sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 20:00:08 +00:00

Author	SHA1	Message	Date
Anso	4a350e7a0a	feat: add Docker label audit across Fleet and Stack views (#1531 )	2026-07-03 18:26:09 -04:00
Anso	9ea2864d60	feat: per-stack storage inventory and portability guardrails (#1399 ) * feat: per-stack storage inventory and portability guardrails Add a Storage tab to the stack Anatomy panel that derives a per-stack mount inventory (bind mounts, named/anonymous volumes, tmpfs, docker socket; read-only vs read-write; host-path existence, type, and owner) from the effective Compose model, and classifies the stack as Portable, Partially portable, Node-bound, or Unknown with the reasons behind it. - New GET /api/stacks/:stackName/storage route (stack:read, Community), served by an on-demand, non-persisted service that renders the effective model, probes within-stack bind sources (symlink-escape aware), and runs the deterministic portability classifier. - Extend the effective-model parser additively with a full per-mount inventory and service-level tmpfs, leaving the rule-facing binds/namedVolumes byte-identical for the existing preflight rules. - New anonymous-volume preflight finding. - Admin-visible "no recent snapshot" warning that reuses the existing hub-local snapshot-coverage endpoint, plus a static note distinguishing config snapshots from application-data backups. - Surface storage assumptions in the Stack Dossier markdown export. - Gate the tab behind a new compose-storage capability on both sides. * docs: phrase the Storage tab availability as current behavior Replace the "older Sencho version / until it is updated" wording in the Storage feature page with present-tense, capability-based phrasing.	2026-06-20 15:06:26 -04:00
Anso	57a0856ffc	feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397 ) * feat(stacks): per-stack environment inventory and secret-safe guardrails Add an Environment tab to Stack Anatomy that derives a per-stack inventory of environment variables from the compose files and env files. Each variable shows its source, whether Compose interpolates it or injects it into a container, and a status (present, missing, unused, duplicate, or shell-only), plus likely-secret classification. The inventory works from variable names only: a value is never read, returned, or logged, and a likely secret shows presence only. A copy env checklist action exports names and status without values. Surface a missing required env_file as a Compose Doctor preflight finding, and add an opt-in node setting that refuses a deploy or update when a required ${VAR:?...} variable is unset or empty, before any backup, pull, or up runs. Default off. The Environment tab is capability-gated so it hides on older remote nodes. * fix(stacks): harden env-file reader against a stat-then-open race Open the env-file handle first and fstat the open handle instead of stat-ing the path before opening, removing the check-then-use window in readEnvFileKeys. Use a secure mkdtemp directory for the out-of-base test path instead of a predictable name in the temp root. * fix(stacks): resolve nested env_file paths per compose file, reconcile inline keys per service Resolve each env_file relative to the directory of the compose file that declared it, so a nested multi-file Git override (infra/prod.yml referencing ./prod.env) lands next to that file instead of the stack root. The root compose file is unaffected, since its directory is the stack directory. Reconcile inline environment provenance per service, so a key an override removed from one service's effective env is not labeled compose-inline just because another service injects the same name from a different source.	2026-06-20 11:58:42 -04:00
Anso	2a4955f56d	feat: add dedicated Security page and policy-pack foundation (#1362 ) * feat: add dedicated Security page and policy-pack foundation Bring vulnerability scanning, scan history, suppressions, Compose risks, secrets, policy packs, and scanner setup into one node-scoped Security command center instead of scattering them across Resources and Settings. - New top-level Security view with Overview, Images, Compose risks, Secrets, Policies, Suppressions, History, and Scanner setup tabs (status masthead + signal rail; controlled tabs with deep-link support). - Backend: GET /security/overview rollup and GET /security/policy-packs static catalog (auth-only, Community). DatabaseService gains an uncapped scan-status count and a node-eligible block-policy count, and getImageScanSummaries now projects secret and misconfig counts. - Reuse existing surfaces: the scan-history sheet, the control-governed suppression and acknowledgement panels, and the scan-detail sheet (now with an initial-tab prop so it opens on the matching finding type). - Extract a shared SeverityBadge (from Resources) and a TrivyManager (from Settings) so both surfaces render identical controls. - Resources "Scan history" now links into the Security page History tab. - Docs for the new Security surface and tests for the new endpoints, helpers, nav wiring, and tabs. * refactor: consolidate scanner and policy management onto the Security page Remove the Settings "Vulnerability Scanning" section now that the Security page covers the same ground, with every