799 Commits

Author	SHA1	Message	Date
Anso	866d784316	feat(notifications): customizable per-channel JSON payload templates (#1805) ... Add an optional Edit Payload editor to every notification channel (Discord, Slack, Webhook, Apprise, ntfy). A saved template replaces the built-in payload for that channel, with {{level}}, {{message}}, {{category}}, {{timestamp}}, {{stack_name}}, and {{actor}} substituted as JSON-escaped values (variables may stand alone or be mixed into strings). Templates are validated on save: known variables only, no unterminated tokens, valid JSON after substitution, 8000 characters max. Apprise keeps urls/tag managed by the channel fields and merges them server-side at dispatch. ntfy publishes JSON instead of plain text when templated. Test dispatch uses the editor template.	2026-08-11 10:25:29 -04:00
Anso	578ce7684d	feat(git): complete-project materialization with a managed-project manifest (#1786) ... * feat(git): add managed-project manifest types and DB cache columns Introduces the canonical managed-project manifest contract types (schema v1) and the stack_git_sources cache columns manifest_version / manifest_state / manifest_generation. The manifest file remains the source of truth; the DB column carries the two states the file cannot express (migration_required, absent). * feat(git): add vendored Docker .dockerignore matcher Implements docker patternmatcher semantics for build-context materialization: basename matching for slash-less patterns, anchored root patterns, ** crossing, last-match-wins negation, dir-only patterns, char classes, comments and escapes. Table-driven tests cover the full rule set. * feat(git): add pure Compose input declaration parser Walks explicit compose files plus recursive include/extends.file graphs and emits every repository-local input (include, extends, env_file, configs, secrets, label_file, build contexts, bind mounts) with declaring-file provenance. Side-effect free: file contents are injected via a read callback. Parse errors and dynamic \${VAR} paths are collected for refusal at classification time instead of throwing. * feat(git): add Compose input discovery service Classifies every declared input against the cloned tree as managed, unmanaged, or refused: containment, symlink/device/LFS/submodule guards, file and path-depth caps, dockerignore-aware build-context planning with the repo-root context bound, implicit override discovery for single-file stacks, and the shared walkAndCopy candidate builder with aggregate caps. * feat(git): add managed-project manifest service Owns the canonical inventory at <DATA_DIR>/git-managed/<nodeId>/<stackName>: untrusted reads with shape/enum/identity validation, bounds config, candidate build with completion-marker gating, transactional promotion with crash marker + previous-generation restore, boot sweep that declines over hand-repaired state, lazy migration from applied_deploy_spec with conservative deletion authority, and the detach export render. * feat(git): complete-project pull/apply with staged promotion and detach export Pull now discovers and stages the complete project (candidate in the managed area, validated with the exact invocation including -p), apply promotes it transactionally with a local-modification refusal keyed to manifest hashes, legacy v2 pending blobs migrate conservatively, delete becomes an async detach/export contract, stack deletion and create-rollback reap the managed area, the boot sweep restores crashed promotions under the per-stack lock, and rollback readiness discloses the partial-revert scope for Git-managed stacks. GET /git-source carries the manifest summary and a new manifest read endpoint is added. * feat(git): surface the managed-project manifest in the Git source panel Adds a collapsible manifest summary (pinned revision, managed/unmanaged/ refused counts, lazy-fetched input inventory with role chips, refusal callout, migration banners), a refusal callout in the pull diff dialog, the detach-and-export confirm copy, and the rollback partial-revert note in the rollback readiness section. * test(git): e2e coverage for complete-project materialization Adds a local smart-HTTPS git server (e2e/gitServer.helper.ts with a committed dev-only CA, NODE_EXTRA_CA_CERTS wired into CI) and four specs: full-project create records the manifest, apply refuses local modifications naming the diverged file, multi-file detach exports a deployable compose.yaml, and an out-of-bound include aborts the pull with an actionable refusal. * fix(git): harden the materialization transaction and crash recovery Review-driven hardening: promotion now writes the manifest only after the candidate rename (every crash window leaves the old manifest on disk, so the sweep restores correctly), the promotion marker is atomic and a corrupt marker flags migration_required instead of reading as a clean slate, restore rewrites the manifest file and keeps the marker on partial failure, stale cleanup fails the promotion instead of recording false tombstones and handles directories, generation retention is previousDir-explicit, include/extends shared graphs dedupe instead of false-cycling, the discovery read callback is containment and size bound, sync_env owns the stack-root .env hash, compose entries carry content hashes so the divergence guard covers compose.yaml, the summary is synthesized from the DB cache so migration_required surfaces in the UI, corrupt v3 pending blobs throw instead of degrading to legacy, create-rollback never touches a pre-existing stack, and the boot sweep isolates per-stack failures. * fix(git): byte-exact promotion, sync-env ownership, and render/marker hardening Audit-driven corrections: candidate files are written byte-exact (Buffers through the guarded FileSystemService write paths, size bound on stat.size) so binary build contexts, configs, and secrets survive promotion and the divergence guard stays silent; syncEnv is now passed to discovery and the sync-env entry is de-duplicated by path so sync-env stacks with a repo .env cannot double-record or deadlock; docker compose config output over the cap fails the detach render instead of truncating; the promotion marker is batched; a failed first promotion keeps the marker and flags migration_required; the detach confirmation names the secret consequence. Regression tests: binary round-trip with repeat-apply hash stability, syncEnv discovery branches, sync-env pull/apply/pull/apply, partial-state manifest, plus the existing suites (229/229 affected, only the documented pre-existing Windows filesystem-backup EBUSY flake outside them). * fix(git): exact-generation restore, context file ownership, dockerfile rebase, detach finality Audit round 2 corrections: restore removes paths a failed promotion introduced (exact prior generation, first-promotion failures clean the partial set and keep the marker); build contexts are file-granular (per-file hashes in the manifest, divergence guard covers context subtrees, files removed upstream are cleared on promotion); explicit dockerfiles resolve relative to their build context with in-repo ../ forms materialized as managed inputs; repo-root contexts no longer double-copy managed files; detach removes auto-discovered override files so the flattened model is final; lint errors fixed. Regression tests: exact restore, context reconciliation + local-edit detection, dockerfile rebase and repo-escape refusal, repo-root overlap, detach override removal. 213/213 affected backend tests. * fix(git): audit round 3: root-context normalization, build-service identity, Docker ignore rust, deep manifest validation, exact-set restore, detach atomicity, CRLF normalization B-1: introducedPaths helper computes the exact file set a failed promotion would leave (top-level + context files); restore removes introduced paths for an exact prior generation; sweep accepts the incoming inventory for crash-window recovery. B-2: repo-root context (build: .) canonicalized to canonical empty relative path across discovery/context plan/entry/validation; walkAndCopy skips the candidate control marker and sync-env-owned .env so root contexts never copy Sencho metadata into the live stack dir. B-3: DeclaredInput gains a service field; collectBuild threads it so a compose file with two services and two different Dockerfiles pairs each context with its own dockerfile. Additional contexts never inherit the service dockerfile. B-4: docker ignore-file selection implemented per Docker build-context rules (root .dockerignore, with Dockerfile-specific <name>.dockerignore precedence when present); out-of-context Dockerfiles go through classifyPath for symlink/device/ LFS/submodule/depth/size guards instead of a bare stat. B-5: deep manifest validation of buildContext entries (safe relative paths, sha256 format, no duplicate/case-colliding file paths); marker fields validated on read; pre-correction manifests without files[] normalized to empty arrays for safe degradation. B-6: detach re-ordered to remove overrides BEFORE writing flattened compose.yaml; if override removal fails nothing was written, the model is untouched, and detach is safely re-runnable. S-1: ComposeService.ts LFs normalized to repository convention. All 213 affected backend tests pass; tsc + lint clean both sides. * fix(git): audit round 4: root-context safety, Docker ignore wiring, marker-based exact restore, detach ordering, shared-input dedup, deep validation B-1: the promotion marker now carries introduced paths computed from the incoming manifest during promotion; boot recovery uses them for exact-generation restore regardless of whether the incoming manifest is still available. `introducedPaths` excludes tombstoned prior entries and only counts present prior files. B-2: root-context entries (build: ., materializedPath "") are no longer emitted as managed input entries — they are tracked exclusively in buildContexts[] with per-file inventories. `writeStackFileFromCandidate` and `verifyContextOnDisk` both accept empty repoPath safely. B-3: Dockerfile-specific .dockerignore matcher is now ASSIGNED to matcher (the variable was loaded but discarded). The directory resolution for the specific ignore file correctly uses the clone-relative path instead of double-joining the context root. B-4: detach now writes the flattened compose.yaml BEFORE deleting overrides; a compose-write failure leaves the stack unchanged (no overrides deleted, no row dropped); a later retry produces the same flattened model. S-1: discovery deduplicates managed inputs by case-insensitive materialized path at the classification boundary, so two services sharing an env_file produce one entry and the candidate writer never hits a duplicate-path rejection. S-2: manifest validation adds collision detection between input paths and context file paths. