Commit Graph

13 Commits

Author SHA1 Message Date
Anso b06dfd7175 fix: prevent false empty states during stack hydration (#1659)
* fix: prevent false empty states during stack hydration

Only show confirmed-empty UI after successful stack, status, and container
fetches. Distinguish loading and recoverable error states in the sidebar,
dashboard, and container health panel.

* fix: arbitrate overlapping stack status and container fetches

Prevent older dashboard status and same-owner container responses from overwriting newer load state after concurrent poll, invalidation, retry, or lifecycle refresh.

* fix: do not let soft status polls starve slow foreground loads

Skip soft /stacks/statuses poll and invalidation while a statuses request is already in flight so a deferred foreground hydration can still commit after the ten-second cadence.

* fix(stacks): surface recoverable errors for confirmed-empty soft failures

Sidebar and dashboard soft (background) refresh failures after a
confirmed-empty state silently kept showing the empty/adopt prompt
instead of a recoverable error, since only the error message was set
without flipping the load status. Also reject malformed non-array
/stacks responses instead of coercing them into a confirmed-empty list,
and drop malformed per-stack status entries before they reach the
dashboard table, which previously crashed the entire app on a null
entry.

* fix(stacks): close two review-found gaps in the load-failure fix

A non-empty stack-statuses map where every entry failed validation was
still committed as a confirmed-empty success; it now surfaces as a
recoverable error instead, and dropped entries are logged. The sidebar's
background-failure helper also checked a stale closure snapshot of the
file list, which could wipe a list that had just loaded non-empty in the
same attempt if the follow-up statuses fetch then failed; it now tracks
the freshest committed list for that decision. Also collapses two refs
tracking dashboard status-map emptiness into one.
2026-07-22 08:01:59 -04:00
Anso 25586fc8ab feat(ui): add Classic, Smart, and Compact desktop navigation styles (#1642)
* feat(ui): add Classic, Smart, and Compact desktop navigation styles

Introduce a shared app-nav registry and reachable model so TopBar, the
command palette, and mobile menus share one destination source. Smart bar
is the default; Appearance gains a Navigation subsection with quick links.

* fix(e2e): stop clearing top-nav prefs on every reload

The desktop-navigation suite used addInitScript to wipe mode storage,
which re-ran on reload and undid the classic/compact values under test.

* fix(ui): harden nav PR docs and Compact quick-link coverage

Drop the partial docs-refresh import that left missing image assets and a stale Display screenshot, keep navigation-scoped operator docs against main, and add an E2E path that proves Compact quick-link add, persist, and render after reload.

* fix(ui): polish Compact quick links and menu mastheads

Align Smart/Compact menus with Theme chrome, keep pin labels always visible, and drive add capacity from persisted pins (max five) with a trailing + picker and per-pin remove.

* test(e2e): exact-match Compact Networking pin locator

Avoid Playwright strict-mode clash with Actions for Networking.

* fix(ui): simplify Compact quick link removal and fix + button trailing

Remove the (...) dropdown per quick link in Compact mode. Right-click
context menu remains as the sole on-bar removal affordance. Fix the +
add-button to trail quick links rather than pinning to the far right
by removing flex-1 from the quick-link rail.
2026-07-16 21:48:03 -04:00
Anso 3fed67a3f1 fix: assorted UI polish across Home, Security, and Resources pages (#1590)
* fix: polish stack health table, security card heights, and scanner-gate copy

- Remove state dot column from Stack Health rows; state still signaled
  via row tinting and sparkline color
- Reposition Update available badge adjacent to stack name and track
  the theme accent (--brand) instead of static fuchsia
- Equalize Top exploit-risk findings and Severity x exploitability
  card heights via h-full in a stretching grid
- Add resolution prop to CapabilityGate so scanner-gated tabs show
  "Install a scanner from the Scanner setup tab." instead of the
  misleading "Upgrade the node" message

* fix: scope Resources scroll area to table contents only

- Remove bg-background from the outer wrapper so search/filter bars
  no longer sit on a dark strip
- Replace outer ScrollArea with a plain div so search and filter
  controls stay fixed while only table rows scroll
- Add ScrollArea (max-h-[62vh]) inside each table card for Images,
  Volumes, and Networks tabs

* fix: remove static bg-background from Security table scroll areas

Images and History tab tables used bg-background on their ScrollArea,
forcing a near-black fill that didn't adapt to the theme. Removing it
lets the parent card's bg-card show through, matching the Resources
table pattern that correctly respects DIM, OLED, and Light modes.

