sitting on a stuck buffer remains visible. Counters live in services/PilotMetrics.ts; the gateway has no shared in-process metrics facility today, so this is a per-feature pattern documented as such for future consolidation. Counters are strictly process-local — no telemetry, no export, no phone-home — consistent with Sencho's privacy posture. Surfaced read-only via GET /api/system/pilot-tunnels behind admin auth, mirroring the existing cache-stats endpoint. * fix(pilot): tighten reconnect backoff and log handling Three small follow-ups to the hardening pass: - Sanitize the primary URL on the agent's connect log so a malicious SENCHO_PRIMARY_URL with embedded control characters cannot inject fake log lines. - Move the reconnect-backoff reset from the 'open' callback to the 'hello' frame handler. A peer that always rejects the handshake (incompatible version, consumed enrollment token) used to reset the backoff on every TCP-level connect and tight-loop reconnects; now the reset waits for a clean protocol round-trip. - Document the StreamIdAllocator wrap behavior so future readers can see the relationship between the 2^31 wrap and the MAX_STREAMS_PER_TUNNEL cap without re-deriving it. * test(pilot): add coverage for enrollment, rate limiter, and tunnel caps Adds two test files exercising the hardening pass surfaces that were previously uncovered: - pilot-enrollment.test.ts: end-to-end through POST /api/nodes (pilot mode), POST /api/nodes/:id/pilot/enroll, the SHA256 token-hash persistence, replay protection, expired enrollments, and the rate-limit header wiring (enrollment limiter on pilot paths, global limiter elsewhere). - pilot-bridge-limits.test.ts: oversize-frame rejection at both binary and JSON decoders, and the per-tunnel concurrent stream cap as observed via openTcpStream returning null and the loopback HTTP server returning 503 once the bridge is at capacity. Bridge cap test fills the slot map with TCP stream handles rather than real HTTP requests so the OS socket pool stays out of the picture. * test(pilot): cover manager metrics snapshot and capacity-error shape Adds direct coverage for: - PilotTunnelCapacityError exposing the limit so the upgrade handler can format a useful close-frame reason. - PilotMetrics.snapshot returning a defensive copy (callers must not mutate the live counter set). - getMetricsSnapshot returning the open count, per-node breakdown, and counter set in a stable shape, with tunnels_total bumping on a successful registerTunnel. The manager test seeds a real pilot-mode node row first because updateNode throws on missing rows; this models the production path where a node is created before its enrollment is consumed. * docs(pilot): document tunnel limits, custom CA, and new failure modes Refresh the Pilot Agent feature doc to cover the hardening surfaces: - New 'Self-signed primary TLS certs' section walking through the SENCHO_PILOT_CA_FILE env var with an example docker run command. - New 'Resource limits' section listing the per-tunnel and system-wide ceilings so operators know what the wire enforces. - Four new troubleshooting entries: WebSocket close 1013 (system cap), loopback 503 (stream cap), close 1002 with protocol error (frame size / malformed), and HTTP 429 on enrollment. Also expand .env.example with a new pilot-agent block covering SENCHO_MODE, SENCHO_PRIMARY_URL, SENCHO_ENROLL_TOKEN, and SENCHO_PILOT_CA_FILE so operators do not have to read code or the feature doc to discover the agent-side config surface. * fix(pilot): address code-review findings on the hardening pass Critical: - Bridge: TCP backpressure now starts the drain timer and tracks streams awaiting drain, so a TcpStream caller waiting on 'drain' no longer hangs when no HTTP request is in flight. - Bridge: every direct streams.delete call now goes through the removeStream helper so per-stream idle timers are cleared consistently and pausedReqs / tcpAwaitingDrain stay aligned. - Bridge close(): resume any paused IncomingMessage before clearing the map so a parser does not stay stuck across teardown. High: - Protocol: decodeJsonFrame now compares Buffer.byteLength(raw, 'utf8') against the cap; raw.length (UTF-16 code units) let multi-byte payloads sneak ~3x the byte budget through. - Agent: the optional CA bundle is read once at construction and cached on the instance, so a missing or rotated SENCHO_PILOT_CA_FILE no longer process-exits on every reconnect attempt. Medium / Low: - Bridge limits test: assert mockWs.sent.length to confirm slot allocations actually serialized a tcp_open frame and that a rejected (cap+1) attempt did not consume a stream id. - Manager: defer the tunnels_replaced increment until after the cap check passes, so a rejected reconnect does not double-count as both replacement and capacity rejection. - Manager: clarify the protocol comment about MAX_FRAME_SIZE_BYTES enforcement layering (ws maxPayload is authoritative; decoder check is for tests and defense-in-depth). - Limiter: defensive `if (!req.body) return false` so a future refactor that delays body parsing cannot silently skip the enrollment limiter. Deferred (documented as follow-ups, not in this branch): - M2: narrowing public surface of PilotTunnelManager.getBridge to a MeshTunnelHandle interface (cross-cutting refactor). - H4: end-to-end replay test driving the upgrade handler twice with the same enrollment JWT (needs WS test harness).	2026-05-07 21:28:35 -04:00
Anso	fe3bc3e9c3	docs: refresh GitHub README for 1.0 launch (#978) ... New hero with light and dark logo via <picture>, fresh production screenshots (dashboard hero plus four-image gallery covering stacks, editor, fleet, and logs), tighter capability list grouped by surface, compose-first quick start with TLS reverse-proxy callout, dedicated remote-nodes section, and a combined documentation/community/license footer. Also adds .github/FUNDING.yml pointing at the Buy Me a Coffee page so the Sponsor button surfaces on the repo page.	2026-05-07 20:06:19 -04:00