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 5: root-context collision fix, marker-based recovery, Docker ignore root case, context divergence, detach rollback B-1: root-context files that collided with managed input paths (compose.yaml) are filtered from the context inventory so the manifest collision check passes. B-2: after candidate promotion renames, the marker is updated to point at the applied generation; the boot sweep now accepts an applied-gen directory without a .candidate-complete marker as valid for recovery. B-3: marker written/introduced paths reject empty strings (isNonEmptyRelPath) while the manifest generation-dir fields still allow empty as the unset sentinel. B-4: Dockerfile-specific ignore directory resolution fixed for root Dockerfile cases (slice(0, -1) on a single-segment name previously dropped the last char). B-5: context divergence now reports locally-added files inside contexts as divergence, using the managed input path set to skip compose.yaml/.env/files that have a non-context owner. B-6: detach now snapshots the prior compose.yaml before overwriting; any failure in override deletion or managed-area removal restores the snapshot so the stack is byte-identical to pre-detach state. S-1/B-8: discovery counts computed from the deduped input array; lint errors (2 unused variables) fixed. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 6: root-context promotion, recovery ordering, context-file merge, divergence precision, detach rollback B-1: root-context files now explicitly promoted from the candidate via a context-file loop after the managed-input promotion step. Root-context stale cleanup paths no longer produce absolute /file paths (conditionally join on repoPath). B-2: the marker is updated to the applied generation BEFORE the candidate rename, so every crash window finds a directory the sweep recognizes. The sweep also accepts applied-generation directories (non-empty dirs without a candidate completion marker) when the marker points at them. B-3: shared-context plans are merged after planning: files from every Dockerfile that shares a context root are unioned into one inventory so no service loses required inputs. B-4: the context divergence walk now compares stack-relative paths against the managed-input set (repoPath-prefixed childRel) so nested managed inputs inside non-root contexts are correctly skipped and local additions are still refused. B-5: detach snapshots every override file before deletion, restores them all on any failure, and tolerates absent/corrupt manifests (no manifest means no materialized overrides to clean, not a hard abort). All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): audit round 7: root Dockerfile containment, inventory-driven context copy, file-only marker recovery, detach transaction B-1: root-context Dockerfile containment check fixed for root contexts ("" or "."). Any repo-relative Dockerfile without ../ is in-context. B-2: context copy now reads from the plan inventory (plan.context.files) instead of re-walking the source with the first matcher. Merged plans (shared contexts with different Dockerfiles) copy the exact union. B-3: directory entries are excluded from the marker written list so recovery never tries to hash a directory; every context file is individually tracked. Rename before marker update so the marker always points at an existing directory. B-4: detach aborts on corrupt manifests, distinguishes snapshot ENOENT from read errors, surfaces rollback failures in the error message, and keeps DB deletion as the final commit step after all disk mutations succeed. All 213 affected backend tests pass; tsc clean; lint 0 errors. * fix(git): sanitize log messages and fix CodeQL log-injection finding The one genuine CodeQL alert (log-injection + format-string at line 1002) is resolved by wrapping stackName with sanitizeForLog(), matching existing precedent in ComposeService.ts and routes/stacks.ts. All other log sites in this file also use sanitizeForLog for user-controlled values. * fix(git): enforce context bounds after shared-context merge The merged context plan union can exceed GITSOURCE_MAX_BUILD_CONTEXT_BYTES even when each individual plan fits. Recheck the cap against the unionized inventory after merging. * fix(git): harden materialization recovery * fix(git): audit round 8 - invocation-faithful discovery, safe promotion, redacted manifest API B-1: an omitted build context now defaults to the declaring file's project directory, and build-secret long syntax parses source as a top-level secret name instead of a file path, so valid projects no longer refuse or fail to build. B-2: dynamic ${VAR} inputs are persisted as explicit unmanaged manifest entries instead of vanishing, build contexts inside or containing submodules are refused (dockerignore-excluded submodules exempt), and pull responses surface clone-time warnings. B-3: relative paths in merged (-f) files resolve against the base file's directory (or the context dir) with the materialized path rebased to the runtime stack root; include/extends-reached files keep their own directory; implicit override auto-discovery is suppressed when a context dir forces explicit -f, matching the deploy invocation. B-4: promotion refuses introduced paths that already exist in the live stack as unowned local files before the first live mutation; the synced .env and fresh-stack creation stay exempt. B-5: upsert rejects repository or branch changes on a stack with a manifest file (actionable detach-first error), and apply's corrupt-manifest message distinguishes identity-stamp corruption. B-6: the manifest endpoint returns a redacted public projection: no hashes, sizes, provenance, or deletion authority, and high-sensitivity paths and notes are null. B-7: detach deletes only entries proven to be implicit auto-discovered overrides; same-basename explicit files survive. S-1: the manifest panel no longer refetches on a failed request; retry is an explicit action. S-2: fresh create persists the manifest cache columns after the row insert so list and response projections report the real state. S-3: git-sources.mdx matches the corrected detach, submodule, and dynamic-path behavior. * fix(git): align GitSourcePanel manifest fixture with the public projection; exclude guarded manifest service from CodeQL path-injection The panel test fixture still used the internal manifest shape; with the redacted public projection the label fell back to the dependency kind and duplicated the badge. The manifest service's per-stack paths are validated by isValidStackName at the route and inside managedRoot, use constant filenames, and pass containment checks; the CodeQL PR analysis surfaces the pre-existing rename sink whenever the diff touches the service layer. * fix(git): restore ComposeService.ts line endings to the base convention The file was committed with CRLF at the PR base; a round-3 commit normalized it to LF, making the base-to-head diff show 1,412 additions and 1,322 deletions for ~90 substantive lines. Restoring CRLF collapses the diff to the functional changes only. * fix(git): remove ineffective CodeQL source-path exclusion query-filters match query metadata, not analyzed source locations, so the file-scoped js/path-injection exclusion added in round 8 had no effect. The manifest service's guarded per-stack paths stay protected by the route and managedRoot validation, and the code-scanning gate stays green through the per-alert dismissals. * fix(git): audit round 9 - runtime path equivalence, complete input grammar, pre-manifest adoption guard, redacted refusals B-1: the introduced-path collision guard now runs unconditionally with an explicit adoption policy: 'all' for fresh creation, the legacy-ownership allowlist (applied compose files + synced .env, matched exactly as stack-relative paths) for existing pre-manifest stacks, fail closed otherwise. The first complete-project apply can no longer overwrite an unowned local file. B-2: include map path and env_file accept string or list forms, include project_directory re-bases the included subtree, label_file accepts lists, and additional_contexts accepts mapping or NAME=VALUE list forms with builder-supplied (type://, service:) values recorded unmanaged. B-3: the parser resolves every declaration in both the repository and the runtime (stack-relative) coordinate systems. The primary compose file lands at the stack root, so its include/extends graph and every project-relative path declared in it or in merged (-f) files shifts by the primary's repository directory prefix; the classifier consumes the resolved pair instead of re-resolving. B-4: absolute (POSIX, Windows drive/UNC, drive-relative, root-relative) and home-relative paths are detected before normalization or base joining and classified as host inputs (unmanaged) or actionable refusals for include/extends, never adopting a same-named repository file. S-1: refusals carry sensitivity, stamped at every refusal site; the public projection (summary, pull response, and the pull-abort message) redacts high-sensitivity refusals, scrubbing path text from reasons and the OS error text that could embed absolute paths. Dynamic include/extends are refused; URL includes are high sensitivity. S-3: ComposeService.ts line endings restored (separate commit). S-2: invalid CodeQL source-path filter removed (separate commit). * chore: bump nanoid to 3.3.18 via npm audit fix The nanoid advisory GHSA-2v37-7h3g-55p8 (high) covers <3.3.17 and was published after the last green CI run; both lockfiles pinned 3.3.16. npm audit fix bumps the transitive dependency to 3.3.18. * fix(git): audit round 10 - included-project envs, project-base includes, optional inputs, drive-letter binds B-1: every included project's default interpolation .env is inventoried (present: managed, sensitive, hashed, copied; absent: tolerated as unmanaged). interpolation: false and same-base includes skip the entry. B-2: include, include-env, and extends.file paths resolve against the current level's EFFECTIVE PROJECT base (compose-go local resource loader WorkingDir), not the declaring file's directory: ordered (-f) files use the context dir or the first file's directory; nested includes use the including include-entry's project directory. Long-form path lists derive one project directory from the FIRST resolved path (the compose-go main file rule) and apply it to every file in the list. Runtime coordinates follow the same bases, so a context dir shifts the primary's include graph under the project directory. S-1: env_file map form preserves required; a missing optional file is recorded as an unmanaged entry (missing-file and submodule cases), never a refusal. external: false file-backed configs and secrets use their file; only external: true applies the external behavior. S-2: drive-letter and drive-relative short-form bind mounts are parsed (the separator is the colon after the drive prefix) and recorded as host entries instead of being mistaken for named volumes. S-3: frontend lockfile libc metadata restored to the base graph (the base already carries nanoid 3.3.18). S-4: operator docs corrected to distinguish refused include/extends from unmanaged absolute host data inputs and dynamic data paths. * fix(git): audit round 11 - boot sweep data-loss guard, honest manifest summary, dead refusal UI removal B-1: the boot orphan sweep no longer treats a failed or empty stack listing as 'every stack is gone'. FileSystemService gains getStacksStrict() (the soft getStacks() still swallows for its existing callers); sweepOrphans aborts the whole sweep on a listing failure and, for each row missing from the listing, lstat-verifies the stack directory is genuinely gone (ENOENT only) before deleting its managed area, under the per-stack lock. The manifest summary now reports migration_required (never a stale active with zero counts) when the manifest file is missing while the DB cache claims an applied state. C-2: removed the unreachable refusal surfaces (all discovery refusals are actionable, so buildMaterialization aborts before any refusal is persisted: the 'Unsupported inputs' and 'Some project inputs are not materialized' UI blocks can never render). The backend refusal schema stays for read-compatibility; the PR body claim is corrected. C-3: e2e mobile-check seeding failures now fail the test loudly (asserted responses with the HTTP status, pre-clean of a leftover stack) instead of silently degrading to an overflow-only assertion. * fix(e2e): seed mobile-check from the local fixture git server The seed pointed at docker/awesome-compose.git with compose_paths ['compose.yaml'], but that repository has no root compose.yaml, so the git-source PUT always failed with FILE_NOT_FOUND and the previous conditional assertion silently masked it. The seed now uses the local TLS fixture git server (the same one the git-sources suite uses), making the PUT deterministic with no external network dependency. * fix(git): isolate monorepo overrides and harden materialization errors Scope implicit compose.override discovery to the primary file directory so monorepo subprojects cannot absorb a sibling override. Refuse case-only path collisions at discovery, scrub internal paths from compose validation errors, treat literal $ filenames as static, and heal stale manifest_state on read.	2026-08-10 17:12:55 -04:00