* fix: collapsible search icon and transparent Combobox across Resources and Security

- Replace always-visible search inputs on Resources tabs (Images,
  Volumes, Networks) and Security Images (desktop + mobile) with
  Fleet-style collapsible search: an icon button that expands to
  a full input on click, collapses on blur when empty
- Add [&>button]:!bg-background to Security Images severity
  Combobox, matching Fleet's transparent dropdown design

* fix: remove redundant orange badge from Unmanaged tab label

The count was shown twice: once as inline text in the tab and again
as an orange bg-warning pill badge. The inline text remains; the
duplicate badge is removed.

* fix: outline buttons invisible in Light mode

- Changed outline variant border from border-input to border so it
  uses --card-border, which maintains a visible 0.035 lightness gap
  from --background in Light mode (was 0.005, essentially invisible)
- Boosted Light-mode --button-inner-glow from a 4% white inset to
  a 10% inset plus a subtle drop shadow for the physical-key feel

* fix: bump table cell horizontal padding from 8px to density-aware token

Changed TableHead and TableCell px-2 (8px) to px-[var(--density-row-x)]
which resolves to 20px comfortable / 16px compact. Matches the density
system used by StackHealthTable and gives every shadcn-based table
proper breathing room on both edges.

* fix: expand collapsible search before typing in ImagesTab test

The test was written for the old always-visible search input. Now that
the search bar collapses to an icon, click it first to expand before
interacting with the input.

* fix: reorder Settings Infrastructure to Nodes, Stacks, Fleet

Move the Stacks section directly below Nodes so the Infrastructure
sidebar reads Nodes, Stacks, Fleet. Pure array-element relocation in
the settings registry; the sidebar renders in array order.

* fix: simplify pilot enroll command and add Step 2 copy button

Step 2 of the pilot-agent enrollment modal now shows "docker compose up
-d" instead of the redundant "-f compose.yaml" form, since Step 1
already has the operator save the file as the default compose.yaml. Add
an inline copy button next to the command so it can be copied without
selecting the text by hand.

* fix: stack Fleet/Security tab heading actions on mobile

The shared FleetTabHeading kept its title and action buttons on one row
at every width, so on phones the Security Suppressions heading and its
Export VEX / Add suppression buttons were crammed together. Stack the
heading and actions vertically below the md breakpoint and restore the
original row layout at md and up, so desktop is unchanged.

* feat: add node selector to mobile Home masthead

The mobile Home page showed the active node as static text, so switching
nodes was only possible from the Stacks page. Render the same compact
NodeSwitcher in the Home masthead kicker slot, giving a second place to
view and switch the active node with the identical popover and Manage
nodes action.
2026-07-11 20:55:37 -04:00
Anso 5fe0843eb2 feat: add routable browser URLs for stacks and shell views (#1586)
* feat: add routable browser URLs for stacks and shell views

Sync in-memory navigation to the address bar via a History API hook so
deep links, refresh, Back/Forward, and bookmarks work across nodes,
views, stack editor tabs, and mobile surfaces. Gate role/tier URL
normalization on permissions and license readiness, preserve URLs on
metadata fetch failure, and surface retryable stack-list errors without
rewriting pending stack paths.

* fix: preserve deep-link views on cold load and refresh

Stop the node-switch effect from resetting to dashboard on initial mount.

Defer URL writer settlement until hydrated activeView matches the route.

Adds E2E coverage for shell cold loads, stack refresh, and compose env tab.

* fix: keep mobile dashboard on list surface so sidebar renders

On mobile, the URL sync hook was routing /nodes/<slug>/dashboard to the
content surface, hiding the stack list sidebar. This prevented the
data-stacks-loaded sentinel from appearing, causing sidebar truncation
E2E tests to time out after reload on a mobile viewport.

Mobile dashboard now stays on the list surface; other non-editor views
still render on the content surface.

* fix: complete mobile URL routing follow-ups for stack deep links

Restore mobile /dashboard vs /stacks, list surface always writes /stacks.

Hydrate pendingDetailStack, freeze compose failures with routeDetailError,

and add unit plus E2E coverage.

* fix: hydrate shell views from URL and sync in-app navigation

Bootstrap activeView and tab state from the pathname on cold load.