Anso	3b650523c1	Audit-hardening pass for secret and misconfiguration scanning (#977) ... * fix(security): dedupe concurrent compose-stack scans Track stack scans in scanningImages keyed stack:<nodeId>:<stackName>. The /scan/stack route returns 409 when an in-flight scan exists, and the service-side check is the real correctness barrier (the route pre-check is a fast-path optimization that mirrors scanImage). The dedup key release lives in a try/finally so failed scans free the slot for retry. Why: scanComposeStack had no equivalent of scanImage's scanningImages guard, so two simultaneous calls for the same stack would both run trivy config, both insert a vulnerability_scans row, and double- process the result. * feat(security): acknowledge misconfig findings Adds a parallel acknowledgement system for Trivy misconfig findings that mirrors cve_suppressions: a new misconfig_acknowledgements table, read-time enrichment via the new misconfig-ack-filter utility, REST CRUD endpoints, fleet-sync replication from control to replicas, a Settings panel, and an Acknowledge button on the Misconfigs tab. Schema and behavior parity with cve_suppressions: - UNIQUE(rule_id, COALESCE(stack_pattern, '')) so fleet-wide acks collide as expected - blockIfReplica on every write - Audit-log entries name the scope (rule_id, stack_pattern) but never the reason text - replicated_from_control flag controls UI delete affordance and drives clearReplicatedRows on demote/reanchor - Validators reused: validateStackPatternForRedos for glob safety, sanitizeForLog for log fragments SARIF export emits an external/accepted suppression entry per acknowledged misconfig, matching the CVE pattern. Per-row Acknowledge dialog prefills stack_pattern with the scan's stack_context so the default scope is "rule + this stack only" and an operator must broaden explicitly. Tests: misconfig-ack-filter (15) and misconfig-ack-routes (23) including the duplicate-409 case for both pinned and fleet-wide acks. * fix(security): reap orphaned trivy tmp dirs at startup When the buildEnv path writes a per-scan DOCKER_CONFIG dir under os.tmpdir() and the process crashes before the finally block runs, the dir leaks. Mirrors GitSourceService.sweepStaleTempDirs: exported sweepStaleTrivyTempDirs is fire-and-forget at boot, removes prefix-matching dirs older than 1 hour, swallows permission/race failures, logs a single line if any were reaped. * perf(security): emit per-batch summary for scanAllNodeImages Adds one diag() line at the end of scanAllNodeImages summarising unique image count, scanned, skipped, failed, violation count, and elapsed time. Per-image diag inside scanImage stays useful for debugging individual scans; the summary gives operators a single fleet-level checkpoint when developer_mode is on. * perf(security): cap SARIF export at 5000 findings per type Replace the unbounded fetchAllPages walk on /scans/:id/sarif with a hard limit of 5000 findings per type. When any type trips the cap, emit run-level properties.truncated=true plus row_limit and per-type totals so downstream tooling can flag the export as partial. Console-warns for ops visibility. A scan with 50k vulns previously streamed every row into memory before serialising; the cap bounds memory and serialisation time at the cost of completeness on pathological scans. * docs(env): document TRIVY_BIN host-binary override The env var is honored by TrivyService.detectTrivy as a fallback when no managed install is present, but it was undocumented in .env.example. Adds the var with a comment explaining precedence (managed > TRIVY_BIN > PATH). * test(security): cover scanComposeStack failure modes Two new cases drive the existing try/catch through real failure paths: - Malformed Trivy stdout: row flips to status='failed' with the parser error preserved on `error`. - execFile rejection: row flips to status='failed' with a string error message. Pairs with the existing dedup tests so the failure path now also verifies the scan row state, not just the thrown exception. * test(e2e): security scanner + misconfig acknowledgement flow Seven Playwright tests covering the scanner UI and the new acknowledgement system end-to-end: - Trivy availability gate (skips suite when binary absent so CI without Trivy can opt out via E2E_SKIP_TRIVY=1) - Stack config scan completes and records misconfig findings - Concurrent stack scan returns 409 from the dedup gate - Misconfig ack POST creates and lists on Settings - Duplicate (rule_id, stack_pattern) returns 409 - Malformed rule_id (shell metacharacters) returns 400 - Misconfigs tab renders against a real stack scan Tests drive the API for behaviour assertions and the UI only for shell-rendering checks; the visual snapshot suite owns screenshots. * docs(features): add misconfig acknowledgement workflow and SARIF cap Refreshes vulnerability-scanning.mdx with: - Misconfig acknowledgements section covering the per-row dialog, Settings panel, scope/matching rules, and SARIF emission - Tier table row for the new feature - SARIF section note on the 5000 row-per-type cap and the properties.truncated marker for partial exports - Troubleshooting entries: SARIF cap, hidden Acknowledge button, findings resurfacing after delete, Trivy DB phone-home, and 409 on concurrent compose-stack scans * fix(ci): clear backend lint and CodeQL alerts - Remove the dead fetchAllPages helper in routes/security.ts. It lost its callers when the SARIF endpoint switched to direct paged reads for the truncation cap. ESLint flagged it as unused. - Switch the trivy-tmp-cleanup test helper to fs.mkdtempSync. Building paths under os.tmpdir() with predictable names tripped CodeQL's js/insecure-temporary-file rule (high severity), which warns about symlink-pre-creation attacks even in test code. mkdtempSync appends a process-random suffix and creates the dir atomically; the sencho-trivy- prefix is preserved so the production sweep still matches the test fixtures.	2026-05-07 19:23:11 -04:00
Anso	4b1de35dda	Audit-hardening pass for fleet-replicated CVE suppressions (#976) ... * perf(security): bucket CVE suppressions by id at read time applySuppressions now builds a Map<cve_id, suppression[]> once before the per-finding loop, dropping per-finding work to O(matching-cve-suppressions) rather than O(all-suppressions). At a fleet-wide cap of 10000 rows against a multi-thousand-finding scan, the prior linear-per-finding shape drifted into tens of millions of comparisons per render. Public API of findSuppression and applySuppressions is unchanged. Specificity scoring, expiry handling, and image-glob matching are preserved bit-for-bit. Adds a regression guard that pins a 10000x2000 workload under 1.5s and asserts at least one match was actually returned. * feat(security): record audit-log entries on control-side CVE suppression CRUD The replica receive path already wrote an audit-log entry on apply; the control-side POST/PUT/DELETE handlers did not. Operators reading the audit panel saw mirrored security-rule changes from the replica view but could not see who originated them on the control. Symmetric logging closes that gap. The summary records the CVE id and pinned scope (pkg, image) but never the suppression's reason text. Reasons are free-form admin input that replicate fleet-wide and may carry incident-tracker IDs or vendor context the operator did not intend to broadcast. The summary is also sanitised before emission so an operator-supplied package name or image pattern carrying a smuggled newline plus a forged "cve_suppression.delete:" prefix cannot inject a fake row into the audit panel. Control characters become "?" and the field is capped to its validator length. Adds a Control-side audit log block to suppression-routes.test.ts that asserts the privacy contract on each verb (scope present, reason absent), plus