Anso	017ac57654	perf(frontend): coalesce concurrent stack statuses fetches (#1816) ... * perf(frontend): coalesce concurrent stack statuses fetches Sidebar and dashboard both requested GET /stacks/statuses for the same node; share one in-flight promise keyed by explicit nodeId so boot and invalidate overlap stop doubling the hot path. * fix(frontend): clear statuses coalescer by entry id Avoid Promise identity checks that CodeQL flags as missing await. Numeric entry ids still protect a newer in-flight fetch after logout clear.	2026-08-10 14:57:17 -04:00
Anso	27fe0ae837	fix(auth): honor SSO-only CLI recovery without restart (#1810)	2026-08-09 23:48:44 -04:00
Anso	9798700401	feat(resources): add search, filters, and sort to Rollback generations (#1788) ... Collapsible search, All/Current/Superseded filter pills matching Images/Volumes, sortable columns defaulting to newest-first, and move the long help copy behind an info tooltip.	2026-08-09 20:45:29 -04:00
Anso	e9901aa24b	fix(whats-new): add RBAC entry and a zoomable screenshot lightbox (#1806) ... RBAC is the largest capability change in this release, so it leads the list. Every entry's screenshot now opens full-viewport on click; the overlay is portaled to document.body so it isn't capped at the modal's own frame, dismissible via backdrop click, a close button, or Escape.	2026-08-09 19:24:23 -04:00
Anso	88fc5470e8	fix(hydration-timing): report list hydration relative to the foreground attempt (#1813) ... The headline listVisibleMs was boot-relative, so a navigation or node switch minutes after boot reported page age as the foreground hydration duration. The developer-mode report now distinguishes boot-, node-session-, and attempt-relative durations (schema v2), the collapsed chip shows the attempt-relative foreground value with its anchor, and superseded, aborted, or failed attempts can never become the reported success. The report schema bumps to v2 with explicit anchors: bootAgeMs and the boot->auth/nodes/shell durations, sessionAgeMs and session-relative list visible/hydrated, and lastAttempt* fields resolved from the newest committed list_visible event in the active node session (event-derived, so a later stack-detail attempt cannot steal the headline). listVisibleMs is retained as the raw boot-relative compatibility field. The repeatable performance baseline scenario matrix is documented in the local internal docs (docs/internal/performance/hydration-timing-baseline.md); the post-hot-path-fix baseline capture is a follow-up evidence step.	2026-08-09 19:19:00 -04:00
Anso	4aae09db4a	fix(resources): center rollback state badges in their column (#1807) ... The State header and its badges (Current, Superseded, Recovery required) in Resources > Rollback were left-aligned. Add text-center to both the header and the cell so the column reads as a unit, matching the Actions column's header/cell alignment pairing.	2026-08-08 23:23:52 -04:00
Anso	fe003d5c49	fix(whats-new): backfill entries for unannounced 0.97.0 features (#1804) ... * fix(whats-new): backfill entries for unannounced 0.97.0 features entries.json shipped empty in the What's New scaffolding (#1767), so the top-bar icon stayed hidden through the 0.97.0 release despite several notable features going out. Add entries for the ones that read as genuine news: SSO-only auth, itemized fleet prune plans, the Audit Log, Fleet Secrets, ntfy notifications, and the resizable file explorer. * fix(whats-new): add screenshots to the backfilled entries Each entry now carries a screenshot captured live against a running Sencho instance, cropped to the relevant panel. Real usernames, the client IP, and the real ntfy topic were scrubbed before capture.	2026-08-08 17:51:54 -04:00
Anso	4f30db3abc	fix: truncate long error text in fleet prune estimate per-node rows (#1802) ... Unreachable nodes rendered their error string in a shrink-0 span with no width bound, so a verbose daemon or proxy error pushed the row past the card edge. Bound the error span to 55% and ellipsize, matching the existing pattern in the label-and-stop card; the full message stays available via the row title tooltip.	2026-08-08 17:39:20 -04:00
Anso	bb98cba1f2	fix(compose-doctor): recognize Docker socket proxy topologies (#1791) ... * fix(compose-doctor): recognize Docker socket proxy topologies Classify dedicated socket proxies separately from direct docker.sock mounts so Doctor no longer recommends adopting a proxy the stack already uses. Closes #1790. * fix(compose-doctor): widen socket proxy detection and flag writable proxy sockets Close the remaining gaps in socket proxy topology handling: a service that points at a proxy through a tcp:// endpoint on its command line (how Traefik and friends do it) now gets the client note, proxy API group flags are read for any truthy value rather than a literal 1, and underscore or dot separated proxy names are recognized. Two cases that previously slipped through now surface: a service classified as a proxy purely by name or image but mounting docker.sock read-write is reported as high, and a proxy on the implicit default network or on a network the rendered model does not describe counts as non-internal. A direct socket mount alongside an existing proxy now names that proxy in its fix. * fix(compose-doctor): require corroboration before a service name classifies a socket proxy A service name is free text the author controls, so on its own it could move a writable docker.sock mount out of the high direct-mount finding. A known proxy image is an artifact identity and still stands alone; a proxy-shaped name now counts only alongside an observable fact, a read-only socket or a scoped API group key. * fix(compose-doctor): tighten socket-proxy detection against live upstream behavior Require proxy API flags to be exactly 1 (matching tecnativa and linuxserver images), count only those enabled flags when classifying a proxy, extract tcp hosts from DOCKER_HOST instead of treating key presence as a proxy client, and correlate each client note to one proxy instance by both name and shared network. Soften the published-port finding so it claims reachability rather than Docker API exposure for unrelated ports.	2026-08-08 01:32:26 -04:00
Anso	5c52ae26eb	fix(rbac): make complete built-in RBAC available on Community (#1793) ... Open all five built-in global roles and stack/node scoped assignments on Community. Remove paid fences from user role create/update, scoped assignment CRUD, permission evaluation, and the Users settings UI. Admiral continues to own extended audit governance, LDAP directory integration, and other organizational assurance features. Built-in scoped RBAC is no longer marketed or enforced as paid-only.	2026-08-07 23:50:53 -04:00
Anso	89b16b97d1	chore: bump nanoid via npm audit fix (#1795) ... Resolves GHSA-2v37-7h3g-55p8 (nanoid custom generators can loop indefinitely when size is zero), a newly published advisory for nanoid <3.3.17. Transitive dev dependency of postcss (via vite) in both packages: - backend: nanoid 3.3.16 -> 3.3.18 - frontend: nanoid 3.3.16 -> 3.3.18 npm audit --audit-level=high now passes clean on both packages.	2026-08-07 20:14:24 -04:00
Anso	b9e73f7bd8	fix(fleet-sync): open status and reset-anchor to Community admins (#1792) ... Baseline Fleet Sync already replicates security policy on Community code paths, but status and anchor recovery still required a paid entitlement. Drop the residual paid gates while keeping admin and node:manage authorization boundaries.	2026-08-07 19:52:12 -04:00
Anso	4fa532530e	fix(image-updates): explain persistent digest rebuilds after update (#1784) ... * fix(image-updates): explain persistent digest rebuilds after update When an update completes but a same-tag digest rebuild is still detected, the generic "update still detected" warning told operators nothing about why. The digest comparison already knows the remaining updates are digest-only (no higher tag), so recheckStack now returns a targeted warning naming the two daemon-side causes: a registry mirror or cache serving stale content, or a container still pinned to the previous image. The digest-rebuild badge surfaces (Anatomy banner, Fleet cards, mobile) now carry a tooltip with the same explanation, and the post-update warning is added to the pre-update refresh sanitization set. * fix(image-updates): surface digest warnings on editor and mobile paths Editor Update discarded recheckWarning, digest hints were hover-only, and service-scoped rechecks blamed the daemon when only sibling services remained stale.	2026-08-06 09:22:53 -04:00
Anso	575848e017	fix: keep fleet prune estimate bytes after a target timeout (#1783) ... * fix: keep fleet prune estimate bytes after a target timeout Accumulate successful per-target reclaimable bytes on both the local serial loop and the remote fan-out, mark partial nodes, and surface that state in the Fleet prune card instead of zeroing the whole node. * test: clarify zero-byte partial estimate card case Rename the FleetPruneCard assertion so it matches fold semantics: partial with zero bytes means a successful zero-byte target plus a failure, not an all-failed node. * fix: keep fleet prune estimate resilient on init and partial errors Guard DockerController init so a deleted-node race cannot 500 the whole fleet estimate, surface partial-node failure text in the card row title, and pin the generic-rejection partial path with a fast route test. * test: destroy reverse-route connect-ack sockets on teardown Unguarded accepted sockets could emit a late ECONNRESET after assertions passed, failing the Backend Vitest job with zero assertion failures.	2026-08-05 22:11:03 -04:00