Settle route phase when state already matches, normalize unknown segments,

and open Monaco editor tabs from stack deep links via applyEditorRouteState.

* fix: prevent mobile stack deep links from hanging on cold load

The resolvePendingStack effect did not re-fire when the pending stack ref
was populated during URL hydration, because the urlHydratingStack state
set in the same callback was not listed in the effect's dependency array.
Adding it causes the effect to retry once hydration has committed.

A resolvingRef mutex prevents concurrent invocations. When the target file
is already loaded, route state is applied directly without calling
loadFileForRoute, which avoids unmounting the editor (and hiding the
recovery chip) if a background refresh triggers route resolution during
a deploy operation.

* test: adapt stack, deploy, and sidebar e2e specs to routable stack URLs

* ci: raise E2E Playwright job timeout to 20 minutes
2026-07-08 13:07:16 -04:00
Anso fdbc1b1ebb feat: move Blueprint orchestration and Federation placement to Community tier (#1555)
* feat: move core Blueprint orchestration to Community tier

Blueprints CRUD, reconciliation, and drift modes are now available on
Community. Pin remains Admiral-only via Federation placement controls.

* feat: move Federation placement controls to Community tier

Remove requirePaid from cordon, uncordon, and blueprint pin routes. Ungate the Federation tab and gate cordon UI on node:manage only. Update licensing and fleet docs for the new tier split.
2026-07-04 21:20:20 -04:00
Anso 5960c1e85e feat: show node and fleet targets on schedule timeline pills (#1480)
Timeline pills and the mobile schedule list now identify what each
scheduled run acts on instead of repeating the task name. Pills stay
compact (firing time plus a category-aware target) and carry the full
detail on hover:

- Stack actions show the stack name.
- Fleet snapshots show "Entire fleet".
- Fleet auto-updates and node-scoped prune/scan show the selected node.
- The hover tooltip adds the action label, task name, and node.

The mobile list resolves node names too, so prune and scan rows name the
node rather than the literal "system". A shared scheduleTargetDescriptor
helper removes the target-label logic that was duplicated across the
desktop and mobile views. The lifecycle lane is renamed "Stack lifecycle"
to match the action-picker category wording.
2026-06-26 22:15:06 -04:00
Anso 7982251dc6 feat(scheduler): add helper text and risk badges to scheduled action picker (#1449)
* feat(scheduler): add helper text and risk badges to scheduled action picker

Add a concise helper text and risk level badge to every scheduled action
in the create/edit modal. The six risk levels (Safe, Read-only, Interruptive,
Runtime change, Removes containers, Destructive) map to the four existing
design-system tones and render as a small dot+label chip next to the helper
text, following the same pattern as SeverityBadge.

Fix an ambiguous mobile label: update + target_type: fleet now resolves
through resolveTaskAction and renders 'update node stacks' instead of the
misleading 'update fleet'.

Add exact helper-text and risk-level assertions for all 10 actions, plus
component tests for default modal state, action-switch scenarios, and
mobile update+fleet rendering.

* docs: update stale scheduled-operations alt text for changed helper text
2026-06-25 02:37:12 -04:00
Anso 0af7ad1df2 refactor(scheduler): drive scheduled-action metadata from a shared registry (#1428)
Scheduled-operation action metadata was duplicated across the backend route
validator, the DatabaseService action union, the desktop action picker, the
Timeline lanes, and the mobile labels/tones. Adding or renaming one action meant
editing all of them.

Introduce one registry per package as the single source within that package:

- backend/src/services/scheduledActionRegistry.ts owns the action list and
  target-type validation; routes/scheduledTasks.ts and DatabaseService import
  from it (BackendScheduledAction type, VALID_ACTIONS, validateActionTarget).
- frontend/src/lib/scheduledActions.ts owns the UI metadata (labels, short
  labels, categories, tones, target/node/stack/service flags, helper text) and
  drives the create-flow picker, the All Tasks label, the Timeline lanes, and
  the mobile schedule view.

Timeline lanes now group by semantic category (Lifecycle, Updates, Security,
Maintenance, Backups) sourced from the registry. The update-fleet UI alias is
made explicit via a backendAction field. Backend validation stays authoritative;
parity tests on each side keep the action sets in lockstep.
2026-06-24 20:09:13 -04:00
Anso 8d9e6574cc feat(appearance): add Calm/Signature visual style, readability mode, and chart palette (#1407)
* feat(appearance): add Calm/Signature visual style, readability mode, and chart palette

Turn the "too intense / italic headers hurt / the security graph fights my
eyes" feedback into a token-driven Visual style with Calm as the new default
and Signature one click back to the prior look.