a log-injection guard test, plus a regression that GET still works when the local instance is a replica. * test(security): cover cve_suppressions fleet-sync receive path The existing fleet-sync route tests covered the protocol mechanics (auth, anchor, stale push, reanchor, demote) for cve_suppressions only with empty-rows payloads. The suppression-specific concerns were unverified end-to-end: - actual rows replace prior replicated rows on a fresh push - the receive path writes an audit-log entry naming the source fingerprint and row count - a malformed suppression row is rejected at the validator before any DB write Adds a focused block exercising those three properties against the real Express app, real SQLite, and the real apply transaction. * docs(features): refresh CVE suppressions troubleshooting and field guidance Converts the troubleshooting section to Mintlify Accordion blocks so each entry is foldable and the page stays scannable. Adds entries for: - control-identity mismatch on a replica (anchor-aware reanchor flow) - mirrored rules persisting after a control demote - the 10000-row truncation cap on a fleet sync push Adds a privacy note to the Reason field guidance: do not paste credentials, tokens, or vendor secrets there, since the field replicates fleet-wide and surfaces on every node's suppressions panel.	2026-05-07 16:18:19 -04:00
Anso	d8e8d500c9	docs(fleet-sync): refresh hardening, anchor, retry, demote behaviors (#974) ... The fleet-sync.mdx page reflected an earlier shape of the feature. Refreshed to cover everything the receiver and sender now do: - Both scan policies AND CVE suppressions replicate over the same channel today (was previously framed as "future" for suppressions). - Control anchor: replicas bind to the first control fingerprint and reject pushes from a different control until an admin reanchors. Documented the reanchor curl call. - Push ordering: monotonic pushedAt rejects strictly-older pushes with 409 STALE_SYNC_PUSH; legacy controls without timestamps still accepted for back-compat. - Automatic retry: the control retries failed pushes every 5 minutes for 24h and emits one warning notification per hour-long failure window for previously-working remotes. - Demote to control: documented the admin-only button and what it wipes. Replaced the "remove the node from the control" workaround with the proper flow. - Pilot-agent nodes: explicitly documented as out of fleet-sync scope. - Tiebreaker: documented lowest-id wins for ties. - Replica policy filtering: identity-scoped policies for other replicas no longer surface in this replica's UI. - Troubleshooting expanded with 409 codes (STALE_SYNC_PUSH, CONTROL_IDENTITY_MISMATCH). Cross-link added from vulnerability-scanning.mdx (Scan policies section) so anyone reading about policies finds the replication docs.	2026-05-07 13:56:14 -04:00
Anso	0f0b22c51a	feat(fleet): Fleet Secrets tab with env-var bundles (v1 MVP) (#965) ... * feat(fleet): add Fleet Secrets tab with versioned env-var bundles (Skipper+) Centralized, encrypted-at-rest secret bundles that can be pushed to labeled nodes' stacks. Each save bumps a monotonic version; each push records a per-node-per-version row in `secret_pushes` plus an entry in `audit_log`. Conflict detection shows added/changed/unchanged/removed (informational) diffs before write. Overlay merge preserves keys missing from the bundle. - Adds `secrets`, `secret_versions`, `secret_pushes` tables. - New `SecretsService` reuses CryptoService for AES-256-GCM, NodeLabelService for selectors, and direct fetch + Bearer for outbound calls to remote nodes. - New `secretsRouter` with 9 endpoints under `/api/secrets`, gated by `requirePaid`. Mounted after the auth gate. - Audit summary patterns added for the new routes. - New Fleet › Secrets tab with bundle list, editor sheet (key=value rows, versions tab), and push wizard (selector, target stack, env file picker, per-node diff preview, results pills). - Documentation: docs/features/fleet-secrets.mdx + docs.json nav entry. - 26 Vitest cases cover parser, encryption, versioning, push aggregation, tier gating. * fix(fleet): use const for rawValue in env parser ESLint prefer-const flagged the let declaration as a CI-blocking error; the variable is never reassigned.	2026-05-07 06:03:39 -04:00
Anso	52b46753af	feat(fleet): add Federation tab with cordon and pin policy (Admiral) (#964) ... Ships the v1 MVP for the Federation tab as placement control, not placement automation: - Cordon a node: marks the node unschedulable so the BlueprintReconciler skips it for new placements only. Existing deployments continue to drift-check and redeploy on revision changes; cordon never triggers withdraw or eviction. Toggle on the NodeCard kebab (Admiral, admin role); Cordoned pill renders for all tiers. - Pin a blueprint to a node: stores blueprints.pinned_node_id, replacing the desired set with the pinned node regardless of selector. Pin overrides cordon by design. Action lives only in the Federation tab; BlueprintDetail and the deployment table show read-only Pinned indicators. Backend: idempotent migrations add nodes.cordoned/cordoned_at/cordoned_reason and blueprints.pinned_node_id. New routes POST /api/nodes/:id/cordon, POST /api/nodes/:id/uncordon, PUT /api/blueprints/:id/pin, all gated by requireAdmiral plus requireAdmin. Audit summaries added so the existing auditLog middleware records every operator action. deleteNode clears dangling pins. Reconciler: pin override evaluated before selector match; cordon filter applied only to the new-placement branch (deploy/stateReview without an existing deployment). 11 new Vitest cases cover cordon filter, pin override, pin-overrides-cordon, missing pin target, pin shrinks desired set (stateless withdraw + stateful evict_blocked), and pin clearing on node delete. Frontend: new FederationTab.tsx with cordoned-nodes summary and pin-policy table. Federation moved out of the experimental flag into {isAdmiral && (...)} + AdmiralGate, mirroring the Routing tab pattern. Secrets stays under experimental. Tests pass: backend tsc, full Vitest suite (1704 passed), frontend tsc -b, ESLint (0 errors). Manual verification via the local dev instance confirmed the tab is hidden at Community, the kebab and pill render at Admiral, and cordon and pin endpoints round-trip end to end. Refs cut-line-1.0.md Federation v1 MVP.	2026-05-07 05:55:00 -04:00