Anso	4e54a9272d	feat: add inspect image action on stack container cards (#1780) ... Open the existing image detail sheet from each container card, between View logs and Monitor, so operators can inspect a container's image without leaving stack details.	2026-08-05 18:10:11 -04:00
dependabot[bot]	a14bd7360f	chore(deps): bump the all-npm-frontend group across 1 directory with 7 updates (#1781) ... Bumps the all-npm-frontend group with 7 updates in the /frontend directory: | Package | From | To | | --- | --- | --- | | [@dagrejs/dagre](https://github.com/dagrejs/dagre) | `3.0.0` | `3.1.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.28.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.0.5` | | [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.9.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.0` | Updates `@dagrejs/dagre` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/dagrejs/dagre/releases) - [Changelog](https://github.com/dagrejs/dagre/blob/master/changelog.md) - [Commits](https://github.com/dagrejs/dagre/compare/v3.0.0...v3.1.0) Updates `lucide-react` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react) Updates `globals` from 17.8.0 to 17.9.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0) Updates `vite` from 8.1.5 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) --- updated-dependencies: - dependency-name: "@dagrejs/dagre" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: lucide-react dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: vite dependency-version: 8.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-05 15:40:58 -04:00
Anso	85b841175a	feat: make the Files explorer tree pane resizable (#1774) ... * feat: make the Files explorer tree pane resizable Operators can drag the Files tab divider to read long or deeply nested names. The width is remembered in this browser; names that still overflow scroll horizontally. * fix: keep Files tree resize from leaking cursor or stealing row clicks Unmount and lost-pointer-capture now clear the drag gesture. The stored width stays a preference while layout clamps to the explorer size, and the hit target only expands into the viewer so full-row context menus still work. * fix: persist last live Files pane width on pointercancel Cancel events can report clientX 0, which was clamping the tree to 160px and writing that to storage. Commit the last tracked width instead, same as lostpointercapture.	2026-08-05 12:50:11 -04:00
Anso	9b481212f6	fix(files): preserve tree expand state after mutations (#1773) ... Stop remounting the file tree on every refresh so expanded folders and scroll position survive delete, move, rename, and save. Relist open directories in place and drop stale collapsed caches.	2026-08-05 08:52:50 -04:00
Anso	63a3594671	fix(ui): restore equal gutters on container logs modal (#1771) ... The terminal panel used w-full with mx-6, so width 100% plus horizontal margins overflowed the overflow-hidden modal and clipped the right gutter. Match BashExecModal by dropping w-full and adding min-h-0.	2026-08-04 23:05:49 -04:00
Anso	a29d451875	fix(resources): attribute free images to managed prune by repository family (#1769) ... * fix(resources): attribute free images to managed prune by repository family After a stack update, unused previous tags lost compose labels and dropped out of managed prune. Match free image repositories still used by managed containers (excluding foreign Compose projects), and clarify the fleet dry-run unlock on the prune card footer. * fix(resources): omit stackName on repo-match managed prune items Repository sharing is not ownership; the confirm list must not show stack attribution for repo-matched free images. Pin repository-key normalization with exact Set assertions so the duplicated parser cannot drift silently. * fix(fleet): bind prune fingerprints to image tag sets RepoTag churn on an already-planned image Id no longer leaves the dry-run fingerprint unchanged, so fleet preflight rejects the whole execute when any node retags. Itemized delete also refuses on reference drift and reports multi-repository refuse without implying a clean no-op.	2026-08-04 16:38:37 -04:00
Anso	011f084e24	chore: hide the What's New setting until an entry exists (#1770) ... The nav trigger already stays out of the top bar while entries.json is empty, but the Settings toggle rendered unconditionally, so About showed a control whose helper text described a sparkle icon that could not appear. The Preferences section now follows the same rule as the trigger. Also gives the toggle an accessible name. Its visible text is only ON/OFF, so a screen reader previously announced the state without the setting it belongs to.	2026-08-04 13:04:51 -04:00
Anso	92d974b13e	fix: condition --volumes in downStack() on the removeVolumes option (#1764) ... * fix: condition --volumes in downStack() on the removeVolumes option ComposeService.downStack() hardcoded --volumes on every stack delete, ignoring the "Also remove associated volumes" checkbox and destroying volumes the operator asked to keep. The sibling Take-down path (runDown) already conditions --volumes correctly. - Add options?: { removeVolumes?: boolean } to downStack() - Default to data-preserving (no --volumes when option absent) - DeletedStackDeletionService reads the persisted intent flag - Templates rollback passes removeVolumes: true (clean up failed deploy) - Blueprint withdraw passes removeVolumes: false (volumes preserved) * docs: update Delete row to reflect conditional volume removal The Delete row now describes that volumes are removed only when the operator opts in, matching the behavior introduced by the downStack fix. * fix: add capability gate for delete pruneVolumes and fix QA findings Four P0 issues found in live QA: P0-1/P0-4 - No capability gate on delete's pruneVolumes: Add stack-delete-prune-volumes capability so the frontend hides the "Also remove associated volumes" checkbox on nodes that don't support conditional volume removal on delete. Without this, an operator on an old node sees a VOLUMES KEPT promise the old node silently breaks. Frontend-only gate: no API or proxy gate because the old node's fallback (always destroy) is correct for the checked case. P0-2 - Checkbox state leaked across dialogs: Reset pruneVolumes in onConfirm before calling the parent, so a previously checked box doesn't appear pre-checked when the dialog opens for a different stack. P0-3 - Delete not bound to the active node: Capture activeNode.id at delete time and pass it as an explicit nodeId to apiFetch, matching the Take Down pattern. Without this, switching the active node while the dialog is open silently deletes the wrong stack on the wrong node. * fix: update test assertions for nodeId binding and showVolumeOption gate P0-3 added nodeId to apiFetch DELETE calls — two useStackActions tests now expect the parameter. P0-1 gated the volume checkbox behind showVolumeOption — the confirming test now passes the prop. * fix: gate volume hint on showVolumeOption to prevent false promise On nodes without stack-delete-prune-volumes, volumes are always destroyed. Showing VOLUMES KEPT was a lie. Now the hint is hidden entirely when the capability is absent. * fix: gate delete against nodes that cannot guarantee volume preservation Hiding the checkbox and the misleading hint stopped the false promise but not the data loss: an unchecked delete against a node lacking stack-delete-prune-volumes still reached that node and its downStack() still destroyed volumes unconditionally, now with no warning at all. - remoteNodeProxy.ts: block an unacknowledged DELETE /stacks/:name (no pruneVolumes=true) to a remote lacking the capability, mirroring the existing removeVolumes gate on the down route. An explicit pruneVolumes=true always proxies through since that matches what an unsupported remote does anyway. - DeleteStackDialog: rework around a three-state model (supported / unsupported / unknown) instead of a boolean. A node whose capabilities have not been confirmed (meta not yet fetched, or a failed probe) is now treated like a supported node, not forced onto the destructive path just because its state is unresolved. - Fix deleteStack's error toast, which surfaced the raw JSON response body instead of the parsed error message. - Fix CreateStackDialog's orphan-stack rollback (docker-run import), which silently no-op'd against a node requiring acknowledgement. - Update node-compatibility.mdx and stack-management.mdx to describe the new gate. * test: advertise stack-delete-prune-volumes on the scoped-evidence fixtures These mock remotes simulate nodes capable enough to run scoped-stack-auth-evidence RBAC and were pinned before stack-delete-prune-volumes existed, so the new delete gate now blocked their unacknowledged DELETE calls before reaching the mock server, failing the grant-tuple-cleanup assertions the tests actually check.	2026-08-04 13:04:21 -04:00
Anso	0b046bfa52	chore: add in-app What's New scaffolding (#1767) ... * feat: add whats-new entries data model * feat: add useWhatsNewPreference hook * feat: add whats-new breathing animation * feat: add WhatsNewTrigger sparkle icon * feat: add whatsNew slot to TopBar * feat: add WhatsNewModal * feat: wire whats-new sparkle icon and modal into EditorLayout * feat: add What's New opt-out toggle to Settings * fix: seed What's New watermark for zero-entry releases A release that ships with entries.json still empty must stamp a watermark on first run, or an existing install can never distinguish itself from a genuinely fresh install once a later release adds its first real entry, silently swallowing that entry's unseen signal. * fix: constrain WhatsNewModal height and clarify settings copy Bound the dialog to 85vh as a flex column so ModalBody's fill can constrain the entry list to scroll while the header and footer stay pinned, matching ConfirmModal's pattern. Also clarifies the "Show What's New" helper text in Settings. * fix: drop What's New screenshots that fail to load Screenshots are authored by hand alongside the entry, so a typo'd or not-yet-added filename is a realistic mistake. Previously that left the browser's broken-image placeholder and alt text inside the card; now the image is dropped and the title, blurb, and doc link still render. * style: replace em dash in watermark comment with a comma * fix: make "Never show again" actually hide What's New Turning the feature off previously only stopped the breathing animation and left the sparkle icon in the top bar, which is not what that label means anywhere else. Opting out now removes the trigger entirely and closes the modal, and Settings > About is the single way back. Also brings the trigger in line with its top bar siblings: it now uses the search trigger's hover treatment and gains a visible keyboard focus ring, and the modal bounds itself with dvh rather than vh so the footer cannot sit under a mobile URL bar. The modal is rendered in the desktop branch only, since the bespoke mobile screens drop the top bar that carries its trigger. * test: cover the empty-entries and loader paths of What's New The shipped state has an empty entries.json, so the branch where there is no newest entry is the one actually running, yet nothing exercised it. Adds a sibling hook test mocking that state to pin the empty-string watermark write, and a loader test for the newest-is-last contract the watermark depends on plus the malformed-entry filter. Drops the unreachable array check in the loader and the assertion that mirrored it: TypeScript types the JSON import, so a non-array file fails the build rather than reaching that branch. * refactor: fold the What's New storage writers into one helper writeEnabled and writeLastSeenId were identical apart from the key and the value encoding, duplicating the comment explaining why a failed write is non-fatal. The boolean encoding now sits at its single call site. Also hoists the reversed entry list to module scope, since the source array is a module constant, and factors the repeated preference mock in the trigger test behind a helper. * chore: keep the What's New icon hidden until an entry exists With entries.json empty there is nothing to announce, so a permanent sparkle in the top bar would only ever open a modal reading "Nothing new to show yet". The trigger now renders nothing in that state, leaving the modal's empty state as a runtime fallback for entries that fail validation rather than the shipping experience. This keeps the scaffolding invisible until the first entry is authored, which is the change that actually surfaces the feature to users.	2026-08-04 02:20:11 -04:00