- Heading family routes through a `.font-heading` utility driven by
  `--font-heading`/`--heading-style`: operational headings render upright in the
  interface face under Calm and italic Instrument Serif under Signature. Base
  rule sets family + style only, so each call site keeps its own weight/tracking
  and Signature stays a true no-op; the Calm lift is a `[data-headings="clean"]`
  descendant rule. Brand lockup, empty-state heroes, and onboarding stay serif.
- Severity charts resolve through `--sev-*` tokens with Muted, Heat, and
  Signature palettes; FindingsByType routes its series through the severity ramp
  plus a neutral so no brand-cyan sits next to rose. The risk trend flattens its
  gradient under Muted/Heat/reduced and keeps the gradient under Signature.
- Appearance settings gain Visual style cards, a Security visualization palette,
  a Readability master toggle, a Motion & effects group, and a "Reset to default"
  button (restores the Calm axes, disabled while readability is on). Contrast
  moves under Readability and Ambient glow under Motion & effects. A card is
  selected only while the stored sub-axes match its preset, so a custom
  combination de-selects both.
- The topbar Theme quick-switch swaps the interface/data font pickers for a
  Visual style switch and a Readability toggle (text size kept); its footer
  Settings link jumps straight to Appearance.
- Readability is a sticky master that forces the calm resolution and a contrast
  lift at apply time without mutating the stored sub-axes.
- New users default to Calm; any pre-existing persisted appearance state keeps
  the Signature look. The pre-paint script mirrors the store.
- SegmentedControl gains a `disabled` prop and a nullable value (no active
  segment for a custom combination, with a roving-tabindex keyboard anchor).
  Adds unit/component coverage for the store, migration, chart shape logic, the
  disabled control, the reset/de-selection, and the quick-switch.

* fix(appearance): migrate Blueprint serif headings and surface readability locks

- Migrate the two operational Blueprint headings (catalog tile name, drift-policy
  option title) from font-serif italic to the .font-heading utility; the first
  pass only covered font-display, so Calm still left these italic. font-serif and
  font-display both resolve to the same display face, so this is the same fix.
- Lock the Visual style cards under Readability (parity with the topbar switch and
  the on-screen guidance to turn Readability off to choose a style by hand).
- Lock the Border brightness slider under Readability and show its forced +0.03
  readout, since Readability overrides the stored value; dragging it previously
  appeared to do nothing.
- Correct the Appearance docs sentence for the topbar quick switch (it listed
  fonts; the quick switch now carries visual style, readability, and text size).
2026-06-22 00:19:57 -04:00
Anso 6cc66faa8c feat(mobile): standardize secondary pages and the stack list on the status masthead (#1374)
* feat(security): reflow the node Security page for mobile

Below the md breakpoint the Security page now reads as a phone surface
instead of a squeezed desktop, with no change to the desktop layout.

- Masthead stat cluster moves into a full-width 3-cell strip
  (critical / high / last scan) below the tab strip, since the masthead
  hides its inline cluster on a phone.
- The eight-section tab strip becomes a horizontally scrollable mono row
  with an edge mask-fade and a cyan underline on the active tab; every
  section stays reachable by scroll.
- The six totals render as a 3x2 hairline-divided grid instead of the
  640px-wide rail that forced a horizontal scroll.
- The Images tab becomes a filterable, scrollable list (severity dot,
  truncated ref, freshness, critical/high count tags) with a chip row,
  in place of the desktop table.
- A freshness footer band states scan recency and scanner version.

All mobile treatment is gated by useIsMobile() or max-md: utilities, so
the desktop view is byte-identical. Charts are reused full-width.

* feat(security): make the mobile Security page a bespoke masthead-led screen

On a phone the Security page now drops the global top bar and leads with
its masthead (the notifications + more-menu cluster moves into the
masthead's right slot), matching Home and Fleet so the mobile shell is
continuous across pages. The view is reclassified bespoke and rendered
through the masthead-led path; the desktop layout is unchanged.

The mobile "more" menu now lists every destination instead of omitting
the bottom-tab views, so the same menu opens the same set on every
screen rather than changing contents from page to page.