Anso	77d5ff58d3	feat(fleet): add Fleet Actions tab for cross-node bulk operations (#963) ... * feat(fleet): add Fleet Actions tab for cross-node bulk operations Introduces a new "Actions" sub-tab in Fleet view with two Skipper+ cards that fill gaps in the existing surface: - Stop fleet by label: matches a label name across every node and stops every stack assigned to it, reporting per-node and per-stack results. - Bulk label assign: applies the same label set to many stacks on one node in a single round trip. Other bulk operations stay in their existing homes (sidebar bulk mode, Schedules, NodeUpdatesSheet) to avoid duplicate surfaces. Backend: - POST /api/fleet/labels/fleet-stop (gateway-orchestrated, multi-node) - POST /api/fleet-actions/labels/bulk-assign (per-node, capped at 1000) - Tightens /api/fleet proxy-exempt prefix to /api/fleet/ so /api/fleet-actions/* is routed through the proxy for per-node calls. - Exports activeBulkActions from labels.ts so fleet-stop and label-action share the per-node lock and cannot double-stop the same containers. - Extracts containerActionForStack helper from stacks.ts for reuse. * chore(fleet): rename Actions tab to Fleet Actions and reorder Fleet sub-tabs - Tab label "Actions" -> "Fleet Actions" so the surface is unambiguous alongside Schedules and the sidebar bulk bar. - Reorder Fleet sub-tabs as Overview / Snapshots / Status | Deployments / Traffic / Fleet Actions, with the separator after Status. - Rename "Traffic · Routing" -> "Traffic" and update Sencho Mesh docs to match the shorter label. - Update Fleet Actions docs to the new tab name and placement.	2026-05-07 05:41:53 -04:00
Anso	7fe90d9f3a	feat(blueprints): capture compose snapshot before stateful eviction (#957) ... Wire the snapshot_then_evict withdraw mode to actually persist the blueprint's compose YAML to fleet_snapshots before running the eviction. The mode previously recorded intent only. Capture failure aborts the eviction with HTTP 500 rather than silently falling through to a destructive withdraw. Volume bytes remain out of scope: the snapshot holds the compose definition only. UI copy and the Blueprints docs (Withdraw note, Migrating stateful data section, two new Troubleshooting entries) clarify that operators must move volumes by hand if they need the data on another node. Adds 9 route-level tests covering the success path, snapshot DB write failure, orphan-row cleanup when insertSnapshotFiles fails, empty compose_content, evict_and_destroy unchanged, stateless unchanged, evict_blocked gate, omitted confirm field, and bad confirm value.	2026-05-06 21:58:45 -04:00
Anso	aa00dc2b89	docs: split Features by capability and tighten nav (#956) ... Subdivide the 40-page Features sidebar into six capability subgroups (Stacks & Deployments, Observability, Fleet & Multi-Node, Security & Identity, Automation, Platform) so users find features by purpose rather than scrolling a flat list. Move the licensing page into the Reference group where it belongs and reorder Reference for scan-ability. Reorder the Operations group by lifecycle: install, upgrade, backup, troubleshoot, then per-feature admin tools. Nav-only change. No .mdx files were moved or renamed; every page keeps its existing URL. Tier badges already inside each page are unchanged.	2026-05-06 21:22:18 -04:00
Anso	ecf4dd5d52	feat: open security basics, manual fleet ops, and basic fleet management to Community (#930) ... Realign tier guards to the user-stated philosophy: Community covers deploy/monitor at scale plus security basics, Skipper adds automation and advanced fleet management, Admiral keeps enterprise control. Community now includes: - Trivy install / uninstall / update from the Settings Hub (admin role) - CVE suppressions CRUD (admin role; replicates fleet-wide) - Manual image scan with vuln, secret, and misconfig results - Stack-config scan, scan comparison - Manual fleet snapshots: create, list, view, restore, delete - Per-node Sencho self-update (Check Updates + per-node Update) - Fleet Overview search, sort, filters, node-card expand, auto-refresh Stays paid: - Scan policies with block_on_deploy enforcement (Skipper+) - SBOM (SPDX, CycloneDX), SARIF export (Skipper+) - Bulk Update All across the fleet (Skipper+) - Scheduled snapshot create (now Skipper, was Admiral) - Trivy auto-update toggle, fleet-wide policy push (Admiral) The Settings -> Security tab is unhidden by setting the registry tier to null. The SecuritySection no longer early-returns a PaidGate; the policy list, Add Policy button, and policy dialogs are wrapped in {isPaid && }. The Fleet view drops isPaid gates on the Snapshots tab, Check Updates button, per-node update handlers, OverviewToolbar grid controls, the NodeCard expand affordance, and the auto-refresh notice. The NodeUpdatesSheet receives a canBulkUpdate prop and gates the Update All button on it. useFleetUpdateStatus and useFleetPolling drop their isPaid guards so polling runs for Community; useFleetOverview drops the isPaid wrap on the filter and sort path. Backend route guards are flipped per the matrix above. The scheduler tick and requireScheduledTaskTier add 'snapshot' to the Skipper+ branch. Backend test assertions are inverted for the now-Community endpoints and a positive Skipper-snapshot-task test is added. Documentation across features/, api-reference/, and operations/ is updated to reflect the new tier mapping.	2026-05-05 12:54:26 -04:00
Anso	a85af40cb5	fix(frontend): tighten bell notification panel toolbar (#929) ... * fix(frontend): tighten bell notification panel toolbar Restructure the popover so the segmented filter (All / Unread / Alerts) and the action icons (filter toggle, mark all read, clear all) share a single row inside the 360px panel. The previous layout wrapped the segmented control onto a second row once the type filter was added. Move the unread badge to the right of the title, collapse the node and type dropdowns behind a filter-toggle icon (accent dot signals an active filter), equalize both Select widths, and extract the duplicated className strings into local constants. * docs: refresh bell notification popover screenshot Reflects the reworked toolbar (segmented filter + filter toggle + mark-all-read + clear-all on a single row).	2026-05-05 09:36:49 -04:00
Anso	49d775c61f	feat(volumes): add read-only volume browser (#926) ... * feat(volumes): add read-only volume browser Adds a browser for the contents of any Docker named volume. Click the folder icon on a volume row (admin only) to open a sheet with a directory tree on the left and a file viewer on the right. Backend ------- New VolumeBrowserService spawns a one-shot Alpine 3.20 helper container with the target volume mounted read-only at /v. The container runs as nobody (65534:65534) with a read-only rootfs, no network, all caps dropped, no-new-privileges, and capped at 64 PIDs and 128 MiB. The helper image is pulled on first use per node. Listing and stat use a portable busybox-compatible shell loop (find -printf is not available on Alpine). Reads use head -c with an explicit -- separator; the helper's working directory is /v so user paths are passed as ./<path> argv elements and never as flags. The container lifecycle is managed manually (create, attach, start, wait, remove) to avoid the AutoRemove race where dockerode sees a 404 on its post-exit container lookup. Path safety: relative paths are sanitized server-side, rejecting