Anso	4be3319a07	fix: surface NOT_EMPTY error code so DeleteFileConfirm can offer recursive delete (#1765) ... * fix: surface NOT_EMPTY error code so DeleteFileConfirm can offer recursive retry The parseApiError helper discards the backend's machine-readable code field, returning only the human-readable message. DeleteFileConfirm tried to detect non-empty directory refusals by matching the substring NOT_EMPTY against the message text, but the actual server message is "Directory is not empty" (with spaces, not underscores), so the two-step "Delete all" confirmation flow was dead code. Add a NotEmptyError class (mirroring the existing UploadConflictError pattern) and intercept HTTP 409 responses in deleteStackPath so the code is preserved. Replace the fragile string match in DeleteFileConfirm with instanceof. * fix: extend NOT_EMPTY fix to volume roots and fix stale viewer after recursive delete P0-1: sendFsError's helper/ExecError branch (volume-browser deletes) never attached a code field to 409 responses, so the frontend NotEmptyError was never thrown for named-volume non-empty directories. Map ExecError 409s whose message matches 'not empty' to code: NOT_EMPTY. P0-2: The context-menu delete onDeleted callback used an exact-match check (ctxDeletePath === selectedPath) to decide whether to clear the viewer. When deleting a folder containing the open file, the viewer stayed open showing now-deleted content. Use the existing openFileAffectedBy helper (which checks ancestor paths) instead, matching bulk-delete behavior.	2026-08-04 01:37:55 -04:00
Anso	5d89a10754	fix(ui): show delayed busy feedback on confirm actions (#1763) ... Wire ConfirmModal and BusyButton so async confirms lock immediately, show spinner and progressive labels after duration-base, and block dismiss mid-flight. Connect stack delete and take-down to the existing stackAction map so the dialog is not idle until the toast.	2026-08-03 22:14:24 -04:00
Anso	0ba09ebdee	feat: add ntfy notification channel (#1761) ... * chore: bump brace-expansion and fast-uri via npm audit fix Resolves GHSA-rgw5-rvv9-x895 (brace-expansion DoS via unbounded intermediate arrays). Both transitive dev dependencies updated: - brace-expansion 5.0.8 -> 5.0.9 - fast-uri 3.1.4 -> 3.1.5 * chore: also bump frontend deps via npm audit fix Fixes brace-expansion and postcss in the frontend lockfile so npm audit --audit-level=high passes on both packages. * chore: bump ip-address transitive dep via npm audit fix Resolves three new ip-address advisories (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg) published between prior push and CI run. * feat: add ntfy notification channel Add ntfy (https://ntfy.sh) as the fifth notification channel alongside Discord, Slack, Webhook, and Apprise. ntfy speaks its native protocol: plain-text POST body with Content-Type, Title, Priority, and Tags headers. Priority maps info/warning/error to ntfy's default/high/urgent. URL validation allows both HTTP and HTTPS (common for LAN self-hosting) but rejects embedded credentials, consistent with Apprise. Token auth via ntfy's documented ?auth= query parameter is supported. * fix: correct ntfy channel test cases for Linux URL parsing and required type field - notification-channels.test.ts: replace http:///topic host check with a cross-platform invalid-URL case (WHATWG parser treats triple-slash authority differently on Linux vs Windows) - ConfigurationStatus.test.tsx: add ntfy agent slot to makePayload and inline agents fixtures (required by the expanded ConfigurationAgents type) * fix: remove unused import and update 0/4 masthead assertions to 0/5 * ci: exclude NotificationService.ts from js/request-forgery CodeQL rule Notification channel dispatch methods (Discord, Slack, Webhook, Apprise, ntfy) all call fetch() with admin-configured URLs and notification bodies that may embed stack or path data. This matches the trust model already documented for registry-api.ts: single-tenant self-hosted, admin owns the server, outbound posting is the intended behavior. The write path is gated by requireAdmin or requirePermission(node:manage), and every dispatch runs with a 10s AbortSignal.timeout. * ci: also exclude NotificationService.ts from js/file-access-to-http Notification messages may embed stack names, paths, or compose-derived content. Same trust model as js/request-forgery: admin owns the server and the configured endpoints, write path is gated. * fix: correct ntfy channel tab copy and validation error message The ntfy settings tab was reusing the generic webhook label, helper, and placeholder (Webhook URL / JSON payloads / https://...). Give ntfy its own copy: label names the server-and-topic URL, helper states plain-text delivery and the mandatory topic path, placeholder matches the routing section. Also fix the routing-rule validation toast: the guard correctly exempts ntfy from the HTTPS check but the error message was not updated alongside it, so ntfy URLs received a misleading HTTPS-required message. * fix: strip trailing slash from ntfy topic URL before dispatch A topic URL like https://ntfy.sh/mytopic/ validates fine (the check strips the trailing slash internally) but was stored and dispatched with the slash intact, causing the real ntfy server to 404. Normalize before fetch so the request reaches the correct topic path. Also add ntfy to the Channels card description in the settings registry.	2026-08-03 19:29:41 -04:00
Anso	d0f1b9211a	chore: bump brace-expansion and fast-uri via npm audit fix (#1762) ... * chore: bump brace-expansion and fast-uri via npm audit fix Resolves GHSA-rgw5-rvv9-x895 (brace-expansion DoS via unbounded intermediate arrays). Both transitive dev dependencies updated: - brace-expansion 5.0.8 -> 5.0.9 - fast-uri 3.1.4 -> 3.1.5 * chore: also bump frontend deps via npm audit fix Fixes brace-expansion and postcss in the frontend lockfile so npm audit --audit-level=high passes on both packages. * chore: bump ip-address transitive dep via npm audit fix Resolves three new ip-address advisories (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg) published between prior push and CI run.	2026-08-03 16:47:48 -04:00
Anso	71be1634a5	feat: surface ZFS ARC reclaimable as dashboard context line (#1760) ... * feat: surface ZFS ARC reclaimable as dashboard context line Add arcReclaimable to the HostMemory interface and MemoryWire shape so the reclaimable ARC amount computed by readReclaimableArc() is exposed through /api/system/stats and /api/fleet/overview. Show it as a context line on the dashboard memory tile, matching the balloon pattern. ARC continues to feed the gauge percentage as before; this is a display-only addition for operator visibility. * docs: clarify ARC line requires nonzero reclaimable, not just readable stats	2026-08-03 13:44:20 -04:00
Anso	1c9060a855	fix(ui): flatten single-container Update onto the service row (#1759)q ... * fix(ui): flatten single-container Update onto the service row On multi-service stacks, put Update/Rebuild on the container card (left of image source) when a service has one matching container, and keep the shared header only for multi-replica services. * fix(ui): show per-service Update only when an image update is confirmed Registry services were always showing Update because eligibility checked declaredImage/hasBuild only. Gate Update on a confirmed pending check so the button clears after a successful recheck; keep Rebuild for build-backed services.	2026-08-03 10:10:09 -04:00
Anso	5f5cd5ea51	feat(fleet-secrets): graduate encrypted fleet-wide environment bundles to Community (#1758) ... * feat(fleet-secrets): graduate encrypted fleet-wide environment bundles to Community * fix(fleet-secrets): update reachability test for Secrets community graduation * fix(fleet-secrets): address review findings * fix(fleet-secrets): add HTTP-level Community admin push/import tests and non-admin tab-hidden test	2026-08-03 08:42:46 -04:00
Anso	bfabdc2444	fix(fleet-secrets): invalidate stale preview when target inputs change (#1756) ... * fix(fleet-secrets): invalidate stale preview when target inputs change Clear the preview plan and push results whenever a target input (selectedLabels, labelMode, stackName, or envFile) changes, so the operator cannot review a diff computed from different inputs. A version counter in a ref drops in-flight preview/push responses when inputs change while a request is still pending. * fix(fleet-secrets): always surface push results, add invalidation test Remove the version guard from handlePush so a completed secret write always reports its outcome to the operator, even if target inputs changed while the push was in flight. The guard remains on handlePreview (read-only). Add a component test covering: plan cleared on input change, stale in-flight preview discarded, and push results always surfaced.	2026-08-02 23:45:53 -04:00