* refactor(mobile): extract shared PageHead, sub-tabs, and chip-row primitives

Add PageHead (the header for a pushed full-screen secondary view),
MobileSubTabs (the mono tab scroller with the cyan active underline), and
MobileChipRow (the cyan-filled filter chips) to the shared mobile-ui kit,
and rewire the Security page's tab strip and Images filter to consume
them. No visual change; this is the shared chrome the remaining mobile
pages reuse.

* feat(updates): make the mobile Updates page a bespoke masthead-led screen

Below the md breakpoint the Auto-Update Readiness page becomes a pushed
full-screen view: a PageHead (back chip, the rehomed notifications +
more-menu, a "fleet readiness" crumb, and a Recheck action) leads, then a
brand-tinted readiness hero, per-node sections, and one-up readiness
cards that reuse the same risk badge, version delta, and apply/disabled
logic as the desktop board. The desktop layout is unchanged.

Reclassifies auto-updates as bespoke and renders it through
renderMobileBespoke behind the same hub-only + capability gates as the
desktop content path. Also lifts the PageHead, sub-tabs, and chip-row
primitives' right-slot to host the rehomed global chrome.

* feat(app-store): make the mobile App Store a bespoke masthead-led screen

Below the md breakpoint the App Store becomes a pushed full-screen view:
a PageHead (back chip, the rehomed notifications + more-menu, and an
app-count crumb) leads, the category sidebar collapses into a horizontal
chip scroller, and the featured hero plus the tile grid (already
single-column on a phone) stack below. The featured hero, tile grid, and
deploy sheet are shared with the desktop layout, which is unchanged.

Reclassifies templates as bespoke and renders it through
renderMobileBespoke. Adds tests for the shared chip row and sub-tabs.

* feat(audit): make the mobile Audit Log a bespoke masthead-led screen

Below the md breakpoint the Audit Log becomes a pushed full-screen view:
a PageHead (back chip, the rehomed notifications + more-menu, an
entry-count crumb, and Refresh) leads, then the Stream/Table sub-tabs and
the stream view, where the signal-rail tiles fold to a 2x2 grid and the
day-banded activity stream reflows. The columnar table reads best on a
larger screen, so the Table tab points there on a phone. Desktop is
unchanged.

Reclassifies audit-log as bespoke behind the same hub-only + capability
gates as the desktop content path.

* feat(app-store): drop the featured hero and category chips on mobile

On a phone the App Store is now search plus a single-column list of
every matching app. The featured hero and the category chip row are
removed; the would-be-featured app is folded into the list so nothing is
dropped. Desktop keeps the featured hero, category sidebar, and grid.

* feat(resources): make the mobile Resources page a bespoke masthead-led screen

Below the md breakpoint Resources becomes a pushed full-screen view: a
PageHead (back chip, the rehomed notifications + more-menu, a docker
crumb) leads, then the reclaim hero, the disk-footprint segments, the
2x2 quick-clean grid, and the resource tabs. The raw resource tables
scroll horizontally to fit; the detail sheets stay full-screen. The main
content and the dialog/sheet overlays are shared with the desktop layout,
which is unchanged.

* chore(mobile): correct shared-primitive comments and dedupe the lazy fallback

Fix the "shared by" consumer lists on the mobile-ui primitives, point the
headerActions doc comments at the PageHead (not a masthead), drop the
stale "all eight sections" count on the Security tab strip, rename a
readiness-card test to match what it asserts, and extract a single
Suspense fallback for the four bespoke phone-screen lazy imports. No
behavior change.

* feat(mobile): codify the fade+arrow tab scroller and fix the Resources tab clip

Extract the horizontal tab scroller (edge fade + clickable chevron +
wheel-to-horizontal) out of the stack anatomy panel into a shared
ScrollableTabRow primitive, and adopt it in the stack anatomy tabs, the
mobile sub-tabs (Security / Audit), and the Resources resource tabs. On a
phone the Resources tabs now scroll horizontally, so the "Unmanaged" tab
and its count no longer clip out of the frame. Desktop is unchanged.

* feat(logs): make the mobile Logs page a bespoke masthead-led screen

Below the md breakpoint the global Logs view drops the TopBar for a
PageHead, hides the metrics rail, collapses the stream and level filters
into a single Filters dropdown, turns the search into an icon that
expands to an input, and folds the pause / clear / download controls into
an expanding floating action button that retracts after each action.
Desktop is unchanged.