parent-escape segments, absolute paths, null bytes, and oversized input. Symlinks are listed but never followed on read. Files larger than 5 MB are truncated; binary content is detected via null-byte scan and returned base64-encoded. Non-zero helper exits map to 404, 403, or 500 by classifying stderr. Routes mounted at /api/volumes: - GET /:name/list?path= - GET /:name/stat?path= - GET /:name/read?path= All three require admin. The read endpoint always inserts an audit log row (success or failure) with the actual response status code, volume name, and relative path. Frontend -------- FileTree generalized to take a loadDir callback and a sourceKey instead of a hard-coded stackName. The single existing consumer (StackFileExplorer) was updated and its tests rewritten. The loader is read through a ref so re-creating the arrow on every parent render does not re-trigger the root fetch effect. New VolumeBrowserSheet renders the tree against the volume API, shows file content (hex view for binaries), and surfaces truncation. Rapid sheet open and reopen on different volumes is generation- checked to avoid stomping the visible result with a stale read. A persistent footnote reminds the user that file reads are recorded in the audit log, and the docs page warns about the typical contents of database volumes. Tests ----- 15 new vitest cases cover the pure helpers (path traversal, volume name validation, binary detection). The Docker-facing exec path is exercised by manual end-to-end via curl against a seeded volume. * fix(volumes): truncate long volume names in browser sheet header Wide volume names overlapped the close X. Reserve right padding on the header, set min-w-0 on the flex title, mark the icon and refresh button shrink-0, and truncate the name span. * fix(volumes): satisfy lint on volume browser additions prefer-const on sanitizeRelPath's local; drop unused FileTree entry arg from the file-select callback (variance lets the arrow take fewer params than the contract).	2026-05-05 00:09:40 -04:00
Anso	7e5dc2d9ea	feat(resources): add image details sheet with layer history (#925) ... Adds a read-only inspect panel for Docker images. Click the eye icon on any image row to open a sheet showing: - Overview: ID (with copy), size, created date, arch/OS, author, tags - Config: Cmd, Entrypoint, WorkingDir, User, exposed ports, env (collapsible), labels (collapsible) - Layers: ordered history list with size, age, and build command per layer. Empty layers (metadata-only) are dimmed. Backend adds DockerController.inspectImage(id) which combines image.inspect() and image.history() in parallel, exposed via GET /api/system/images/:id. The route accepts both bare hex IDs and sha256-prefixed IDs, since the list endpoint surfaces the prefixed form. Returns 400 for malformed IDs and 404 for missing images. Documents the new panel in docs/features/resources.mdx under Images.	2026-05-04 23:45:54 -04:00
Anso	945259f048	refactor(frontend): migrate CreateStackDialog to Modal chrome system (D-4) (#908) ... * refactor(frontend): migrate CreateStackDialog to Modal chrome system (D-4) Swap raw shadcn Dialog/DialogContent/DialogHeader/DialogFooter for the Modal/ModalHeader/ModalBody/ModalFooter primitives shipped in D-1 and introduce an inline ModeRail to replace the TabsHighlight chip. The new chrome carries the cyan rail, mono kicker (STACKS · NEW), italic serif title, and contextual footer hints per mode (ALPHANUMERIC · HYPHENS, HTTPS REPOS ONLY, CONVERT FIRST / YAML READY + line-count accent). ModeRail implements the full WAI-ARIA tabs pattern: aria-selected on the active tab, aria-controls/role=tabpanel/aria-labelledby linkage to each mode panel, roving tabIndex (active=0, inactive=-1), and ArrowLeft / ArrowRight / Home / End keyboard navigation matching the contract that the prior shadcn Tabs primitive provided. Each mode also gains an explicit Cancel button alongside the existing primary action, the empty-mode primary button is now disabled until the stack name is non-empty, and the ModeRail disables itself while a Git or docker-run create is in flight. The async handlers (handleCreateStack, handleCreateStackFromGit, handleConvertDockerRun, handleCreateStackFromDockerRun) and form-reset helpers are unchanged; this PR is structural plus the segmented-control redesign called out in the migration tracker as the D-4 risk note. * test(e2e): align git-sources spec with new CreateStackDialog title D-4 renamed the dialog title from "Create New Stack" to "New stack". The shared openCreateStackDialog helper in git-sources.spec.ts was still asserting the old literal, so three tests in the "Create stack from Git" group failed at the helper's first assertion. Update the assertion to match the shipped title and refresh the two stale references in docs/features/stack-management.mdx so the docs stay in sync with the UI copy. * test(e2e): use dialog accessible name in openCreateStackDialog helper The previous helper used getByText('New stack') which matched two elements: the dialog title h2 and the sr-only description (which starts "Create a new stack: empty, ..." and contains the substring). Playwright fails with a strict mode violation. Switch to getByRole('dialog', { name: 'New stack' }), which asserts the dialog by its accessible name (provided by DialogTitle via the Radix aria-labelledby wiring). One match, more precise, and independent of any future description copy.	2026-05-04 11:17:29 -04:00
sencho-quartermaster[bot]	577acc056b	docs: refresh screenshots (#882) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 13:56:08 -04:00
sencho-quartermaster[bot]	9ba6b604e3	docs: refresh screenshots (#869) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 01:15:46 -04:00
Anso	5e29649f3e	chore: workflow hardening (husky+commitlint, dependency-review, stale, GHCR, mesh-sidecar digest) (#863) ... * chore(repo): enforce Conventional Commits via husky and commitlint release-please parses commit subjects on main to compute the next version and regenerate CHANGELOG.md. A non-conforming commit silently breaks both, so the format must be enforced at commit time, not by review. Adds husky 9 to wire a commit-msg hook, commitlint with the conventional config, and a small rule override (loosen subject length to 120 chars, disable subject-case so existing imperative subjects keep passing). The prepare script runs husky on npm install so contributors do not need to configure it manually. * ci: add dependency-review workflow GitHub-native action that diffs the PR's manifests (package.json, package-lock.json) against main and fails when a new transitive dep introduces a high or critical CVE. Existing vulnerabilities tracked in security/vex/sencho.openvex.json and the Trivy scan in ci.yml are not re-flagged here. Pinned to actions/dependency-review-action v4.9.0 by commit SHA. Comment summaries are posted to the PR only on failure to keep the conversation