Anso	41bf075eb0	feat(recovery): make rollback-recovery image lifecycle visible and controllable (#1753) ... * feat(recovery): make rollback-recovery image lifecycle visible and controllable GitHub discussion #1751 asked why Sencho creates sencho-rb/<id>/<service>:hold images during automatic updates and how to clean them up. That surfaced a real safety bug alongside the missing visibility: the manual single-image delete route did not consult the held-image predicate every other deletion path already honors, so a user could delete a rollback-protected image straight through the Images tab and silently break automatic recovery for that update. A short/truncated id also bypassed the predicate's full-id lookup. Fixes: - POST /images/delete now resolves the submitted id to its canonical form and checks the unified held-image predicate before deleting, returning 409 IMAGE_HELD_FOR_ROLLBACK for a protected image. - The Images tab no longer mislabels a protected image as plain "Unused"; a fully-synthetic hold image is kept out of the generic inventory entirely and surfaced instead in a new Resources -> Rollback tab, with an additive "Rollback protected" badge for images that still carry a normal tag too. New capability: - Two settings (Deploy Guardrails): superseded-generation retention (days, replaces a hardcoded 7) and a cap on retained generations per stack. - A new Resources -> Rollback tab lists every generation (stack, short id, state, retention) with an admin-gated manual release action, including releasing the current generation with an explicit warning that automatic rollback becomes unavailable until the next successful update. Release is a single atomic, server-revalidated transition so a stale UI read can never release a row that has since become ineligible. Also consolidated three near-duplicate implementations of the held-image predicate (two of which relied on a require() of a sibling .ts file that silently failed to resolve under the test runner and was never actually exercised by a real test before this change) into one shared module. Known follow-up, not fixed here: an orphaned sencho-rb tag whose recovery row no longer exists (DB restore, node re-add) is invisible in both the Images and Rollback tabs with no UI path to reclaim it. * fix(audit): add summary mapping for rollback generation release * fix(security): sanitize prune target in log sinks and cover release RBAC Closes two open js/log-injection findings on the system prune route by applying the same inline sanitizeForLog barrier the rest of the file already uses. The prune target is validated against an enum by parsePruneTargets before reaching these sinks, so the findings were false positives, but the barrier is cheap and removes the standing alerts on a file this change already touches. Also wraps the generation id in the release log line for consistency with the stack name beside it. Adds coverage for gaps a QA pass identified: - Release endpoint refuses a viewer and a deployer (Admin-only), leaving the generation and its artifacts untouched. - Viewer can still read the generations list, matching the sibling Resources routes. - The predicate the prune routes build reports full-stack rollback holds, not just service-scoped ones, and re-reads per call so a hold taken between plan and delete still gates the delete. - After releasing the current generation, no rollback point is claimed for the stack through any consumer of the current-generation lookup.	2026-08-02 21:55:22 -04:00
Anso	97be019696	feat(fleet): add Node details sheet to the node card kebab (#1752) ... * feat(fleet): add Node details sheet to the node card kebab Every Fleet node card now carries a "Node details" kebab item, open to any role that can see the card (previously the kebab only rendered for users with node-manage permissions, so plain viewers had none). The sheet shows connectivity, live capacity, Compose workload, version/capability compatibility, and governance info (labels, cordon reason and date, default-node flag, Compose directory, registration date) using data the Fleet page already fetches, plus one lazy call to the existing node meta endpoint for capabilities. Wired into both the desktop card and the mobile bespoke Fleet screen. * fix(fleet): correct Node details sheet timestamp units and update-status fallback QA against a live 3-node fleet found that last_successful_contact and pilot_last_seen come back from the fleet-overview endpoint in Unix seconds, but the sheet passed them straight into a milliseconds-only formatter, rendering values like "20647d ago" instead of "just now". Both are now converted before formatting. The Compatibility section's update-status badge also fell through to a confident "Up to date" whenever updateStatus was absent (e.g. on mobile, which doesn't poll update status) instead of reflecting that there was no data to back the claim; it now renders "Unknown" in that case. The local node no longer shows a misleading "Last successful contact: Never". Reworded the "read-only sheet" language in the docs page to describe the sheet accurately, since the Governance section's label picker stays editable for node managers by design.	2026-08-02 21:35:50 -04:00
Anso	c613010199	feat: account for VM memory ballooning in host memory reporting (#1750) ... * feat: account for VM memory ballooning in host memory reporting Extend hostMemory.ts with a readBalloonedMemory() function that parses the Balloon: field from /proc/meminfo, following the same fail-open pattern as the ZFS ARC integration. When a nonzero balloon is detected, effective memory fields (effectiveUsed, effectiveFree, effectiveUsagePercent) are computed and exposed through /api/system/stats and /api/fleet/overview. All consumers that derive meaning from host memory now prefer effective values when present: the dashboard gauge, Fleet card RAM bar, mobile views, health verdict, health status bar stat tile, and host RAM alerts. Backward compatible: missing /proc/meminfo or absent Balloon: line preserves exact current behavior. Old remote nodes without the new fields continue rendering normally. * refactor: extract shared helpers for balloon memory wiring Extract readCandidateFile() and logSelectedPath() in hostMemory.ts to deduplicate ARC and balloon file-read logic. Add memoryToWire() to centralize the optional-field spread used by /api/system/stats and /api/fleet/overview. Add getNodeMemUsed()/getNodeMemTotal() helpers in nodeUtils.ts for frontend byte-text consumers. * fix: make desktop fleet masthead aggregate balloon-aware The desktop fleet overview's memory aggregate in useFleetOverview.ts still summed raw memory.used, while the mobile fleet aggregate and per-node cards already used effective values. Update to use getNodeMemUsed/getNodeMemTotal helpers. * fix: revert balloon adjustment from alerting and health decisions Ballooned memory is host-reclaimed (unlike ZFS ARC, which the guest can reclaim on demand). The guest cannot get ballooned pages back until the hypervisor deflates them, so treating ballooned memory as available for alerting or health can mask real memory pressure. Keep balloon parsing, wire fields, and the dashboard context line as informational-only. The memory gauge, health verdict, and host RAM alerts now use the standard ARC-adjusted working-set percentage regardless of balloon. Updated configuration.mdx and dashboard.mdx to document that balloon data is informational and does not influence alerting.	2026-08-02 20:48:38 -04:00
Anso	7c02f6eeb5	feat: add stack:read permission gate to Settings Labels section (#1747) ... The Labels section registry entry had no requiredPermission, leaving it visible to every authenticated operator. The backend already enforces stack:read on GET and stack:edit on write endpoints, and the frontend component already hides edit controls behind can('stack:edit'). Adding stack:read to the registry declares the contract explicitly. All five built-in roles hold stack:read, so this has no observable effect on current users. It becomes a functioning gate automatically if a future role or scoped user type is introduced without the permission.	2026-08-02 02:03:57 -04:00
Anso	209c9c5d53	feat: add target-aware RBAC authorization to Scheduled Operations (#1745) ... * feat: add target-aware RBAC authorization to Scheduled Operations Replace the blanket requireAdmin gate on all 9 scheduled-tasks endpoints with per-action permission checks derived from the centralized action registry. Each scheduled action now declares the existing permission it requires: stack lifecycle actions need stack:deploy on the target stack, node-wide operations need node:manage on the target node, prune stays admin-only via system:settings, and snapshot requires unscoped node:manage. Key changes: - Backend registry: add permission field and resolveTaskPermissionScope - Routes: replace requireAdmin with requireTaskPermission, filter GET listing by permission, add two-phase PUT check - Scheduler: revalidate creator permission at execution time, auto-disable on revocation (TaskAuthorizationError) - Database: new creator_user_id column with migration and backfill - Frontend: canScheduleAction/canScheduleAny helpers, reachability gate via scheduledOpsAccessible, stack context menu uses canDeploy not isAdmin, permissions field on all ScheduledActionDefinitions - Expose checkPermissionForSubject for in-process callers (scheduler) No new PermissionAction values are added. Uses the existing stack:deploy, node:manage, and system:settings matrix. Scoped Admiral grants work on the exact (nodeId, stackName) target per SEN-438. * test: add RBAC coverage for scheduled operations authorization * test: update frontend tests for scheduled-ops RBAC gate changes - useStackMenuItems: gate Schedule task on canDeploy not isAdmin; add test for canDeploy=true, non-admin case - buildNavigationModel: default scheduledOpsAccessible to true (default ctx is admin, who can always schedule) - useViewNavigationState: add stack:deploy to admin can() mocks so canScheduleAny resolves correctly * fix: keep checkPermission unchanged, add checkPermissionForSubject standalone The earlier refactoring that made checkPermission delegate to checkPermissionForSubject changed the call order of effectiveTier(req) relative to the admin bypass, which subtly broke the Community tier clamping in the audit-log route. Keep checkPermission byte-identical to the original and expose checkPermissionForSubject as a standalone function used only by the scheduler revalidation path. * fix: prefix unused selectorType parameter in resolveTaskPermissionScope * fix: address audit findings — existence oracle, revalidation test, action filtering Three corrections from the independent PR audit: RC-1 (action filtering): Wire canScheduleActionAnywhere into the action picker in ScheduledOperationsView so actions the user can never schedule (prune without system:settings, node:manage actions without a scoped grant) are filtered from the picker entirely. Add canScheduleAction check on the Create button against the currently selected target, so the submit button is disabled when the caller cannot schedule the chosen action on the chosen target. RC-2 (existence oracle): Six by-ID endpoints (GET /:id, DELETE /:id, PATCH /:id/toggle, POST /:id/run, GET /:id/runs/export, GET /:id/runs) now return a uniform 404 when permission is denied on an existing task, so an unauthorized caller cannot distinguish "task does not exist" from "task exists but you are not authorized." Added requireTaskExistsPermission helper for the 404 variant; POST create and PUT merged-scope checks keep requireTaskPermission (403). RC-3 (revalidation test): Fixed the orphan-creator test to assert the post-execution task state (auto-disabled, explicit error message) rather than wrapping executeTask in a try/catch with a no-op else branch, since executeTask catches TaskAuthorizationError internally and returns normally. Added canScheduleActionAnywhere helper and AuthContext mock to ScheduledOperationsView tests (38/38 pass). * fix: remove unused TaskAuthorizationError import from test * fix: use 404 on PUT phase-1 unauthorized-access check The PUT two-phase check's first phase (ownership verification) now uses requireTaskExistsPermission (404) instead of a manual 403, consistent with the six other by-ID endpoints. This prevents a caller from probing task-ID existence via the PUT route. * fix: address QA findings — reorder prechecks, surface permission reason Two live-confirmed fixes from the 3-node fleet QA pass: Finding #4 (offline-node error ordering): Swap the order of the node- reachability precheck and the creator-permission revalidation in SchedulerService.executeTask. Authorization now runs first, so a revoked grant is always surfaced as an explicit auto-disable with a clear error message, even when the target node is offline. Previously the reachability check ran first, hiding the revocation behind a misleading "target node is offline" error and leaving the task enabled indefinitely while the node was down. Finding #7 (unexplained Save dead-end): When the Create/Update button is disabled because canScheduleAction denies the selected action-target combination, a muted text line now appears below the button: "You do not have permission to schedule this action on the selected target." This gives scoped users meaningful feedback instead of a silently disabled button with no explanation. * chore: remove redundant !!formName guards The earlier short-circuit conditions in isSaveDisabled and saveDisabledReason already guarantee formName is truthy by the time the canSaveWithCurrentTarget check runs. The !!formName guard is a no-op — flagged by GitHub code-quality as 'Useless conditional: This negation always evaluates to true.'	2026-08-02 01:15:37 -04:00