Reclassifies global-observability as bespoke behind the same hub-only
gate as the desktop content path.

* feat(mobile): standardize secondary pages on the status masthead

Adopt the Home/Fleet/Security status masthead (cyan rail, kicker, serif-
italic state word + tone dot, meta line, notifications + more-menu in the
right slot) on every bespoke secondary page (Resources, App Store,
Updates, Audit, Logs), replacing the title-led PageHead, which is
removed. Each page derives a status word: Updates "Up to date" /
"N pending", Logs Streaming / Idle / Offline, Audit Healthy / Review /
Alerts, Resources Reclaimable / Tidy, App Store the app count.

The "< Stacks" back chip is dropped (the bottom tab bar and more-menu own
navigation), the page actions (Recheck, Refresh) move into the body, and
the Updates readiness hero folds into the masthead. Also make the
Resources tab tables scroll horizontally instead of clipping on the
right. Desktop is unchanged.

* feat(stacks): lead the mobile stack list with the status masthead

On phones the stack list now opens with the shared status masthead instead
of the global top bar plus an in-sidebar node row. The node switcher renders
as a compact kicker chip in the masthead, the serif word summarizes stack
health (down, updates, or all running), and notifications plus the more-menu
sit in the right slot. This matches the Home, Fleet, and Security pages.

The dropped top bar hosted global search, so the more-menu gains a Search
item that opens the command palette. The masthead kicker now accepts either
a styled kicker or a raw slot, enforced as a discriminated union so exactly
one source is supplied. Desktop is unchanged: the new chrome is gated to the
mobile shell and the sidebar rows hide via max-md only.

* fix(stacks): only call the list "All running" when every stack is up

The mobile stack masthead derived its health word from filterCounts, where
up counts running stacks and down counts exited ones. Any other status, and
the window before statuses load, counts as neither, so a list with no exited
stacks but some not yet running fell through to "All running" even though it
was not. Gate that label on up equal to all, and otherwise show the running
count out of the total so the headline stays honest while statuses settle.
2026-06-14 22:21:46 -04:00
Anso 2a4955f56d feat: add dedicated Security page and policy-pack foundation (#1362)
* feat: add dedicated Security page and policy-pack foundation

Bring vulnerability scanning, scan history, suppressions, Compose risks,
secrets, policy packs, and scanner setup into one node-scoped Security
command center instead of scattering them across Resources and Settings.

- New top-level Security view with Overview, Images, Compose risks,
  Secrets, Policies, Suppressions, History, and Scanner setup tabs
  (status masthead + signal rail; controlled tabs with deep-link support).
- Backend: GET /security/overview rollup and GET /security/policy-packs
  static catalog (auth-only, Community). DatabaseService gains an uncapped
  scan-status count and a node-eligible block-policy count, and
  getImageScanSummaries now projects secret and misconfig counts.
- Reuse existing surfaces: the scan-history sheet, the control-governed
  suppression and acknowledgement panels, and the scan-detail sheet (now
  with an initial-tab prop so it opens on the matching finding type).
- Extract a shared SeverityBadge (from Resources) and a TrivyManager
  (from Settings) so both surfaces render identical controls.
- Resources "Scan history" now links into the Security page History tab.
- Docs for the new Security surface and tests for the new endpoints,
  helpers, nav wiring, and tabs.

* refactor: consolidate scanner and policy management onto the Security page

Remove the Settings "Vulnerability Scanning" section now that the Security
page covers the same ground, with every option preserved:

- Scanner install / update / uninstall / auto-update live on the Scanner setup
  tab (TrivyManager).
- Scan policies, the honor-suppressions toggle, and the replica
  managed-by-control / demote controls move into a new ScanPolicyManager on the
  Policies tab (paid; Community sees only the policy-pack catalog).
- CVE suppressions and acknowledgements remain on the Suppressions tab.

Wiring removed: the registry section and the now-empty Security settings group,
the SectionId, the SettingsSectionContent case and the isPaid prop it was the
sole consumer of, and SecuritySection itself. The dashboard configuration-status
"Vulnerability scanning" row now navigates to the Security page Policies tab.

Docs that pointed at "Settings -> Security -> Vulnerability Scanning" are swept
to the relevant Security page tabs.