clean on green PRs. * ci: add stale workflow for issues and pull requests Marks issues and PRs as stale after 60 days of inactivity and closes 14 days later unless re-engaged. Issues labeled pinned, security, bug, or tracking are exempt and never auto-closed; PRs labeled pinned or security are exempt. Runs daily at 01:30 UTC and processes up to 30 items per run to stay within the action's rate budget. Pinned to actions/stale v10.2.0 by commit SHA. * chore(repo): route new issues to docs, discussions, and security policy Disables the blank-issue option and adds three contact links the issue chooser surfaces above the bug-report and feature-request templates: docs.sencho.io for setup questions, GitHub Discussions for open-ended chat, and the repository security policy for private vulnerability reports. This keeps the bug tracker focused on actionable bug reports and feature requests instead of support questions. * ci(docker): publish multi-arch image to GHCR alongside Docker Hub Mirrors every released sencho and sencho-mesh image to ghcr.io with the same tags, signing, and supply-chain attestations as the Docker Hub copy. Same content; pull from whichever registry your environment prefers. - Adds packages:write to both publish jobs so the auto-provisioned GITHUB_TOKEN can push to ghcr.io/studio-saelix/sencho and -mesh. - Adds a second docker/login-action step authenticating to ghcr.io. The Docker Hub login still resolves credentials from the production env. - docker/metadata-action now lists both image references; one buildx push attaches the manifest to both registries in a single round trip. - Cosign keyless signing already loops over $TAGS, so adding the GHCR reference is enough to sign both digests. - The cosign attest step now loops over both registry paths so SBOM (CDX + SPDX) and OpenVEX attestations are resolvable from either registry. Quickstart and image-verification docs note GHCR as an alternative pull source with identical content. * fix(mesh-sidecar): pin base image by digest The main Sencho Dockerfile pins every base image by sha256 digest so a republish of an upstream tag cannot silently shift content into a release. The mesh-sidecar Dockerfile pinned node:22-alpine by tag, which is exactly the gap that pinning closes. Resolves node:22-alpine to its current multi-arch index digest (covers linux/amd64 and linux/arm64) and threads it through both build stages via a single ARG so a future digest roll only edits one line. The inline comment documents the resolution command. The sidecar holds an outbound websocket and has no inbound HTTP listener, so adding a HEALTHCHECK is intentionally out of scope: a process-liveness probe would be tautological with Docker's restart policy. The Dockerfile now records that decision so it does not get reopened on every audit. * ci(docker): use repository_owner for GHCR login username github.actor varies by event source (the maintainer who merged the release PR on tag pushes, github-actions[bot] on bot-driven runs, the dispatcher on workflow_dispatch). The username field is metadata only; GITHUB_TOKEN is what authenticates against GHCR. github.repository_owner resolves to a fixed value (studio-saelix) on every event and matches GitHub's own example workflows for GHCR push. * chore(repo): tighten commit subject-case rule Disabling subject-case entirely allowed accidental ALL-CAPS or PascalCase subjects through. Restrict to "never upper-case or pascal-case" instead, which preserves the lowercase / kebab-case norm of this repo and lets sentence-case subjects (used sparingly on main) keep passing.	2026-05-02 00:49:49 -04:00
sencho-quartermaster[bot]	7cde9917a5	docs: refresh screenshots (#866) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 00:43:40 -04:00
Anso	e5391e66cb	feat(blueprints): add Fleet > Deployments tab UI, node labels, and docs (#861) ... Implements the frontend layer for the Blueprint Model feature (backend landed in PR #860). Fleet > Deployments tab is now live for Skipper+ users; Community users see the existing locked badge. Key additions: - blueprintsApi.ts: typed apiFetch wrappers (localOnly: true on all calls) - BlueprintCatalog: featured hero, filter pills, classification-chipped tile grid - BlueprintEditor: Monaco YAML editor with debounced live classification, label/node selector, three-mode drift radio cards, create/edit modes - BlueprintDeploymentTable: per-node status rows with action buttons (Confirm deploy, Retry, Withdraw/Evict, DATA PINNED HERE for stateful) - EvictionDialog: dual-affordance (Snapshot then evict / Evict and destroy) - StateReviewDialog: fresh-deploy acceptance gate for stateful blueprints - BlueprintClassificationBanner: real-time stateless/stateful/unknown banner - DeploymentsTab: wires catalog, empty state, and create dialog - BlueprintDetail: Sheet with Apply/Edit/overflow, themed delete dialog - NodeLabelPicker + NodeLabelPill: label CRUD per node in NodeManager - FleetView: gates Deployments tab behind isPaid; mounts DeploymentsTab - NodeManager: Labels column with NodeLabelPicker (Skipper+ users) - docs/features/blueprint-model.mdx + docs.json entry + 6 screenshots	2026-05-01 19:47:05 -04:00
Anso	7663f4cd8b	feat(fleet): sencho mesh in traffic and routing tab (#858) ... * feat(fleet): sencho mesh in traffic and routing tab Lights up Sencho Mesh: cross-node container forwarding rendered as if the container next to you were on localhost. Builds on the dormant TCP frame plumbing from the prior PR (pilot tunnel TCP frames + sencho-mesh sidecar package) and exposes the Admiral-only orchestrator surface. Backend - New mesh_stacks table (per-node opt-ins) + nodes.mesh_enabled column via DatabaseService.migrateMeshTables. - MeshService singleton: sidecar lifecycle via Dockerode, opt-in/out with cascading override regeneration, request-based resolver from sidecar control WS, cross-node TCP forwarding via PilotTunnelManager (same-node fast path included), in-memory 1000-event activity ring buffer with durable mirror to audit_log for state-change events, per-node and per-route diagnostics, and the Test upstream probe. - MeshComposeOverride: pure YAML generator that injects extra_hosts using host-gateway. The user's docker-compose.yml is never mutated; overrides live under DATA_DIR/mesh/overrides. - ComposeService deploy/update splice the override file when the stack is opted in; non-mesh stacks behave identically to today. - Pilot agent resolveMeshTarget consults the local mesh_stacks table (defense in depth) and resolves Compose containers via Dockerode. - /api/mesh router with 13 Admiral-gated endpoints covering status, enable/disable, stack opt-in/out, alias listing, per-route diagnostic, Test upstream probe, per-node diagnostic, sidecar restart, activity log paginated and SSE. - meshControl WS slot at /api/mesh/control validates the mesh_sidecar JWT minted by MeshService; dispatched as upgrade slot 2 (canonical