Anso	15801318d6	fix(rbac): permission-gate alerts, auto-heal, and image updates (#1743) ... * fix: gate alerts and auto-heal routes on stack:edit/stack:read permissions Replace requireAdmin with requirePermission across backend/src/routes/alerts.ts and backend/src/routes/autoHeal.ts, mirroring the stack:read/stack:edit model already used by stacks, blueprints, git sources, and settings. Adds the previously-missing permission gate on the auto-heal history route, and adds ownership-aware deletion for alerts via a new DatabaseService.getStackAlert(id) lookup. * fix: gate image-update fleet, per-stack refresh, and auto-update execute on RBAC permissions Replace requireAdmin with requirePermission/checkPermission across backend/src/routes/imageUpdates.ts (imageUpdatesRouter and autoUpdateRouter), mirroring the permission-aware model already used by alerts and auto-heal. GET /fleet drops its admin gate to match the auth-only read model shared with GET / and /detail. POST /fleet/refresh now requires node:manage. A new route, POST /refresh/:stackName, lets a caller with stack:deploy on that stack trigger a per-stack recheck, distinct from the node-wide POST /refresh. The auto-update executor now pre-checks stack:deploy across every resolved target before any work starts, so a denied stack in a bulk request fails the whole call instead of partially executing; the "*" wildcard additionally requires global stack:deploy up front since it expands to every stack on the node, including the empty case where a per-stack check would otherwise have nothing to gate. * fix: evaluate permission before checks-enabled state in auto-update execute The checks-enabled short-circuit in autoUpdateRouter POST /execute ran before target parsing and before any permission check, so a node with image-update checks disabled returned 200 to any authenticated caller regardless of stack:deploy grants. Move the checks-enabled check to run after the resolved stackNames have cleared requireExactStacks, so permission is always evaluated first. Add coverage: a denied role still gets 403 PERMISSION_DENIED (not the disabled-checks 200) while checks are disabled node-wide, and a scoped-only user whose stack:deploy grant covers every stack on the node is still denied target="*" (the wildcard requires global stack:deploy, per the earlier fix), proving that tradeoff against a real on-disk stack rather than the always- empty fresh test instance. * fix: gate alerts, auto-heal, and image-update controls on frontend permission checks Match the backend RBAC gates for alerts, auto-heal, and per-stack image updates with matching frontend checks, replacing raw isAdmin/node:manage gates with scoped can() calls: - Alerts/Auto-Heal menu items and their keyboard shortcuts now gate on stack:read (canViewMonitor), including the window-level keyboard shortcut handler that previously bypassed the menu item gate entirely. - Check updates now gates on stack:deploy (previously node:manage) and calls the new per-stack POST /image-updates/refresh/:stackName endpoint instead of the node-wide refresh. Since the endpoint runs the recheck synchronously and returns the result directly, the old node-wide /status polling loop is removed in favor of handling the response inline. - StackAlertSheet's alert and auto-heal policy mutation controls gate on stack:edit instead of isAdmin. - The Fleet Image Updates refresh button (mobile and desktop) gates on node:manage, hidden rather than disabled to match the existing convention for node:manage-gated affordances. * fix: cover the stack:edit deny path for StackAlertSheet gates The useAuth mock in StackAlertSheet.test.tsx returned can: () => true unconditionally, so canEditAlerts, canEditAutoHeal, and PolicyRow's canEdit prop were never exercised with a denial. Make the mock per-test-controllable (matching the vi.fn() pattern already used in NodeCard.test.tsx) and add one deny-path test per tab asserting the mutation controls are absent while reads stay visible. Also adds an aria-label to the alert row's delete button so the deny test can assert on its absence, matching the aria-label convention PolicyRow's own toggle/delete controls already use. * fix: surface accurate warnings and loading feedback on stack update checks checkUpdatesForStack ignored the backend's StackRecheckResult outcome and always showed a success toast, even when verification failed or an update is still present. It also gave no feedback while the multi-second per-image registry probe was in flight. Add a loading toast on request start, and branch the result toast on outcome/warning instead of unconditional success. The backend reuses its post-update reconciliation copy for this pre-update discovery check, so the two generic "update command completed" strings are replaced with accurate pre-update wording; a genuine stack-specific warning (e.g. a compose render failure) is still shown as-is. Also update docs/features/rbac.mdx: stack:edit now covers alert and auto-heal management, stack:deploy covers per-stack image-update checks, and the Deployer role description reflects both. * fix: add per-stack cooldown rate limit for image-update recheck route The per-stack POST /refresh/:stackName route bypassed the existing node-wide manual-refresh cooldown. A caller with stack:deploy could hammer the registry with unbounded concurrent recheck calls. Add tryMarkStackRecheck in ImageUpdateService, sharing the same 2-minute cooldown window, keyed per (nodeId, stackName). The route handler returns 429 when denied. The mark is written synchronously before the first await so concurrent calls on the same tick are blocked.	2026-08-01 21:07:21 -04:00
Anso	a1e2846d7d	feat: expose Community audit log via system:audit navigation (#1740) ... * feat(rbac): make Settings authorization permission-aware Align Settings visibility and mutations with the existing permission matrix so Node Admin can edit node-scoped operational settings while system and credential surfaces stay Admin-protected. * fix(rbac): tighten settings permission buckets and tests Collapse settings key permission maps into one source of truth, and cover mixed PATCH atomicity plus image-update enabled writes. * fix(rbac): tighten Settings scoped grants and CI assertions Empty settings PATCH fails closed, node:manage is scoped to the active node, system-only Settings stay hidden without system:settings, and Check updates / webhooks mutate gates follow the permission matrix. * fix(rbac): defer Settings section fallback until authz is ready Keep deep links to permission-gated sections (e.g. license) intact while can() is still fail-closed during permission metadata load. * feat: expose Community audit log via system:audit navigation Gate the Audit view on the system:audit permission instead of paid tier, so Community admins can open the existing 14-day recent-activity window. Export, anomaly flags, and stats remain Admiral-only. * test: clarify synthetic Community admin mock lacks system:audit Document that mockCommunityAdmin is a gate-isolation helper, not the real Admin permission matrix where system:audit is always present.	2026-07-30 12:50:55 -04:00
Anso	a3026f47a8	feat(rbac): make Settings authorization permission-aware (#1738) ... * feat(rbac): make Settings authorization permission-aware Align Settings visibility and mutations with the existing permission matrix so Node Admin can edit node-scoped operational settings while system and credential surfaces stay Admin-protected. * fix(rbac): tighten settings permission buckets and tests Collapse settings key permission maps into one source of truth, and cover mixed PATCH atomicity plus image-update enabled writes. * fix(rbac): tighten Settings scoped grants and CI assertions Empty settings PATCH fails closed, node:manage is scoped to the active node, system-only Settings stay hidden without system:settings, and Check updates / webhooks mutate gates follow the permission matrix. * fix(rbac): defer Settings section fallback until authz is ready Keep deep links to permission-gated sections (e.g. license) intact while can() is still fail-closed during permission metadata load. * docs(settings): clarify Notifications channels vs routing authz Channels use node:manage via /api/agents; routing and mute stay Admin-only.	2026-07-30 10:25:13 -04:00
Anso	c704cb54d2	fix(rbac): enforce operational permission parity (#1736)	2026-07-29 22:02:53 -04:00
Anso	a65bf4d46a	fix(rbac): handle permission metadata failures (#1735)	2026-07-29 15:51:27 -04:00
Anso	44d6078241	feat(fleet): show itemized prune plans (#1734) ... * feat(fleet): itemize prune review plans Build and display fingerprint-bound prune candidates for every reviewed fleet node. Preflight all node plans before mutation and preserve detailed removed, skipped, failed, and partial outcomes. Add safe resource metadata projection, managed ownership attribution, runtime contract validation, transport parity coverage, and operator docs. Closes #1724 * fix(security): harden stack path lookup Use a Map for Compose working-directory ownership resolution so untrusted path strings cannot become object property writes. * fix(fleet): harden prune execution safeguards	2026-07-29 14:30:18 -04:00