* fix: harden Security page scanner refresh, policy-load errors, and secret-only badges

Address independent-review findings on the Security page:

- Scanner setup now refreshes Trivy state when the active node changes, so the
  displayed scanner status matches the node TrivyManager's actions target (both
  follow x-node-id). Previously, switching nodes on the tab left stale state.
- ScanPolicyManager surfaces an explicit error state on a failed policy fetch
  instead of falling through to a false "No scan policies configured".
- The shared SeverityBadge and the Images findings column no longer label a scan
  "clean" when it has secrets or misconfigurations but no CVE severity
  (highest_severity is derived from vulnerabilities only); they show a "Findings"
  state and the secret/misconfig counts instead.
- The Overview enforcement note points to the Policies tab, not the removed
  Settings section.
- The History tab auto-opens the scan-history sheet only on a deep-link (mount
  with the History tab active), not on every manual tab selection.

Adds tests for the badge secret/misconfig state and the policy-load error state.
2026-06-12 10:41:39 -04:00
Anso 8e4a09f44a chore: drop stale prototype path from mobile-ui comment (#1342)
The mobile primitives comment pointed at a design prototype folder that
no longer exists. Remove the dead path reference; the comment still
describes where the primitives came from.
2026-06-09 19:01:32 -04:00
Anso 928a3a8343 feat(mobile): bespoke phone layouts for dashboard, fleet, schedules, and settings (#1330)
* feat(mobile): masthead-led dashboard and 5-tab bottom nav on phones

On phones (below the md breakpoint) the dashboard now renders a bespoke,
masthead-led layout instead of the reflowed desktop workspace:

- A status masthead leads with the overall system-health verdict, the node,
  and a live summary (stack counts, last sync, a "metrics stale" marker when
  polling stops).
- A CPU hero card with a sparkline, then a memory / disk / network strip with
  threshold-colored bars, then a tappable stack-health list.
- The bottom tab bar gains a Home tab (Home / Stacks / Fleet / Sched /
  Settings); the global top bar is dropped on this screen, with notifications
  and a "more" menu rehomed into the masthead.

The health-verdict logic is extracted into a shared helper so the phone
masthead and the desktop health bar read from one source, with unit tests.

All changes are scoped below the md breakpoint or rendered only on the mobile
shell; desktop layout is unchanged (verified against the desktop snapshot gate).

* feat(mobile): bespoke fleet glance and node detail on phones

On phones (below the md breakpoint) the Fleet view now renders a bespoke,
masthead-led layout instead of the reflowed desktop workspace:

- A fleet masthead leads with the overall fleet-health verdict and a running /
  cpu / mem summary band, then a list of node cards. The local node is marked
  with a cyan rail and a "you are here" tag; offline nodes are dimmed.
- Tapping a node opens a full-screen node detail: state pill, resource bars
  (cpu / mem / disk), the stacks running on that node, and an Inspect action
  that switches to the node. Operators with the right permissions also get a
  Drain (cordon) action.
- The screen polls the fleet overview every 30 seconds; the global top bar is
  dropped here, with notifications and a "more" menu in the masthead.

All changes are scoped below the md breakpoint or rendered only on the mobile
shell; desktop layout is unchanged.

* feat(mobile): bespoke schedules and settings screens on phones

On phones (below the md breakpoint) Schedules and Settings now render bespoke,
masthead-led layouts instead of the reflowed desktop workspace:

- Schedules: a "next up" glance leading with the next run time and countdown,
  then upcoming runs grouped by day with a per-action status dot and target.
  It is read-only on mobile; creating and editing schedules stays on desktop.
- Settings: a grouped-card list of every reachable section; tapping one opens
  it full-screen with a back affordance and a section masthead. The section
  content itself is the same as on desktop.

The settings section switch, lazy-loaded section chunks, and tier gating are
moved into a shared component so the desktop and mobile screens render the same
section content from one place. The global top bar is dropped on both screens,
with notifications and a "more" menu in the masthead.

All changes are scoped below the md breakpoint or rendered only on the mobile
shell; desktop layout is unchanged.

* fix(mobile): show notifications and more-menu on the stack detail header

The full-screen stack detail on phones drops the global top bar, but its
header was missing the notifications bell and the "more" navigation menu that
the other mobile screens carry in their masthead, leaving no way to reach
notifications or other destinations while viewing a stack. Render the same
header-actions cluster in the detail header (and the loading placeholder),
next to the back affordance. Desktop is unaffected.
2026-06-07 01:15:16 -04:00