order preserved). Frontend - New Traffic Routing tab in FleetView, gated by isAdmiral and wrapped in AdmiralGate. Tab uses the cyan brand glyph and italic-serif state typography from the audit. - RoutingTab masthead with mesh activity drawer, per-node card grid with TogglePill, alias rows with five-state pill taxonomy (healthy / degraded / unreachable / tunnel-down / not-authorized), inline Test buttons. - Four sheets: opt-in picker with port-collision inline error, per-route detail with diagnostic + filtered activity, per-node diagnostics with active streams + resolver cache + restart action, fleet-wide activity log with filters. - meshRouteState helper centralizes pill-state mapping; pure-function tests cover all five states. Docs - User docs at /docs/features/sencho-mesh.mdx covering opt-in, troubleshooting, security model (4 guarantees + 4 explicit non-guarantees), and V1 limitations. - Internal architecture and runbook pages. - websocket-dispatch internal doc updated with the new slot. * fix(mesh): validate stack name before path use; fix test DB lifecycle Two surgical fixes against the prior PR. Path-injection (CodeQL js/path-injection): MeshService.optInStack, optOutStack, ensureStackOverride, and removeStackOverride now validate stackName via isValidStackName from utils/validation, reject malicious names at the API boundary, and additionally check isPathWithinBase on the resolved override file path for defense in depth. The dataflow from req.params.stackName to fs.writeFile no longer reaches an unsanitized path expression. Test DB lifecycle: mesh-service.test.ts used per-test setupTestDb / cleanupTestDb, which deletes the temp dir while DatabaseService still holds an open SQLite handle. On Linux CI this raises SQLITE_READONLY_DBMOVED on the next prepare() because the inode has been unlinked. Switched to file-scoped beforeAll/afterAll matching agents-routes.test.ts, with a per-test beforeEach that truncates mesh_stacks plus non-default nodes and resets the MeshService singleton in-memory state. Adds a new test case asserting the path-traversal rejection. * fix(compose): use discovered compose filename instead of hardcoded docker-compose.yml composeArgs() hardcoded `-f docker-compose.yml` for every deploy. Sencho writes its canonical compose file as `compose.yaml`, so any stack created via the UI failed to deploy with `open ...docker-compose.yml: no such file or directory`. When no mesh override applies, drop the explicit `-f` so docker compose's built-in discovery resolves the actual filename. When an override exists, look up the real base filename via FileSystemService.getComposeFilename() and pass both files explicitly. Also hoist the MeshService import to module top now that the dependency is known to be acyclic, and revert the matching unit-test assertion.	2026-05-01 01:50:53 -04:00
Anso	a25acbec7c	feat(editor): opt-in diff preview before save (#855) ... * feat(editor): add useComposeDiffPreviewEnabled hook * feat(editor): add ComposeDiffPreviewDialog component * fix(editor): replace HTML entity with Unicode arrow in ComposeDiffPreviewDialog * feat(editor): add diff preview toggle to Appearance settings Added a new 'Diff preview before save' toggle in the Display section of the Appearance settings panel. Users can now enable or disable the side-by-side diff view before compose and env file edits are saved to disk. * feat(editor): wire diff preview dialog into compose save flow * fix(editor): snapshot diff content at open time and fix event name - Fix useComposeDiffPreviewEnabled and useDeployFeedbackEnabled to use the canonical SENCHO_SETTINGS_CHANGED constant from @/lib/events instead of the hardcoded string literal (wrong value) - Snapshot language, original, modified, and fileName into diffPreview state at click time to prevent tab-switching from corrupting dialog content mid-review - Remove React.MouseEvent from diffPreview state; pass a no-op stub to deployStack in the confirm path (preventDefault/stopPropagation are no-ops on an already-settled event anyway) - Add diff-modal screenshot and document the feature in editor.mdx and settings.mdx * docs(editor): add settings-toggle screenshot for diff preview feature	2026-04-30 22:01:17 -04:00
Anso	3e01daf76f	feat(stack): per-stack activity timeline with actor attribution (#852) ... * feat(stack): per-stack activity timeline with actor attribution Adds an Activity tab to the Stack Anatomy panel showing a timestamped event log for each stack: deploys, restarts, starts, stops, and image updates, attributed to the user who triggered them or 'system' for automated actions. Backend: - Extends notification_history with actor_username column (idempotent migration) and a partial composite index on (node_id, stack_name, timestamp DESC) for efficient per-stack lookups. - NotificationService.dispatchAlert() accepts an optional actor that is written to the new column. - Success-side dispatchAlert calls added after deploy, bulkContainerOp (start/stop/restart), and update handlers in routes/stacks.ts so user-initiated operations are recorded, not just failures. - New GET /api/stacks/:stackName/activity?limit&before endpoint with stack:read permission gate and cursor-based pagination. Frontend: - StackAnatomyPanel grows an Anatomy / Activity tab pair using the existing Tabs primitive. - StackActivityTimeline fetches the initial 50 events, paginates on demand, and prepends live events arriving over the existing WS notifications stream without duplicates. - NotificationPanel bell dropdown suppresses user-initiated success events (start/stop/restart/deploy/update triggered by a real user), keeping the tray focused on alerts and system events. * docs(stack): add stack activity timeline feature page and internal arch docs * fix(test): add actor_username to notification-routing history assertions dispatchAlert now passes actor_username to addNotificationHistory after the activity timeline PR added the column. Update the two exact-match assertions that were failing because the expected object shape was missing this field.	2026-04-30 19:53:23 -04:00
SaelixCode	b5d0e7e4db	chore: verify docs sync in new organization	2026-04-29 15:53:45 -04:00
SaelixCode	2c85bc7219	Merge branch 'main' of https://github.com/AnsoCode/Sencho ... # Conflicts: # package.json	2026-04-29 09:28:43 -04:00
SaelixCode	3da0aa6036	chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho ... Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.	2026-04-29 09:24:20 -04:00
sencho-quartermaster[bot]	a2d06a2ef6	docs: refresh screenshots (#843) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-29 05:54:52 +00:00
Anso	f318ec5523	docs: updates to the README and screenshots (#834)	2026-04-28 12:57:45 -04:00
sencho-quartermaster[bot]	8d3fc1bc77	docs: refresh screenshots (#832) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-28 14:33:18 +00:00