dependabot[bot]	538a41b771	chore(deps): bump the all-npm-frontend group in /frontend with 25 updates (#1733) ... * chore(deps): bump the all-npm-frontend group Bumps the all-npm-frontend group in /frontend with 25 updates: | Package | From | To | | --- | --- | --- | | [@radix-ui/react-alert-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog) | `1.1.20` | `1.1.23` | | [@radix-ui/react-checkbox](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox) | `1.3.8` | `1.3.11` | | [@radix-ui/react-context-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/context-menu) | `2.3.4` | `2.3.7` | | [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.20` | `1.1.23` | | [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.21` | `2.1.24` | | [@radix-ui/react-hover-card](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/hover-card) | `1.1.20` | `1.1.23` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.12` | `2.1.15` | | [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) | `1.1.20` | `1.1.23` | | [@radix-ui/react-scroll-area](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/scroll-area) | `1.2.15` | `1.2.18` | | [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.4` | `2.3.7` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.12` | `1.1.15` | | [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.4.4` | `1.4.7` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.0` | `1.3.3` | | [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.18` | `1.1.21` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.13` | `1.2.16` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.27.0` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.55.1` | `0.56.0` | | [motion](https://github.com/motiondivision/motion) | `12.42.2` | `12.43.0` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.4` | `1.6.7` | | [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` | | [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.8.0` | | [jsdom](https://github.com/jsdom/jsdom) | `29.1.1` | `30.0.1` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.2` | `7.0.2` | Updates `@radix-ui/react-alert-dialog` from 1.1.20 to 1.1.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/alert-dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/alert-dialog) Updates `@radix-ui/react-checkbox` from 1.3.8 to 1.3.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/checkbox/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/checkbox) Updates `@radix-ui/react-context-menu` from 2.3.4 to 2.3.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/context-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/context-menu) Updates `@radix-ui/react-dialog` from 1.1.20 to 1.1.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog) Updates `@radix-ui/react-dropdown-menu` from 2.1.21 to 2.1.24 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu) Updates `@radix-ui/react-hover-card` from 1.1.20 to 1.1.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/hover-card/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/hover-card) Updates `@radix-ui/react-label` from 2.1.12 to 2.1.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-popover` from 1.1.20 to 1.1.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover) Updates `@radix-ui/react-scroll-area` from 1.2.15 to 1.2.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/scroll-area/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/scroll-area) Updates `@radix-ui/react-select` from 2.3.4 to 2.3.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select) Updates `@radix-ui/react-separator` from 1.1.12 to 1.1.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slider` from 1.4.4 to 1.4.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider) Updates `@radix-ui/react-slot` from 1.3.0 to 1.3.3 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@radix-ui/react-tabs` from 1.1.18 to 1.1.21 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs) Updates `@radix-ui/react-tooltip` from 1.2.13 to 1.2.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `lucide-react` from 1.25.0 to 1.27.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react) Updates `monaco-editor` from 0.55.1 to 0.56.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](https://github.com/microsoft/monaco-editor/compare/v0.55.1...v0.56.0) Updates `motion` from 12.42.2 to 12.43.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.42.2...v12.43.0) Updates `radix-ui` from 1.6.4 to 1.6.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui) Updates `recharts` from 3.10.0 to 3.10.1 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](https://github.com/recharts/recharts/compare/v3.10.0...v3.10.1) Updates `@types/node` from 26.1.1 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.7.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.7.0...v10.8.0) Updates `globals` from 17.7.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0) Updates `jsdom` from 29.1.1 to 30.0.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](https://github.com/jsdom/jsdom/compare/v29.1.1...v30.0.1) Updates `typescript` from 6.0.2 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: "@radix-ui/react-alert-dialog" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-checkbox" dependency-version: 1.3.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-context-menu" dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-dialog" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-dropdown-menu" dependency-version: 2.1.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-hover-card" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-popover" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-scroll-area" dependency-version: 1.2.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-select" dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-slider" dependency-version: 1.4.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-slot" dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-tabs" dependency-version: 1.1.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: lucide-react dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: monaco-editor dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: motion dependency-version: 12.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: radix-ui dependency-version: 1.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: recharts dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-frontend - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-frontend - dependency-name: jsdom dependency-version: 30.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-npm-frontend - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-npm-frontend ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): use Monaco's public worker entrypoint * fix(deps): retain TypeScript 6 compatibility --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SaelixCode <dev@saelix.com>	2026-07-29 12:58:43 -04:00
Anso	9922d8e765	feat(rbac): make stack-scoped grants node-specific (#1727) ... * feat(rbac): make stack-scoped grants node-specific Qualify stack role assignments as (nodeId, stackName), migrate legacy rows to the default node, and forward bound multi-action evidence on Proxy/Pilot hops so scoped users keep least-privilege remote access without shipping the full grant table. * fix: mirror scoped-stack-auth-evidence capability to frontend, sanitize node id in role assignment log Backend added the scoped-stack-auth-evidence capability without the matching frontend entry, failing the capability parity test. The role assignment log also interpolated the node id without sanitizeForLog, unlike the rest of the line. * fix(rbac): honor node-wide scopes and fix proxied DELETE cleanup Node-scoped grants now authorize that role's stack actions on the same node in the backend resolver, frontend can(), and remote evidence. Proxied DELETE cleanup uses the gate-stashed route because pathRewrite mutates req.path before proxyRes. Add proxy integration coverage and drop the stale scoped-permissions screenshot. * fix(rbac): preserve node-qualified grants during repair	2026-07-29 09:42:14 -04:00
Anso	b0b423b234	feat(fleet): reapply Compose configuration without a version update (#1716) ... * feat(fleet): reapply Compose configuration without a version update Add a distinct Fleet Reapply configuration path so Compose-managed nodes can recreate Sencho from the current on-disk project when already up to date, without pulling or rewriting the image reference. * fix(fleet): confirm remote reapply and close concurrent tracker race Require confirmation for remote compose reapply, and lock dispatch before the remote POST so a second request cannot overwrite a successful in-flight tracker. * fix(ui): icon-only Reapply control so Up to date badge can breathe Collapse the Node updates Reapply label into a tooltip so the status pill no longer wraps in the Status column. * feat(editor): Save & Reapply self-stack via fleet compose reapply (#1726) * feat(editor): Save & Reapply self-stack via fleet compose reapply Eligible admins can apply on-disk Compose edits to Sencho's own stack from the editor using the same confirm, dispatch, and reconnect path as Fleet Node Updates. * fix(editor): gate Save & Reapply label to self-stack only Ordinary stacks were labeled Save & Reapply whenever the node was reapply-eligible. Require the selected file to be the self-stack for the toolbar label and diff confirm CTA. * fix(ui): move compose diff action label helper out of dialog module Keep ComposeDiffPreviewDialog component-only so react-refresh Fast Refresh lint passes after the Save and reapply stacked merge.	2026-07-28 14:26:46 -04:00
Anso	543e4ef256	feat(compose-doctor): show All Clear when findings are acknowledged (#1721) ... When every finding is acknowledged, the Doctor summary uses the success All Clear banner with distinct copy instead of the muted acknowledged chip, so operators can see at a glance that no active findings remain.	2026-07-28 14:26:16 -04:00
Anso	78475d96ef	fix(compose-doctor): resolve effective healthcheck coverage (#1713) ... * fix(compose-doctor): resolve effective healthcheck coverage Compose Doctor now classifies healthcheck coverage from the Compose model, running containers, and local images so image-provided HEALTHCHECKs are not false positives. Update Guard shares the same presence helper so test NONE is not treated as active. * fix(compose-doctor): fix healthcheck project label and empty compose HC Use the Compose project name for runtime container listing so stacks whose name: differs from the directory still get runtime evidence. Treat empty or timing-only healthcheck objects as absent rather than active. * fix(compose-doctor): treat inherited healthcheck as All Clear note Inherited image healthchecks no longer block All Clear; they surface under a notes section and cannot be acknowledged.	2026-07-28 14:26:00 -04:00
Anso	72cdbb0eaa	feat(schedules): auto-update stacks by Stack Label (#1717) ... * feat(schedules): auto-update stacks by Stack Label Add a reusable selector_type/selector_value on scheduled tasks so admins can schedule image updates against live Stack Label membership across the fleet or one node, reusing fleet label resolution and the existing auto-update orchestrator. * fix(image-updates): sanitize auto-update execute failure logs Use a static format string and sanitizeForLog so CodeQL no longer flags user-controlled stack names and error text in the execute catch. * fix(ui): space Scope label from fleet/node segmented control Match the Schedule row layout so the inline SegmentedControl no longer sits flush against the Scope label. * fix(ui): remove redundant wrapper around Scope segmented control	2026-07-28 13:00:47 -04:00