sencho-quartermaster[bot]	5d376590f8	docs: refresh screenshots (#809) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 15:06:14 +00:00
sencho-quartermaster[bot]	3f4f7c6135	docs: refresh screenshots (#805) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 13:14:15 +00:00
sencho-quartermaster[bot]	fb88ea41ed	docs: refresh screenshots (#800) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 04:56:43 +00:00
Anso	3668c71860	feat(security): add SBOM attestations, VEX document, and retire .trivyignore (#790) ... * feat(security): add SBOM attestations, VEX document, and retire .trivyignore Add OpenVEX triage document (security/vex/sencho.openvex.json) for the 5 residual CVEs vendored inside docker/compose v5.1.2 that were carried over from the previous PR. All 5 are marked not_affected with justifications. Configure Trivy in both CI and release workflows to consume the VEX document via trivy.yaml so the same source of truth gates PR scans and release scans. Delete .trivyignore, which is fully superseded by the VEX file. Add two new release pipeline steps after image publication: - CycloneDX 1.6 SBOM via anchore/sbom-action (also installs syft) - SPDX 2.3 SBOM via syft directly (reuses OCI layer cache from prior step) Both are attached as cosign OCI referrer attestations (keyless, OIDC-signed) and uploaded as GitHub Release assets alongside the OpenVEX file. Bump docker-publish.yml permissions from contents:read to contents:write, required for softprops/action-gh-release to create Release assets. Add docs/operations/verifying-images.mdx with copy-paste verification commands for all supply-chain artifacts: signature, SLSA provenance, CycloneDX SBOM, SPDX SBOM, OpenVEX, and Rekor entry. Update docs.json navigation and expand the Supply chain security section in docs/security.mdx. Add a Verifying Release Artifacts section to SECURITY.md. * fix(vex): cover otel SDK CVE-2026-39883 in rebuilt Docker CLI binary The rebuilt Docker CLI v29.4.0 vendors otel/sdk v1.42.0, which still contains CVE-2026-39883 (BSD kenv PATH hijacking; fixed in v1.43.0). docker-compose v5.1.2 vendors otel/sdk v1.38.0 separately. The original VEX statement only covered the compose binary's location and version, so Trivy's scan of /usr/local/bin/docker was not suppressed. Add a second subcomponent entry for the CLI binary path with the correct vendored version. The not_affected justification (BSD-only code path; we ship linux/amd64 and linux/arm64 only) holds for both binaries. * fix(ci): use list form for vulnerability.vex in trivy.yaml Trivy's config schema requires vulnerability.vex to be a list (mapped to the multi-value --vex flag). The previous bare-string value was silently dropped, so the OpenVEX document was never loaded and HIGH findings already covered by VEX statements still failed the scan. * fix(ci): mirror VEX CVE in .trivyignore for local-image scan Trivy does not emit an OCI purl for locally-built images without a RepoDigests entry (aquasecurity/trivy#9399), so OpenVEX product matching against the CI build target sencho:pr-test resolves to no artifact and every statement is silently dropped. The VEX document remains the canonical triage record and is still attached as a cosign attestation on the published image; this file just mirrors the single CVE that surfaces on the local scan so CI does not block on a finding already triaged in VEX. Updates the Trivy step comment to document the relationship between the two files.	2026-04-26 23:21:11 -04:00
Anso	d7d8f9bfe8	feat(dashboard): replace 24h charts with Configuration Status and Recent Activity (#785) ... * feat(dashboard): replace 24h charts with Configuration Status and Recent Activity The 24-hour CPU/Memory area charts summed per-container metrics normalized to each container's CPU quota, producing numbers that bore no honest relationship to host load. The live ResourceGauges strip already shows accurate host-level stats, making the historical charts both inaccurate and redundant. This commit replaces that row with two side-by-side cards: - **Configuration Status**: aggregates every toggleable feature on the active node (notification agents, alert rules, routing rules, auto-heal, auto-update, webhooks, scheduled tasks, MFA, SSO, vulnerability scanning, cloud backup, and alert thresholds) into a single at-a-glance card. Tier-locked rows display an upgrade indicator instead of a value. Each row is clickable and navigates to the relevant settings section. Data refreshes every 60 s and immediately on state-invalidate events. - **Recent Activity**: lists the ten most recent notification-history events for the active node (deployments, image updates, auto-heal actions, scan findings, cloud backup events, system notices) with category icons and relative timestamps. Refreshes every 30 s. New backend endpoints: - GET /api/dashboard/configuration - per-node feature status with locked/ requiredTier markers so the frontend renders upgrade chips without extra calls. The endpoint sits after authGate and before the remote proxy so remote-node requests are transparently forwarded. - GET /api/dashboard/recent-activity?limit=N - thin wrapper over DatabaseService.getNotificationHistory. - GET /api/fleet/configuration - fleet-wide fan-out using the same Promise.allSettled dead-node-tolerant pattern as /fleet/overview. Exposed as the new "Status" tab on the Fleet page (after Snapshots). Shared utilities: - visibilityInterval and formatCount extracted to frontend/src/lib/utils.ts so the three polling hooks and two components share a single copy. * docs(dashboard): fix stale alt text referencing removed historical charts	2026-04-26 18:42:28 -04:00
Anso	03f91cd5bb	feat(cloud-backup): mirror fleet snapshots to S3-compatible storage (#782) ... * feat(cloud-backup): mirror fleet snapshots to S3-compatible storage Add an Admiral-tier Cloud Backup feature that replicates every fleet snapshot to off-site storage, with two provider modes that share the same `@aws-sdk/client-s3` code path: - Sencho Cloud Backup: zero-config, 500 MB allowance backed by Cloudflare R2, provisioned via the sencho.io worker against the user's Lemon Squeezy license. - Custom S3 (BYOB): any S3-compatible bucket (AWS, MinIO, Backblaze B2, Wasabi, R2 with own keys), with credentials encrypted via `CryptoService` before storage. API-triggered snapshots upload fire-and-forget so the UI returns immediately; scheduled snapshots block on the upload so the task's success/failure reflects cloud durability. Object keys include the instance_id segment to prevent collisions when the same Admiral license is activated on multiple Sencho instances. * fix(cloud-backup): drop ES2022-only Error cause arg breaking ES2020 build The backend tsconfig pins lib to ES2020. The two-argument `Error(message, { cause })` form requires ES2022, so tsc rejected it with TS2554. Revert to single-argument throw to match the convention used elsewhere in the backend services.	2026-04-26 15:42:21 -04:00