option preserved: - Scanner install / update / uninstall / auto-update live on the Scanner setup tab (TrivyManager). - Scan policies, the honor-suppressions toggle, and the replica managed-by-control / demote controls move into a new ScanPolicyManager on the Policies tab (paid; Community sees only the policy-pack catalog). - CVE suppressions and acknowledgements remain on the Suppressions tab. Wiring removed: the registry section and the now-empty Security settings group, the SectionId, the SettingsSectionContent case and the isPaid prop it was the sole consumer of, and SecuritySection itself. The dashboard configuration-status "Vulnerability scanning" row now navigates to the Security page Policies tab. Docs that pointed at "Settings -> Security -> Vulnerability Scanning" are swept to the relevant Security page tabs. * fix: harden Security page scanner refresh, policy-load errors, and secret-only badges Address independent-review findings on the Security page: - Scanner setup now refreshes Trivy state when the active node changes, so the displayed scanner status matches the node TrivyManager's actions target (both follow x-node-id). Previously, switching nodes on the tab left stale state. - ScanPolicyManager surfaces an explicit error state on a failed policy fetch instead of falling through to a false "No scan policies configured". - The shared SeverityBadge and the Images findings column no longer label a scan "clean" when it has secrets or misconfigurations but no CVE severity (highest_severity is derived from vulnerabilities only); they show a "Findings" state and the secret/misconfig counts instead. - The Overview enforcement note points to the Policies tab, not the removed Settings section. - The History tab auto-opens the scan-history sheet only on a deep-link (mount with the History tab active), not on every manual tab selection. Adds tests for the badge secret/misconfig state and the policy-load error state.	2026-06-12 10:41:39 -04:00
Anso	77f1611971	feat: Compose Network Inspector and exposure intent guard (#1360 ) * feat: add Compose Network Inspector facts engine Render a stack's authored effective model and pair it with the live Docker snapshot to derive per-stack networking facts: project networks with external and internal flags, service-to-network membership and aliases, published ports with host-binding scope, network_mode, and extra_hosts, plus runtime drift (runtime-only attachments, foreign networks, and declared-but-unused or missing networks). Extend the effective-model parser with service network membership, extra_hosts, and label keys (key names only, never values), and add a key-space normalized network model with adapters from both the rendered model and the raw declared compose so the Inspector and drift share one comparison. Expose GET /api/stacks/:stackName/networking: advisory and read-only, it renders the authored model only and never returns or logs raw stderr, env values, or label values. * feat: store and edit per-stack and per-service exposure intent Add a stack_exposure_intent table (intent values constrained by a CHECK, unique per node, stack, and service) with DAO methods to read, upsert, clear one row, and clear all rows for a stack. The classification is stored independently of the generated networking facts so a later mismatch stays detectable; service rows are kept separately from the stack-level row (service ''). Expose GET and PUT /api/stacks/:stackName/exposure: GET requires read access, PUT requires edit access and validates the intent against the allowed set. Sending intent null clears that row, returning the scope to unset so a service inherits the stack intent again. Intent rows are cleared when the stack is deleted and when the owning node is removed, so a later same-named stack never picks up stale classification. * feat: add exposure-aware Compose Doctor findings Feed the Compose Doctor's effective-model context with the stored exposure intent (resolved into a stack-level value plus per-service overrides) and the dossier's documented access-URL ports, read fail-soft so a metadata read error skips these checks rather than failing the preflight. Add five deterministic findings on top of that context: - a service classified internal or same-node that publishes a host port (same-node tolerates a loopback bind), - a sensitive database or admin image published on all interfaces, - a port-publishing stack with no exposure intent set, - a published port not reflected in the documented access URLs, - reverse-proxy labels with no documented URL or reverse-proxy intent. The rules stay pure functions over the preflight context; the registry completeness test pins the new rule set. * feat: detect compose network drift in the drift ledger Extend the spatial drift engine with two network-level findings: a running container attached to a stack-owned or foreign network that compose does not declare (one finding per service), and a declared network that no running service uses or that is absent from the runtime (one stack-level finding, every network named by its resolved runtime name). The comparison reuses the same helper the Network Inspector uses, so the two surfaces never disagree. Network drift runs only when the stack has running containers and the runtime is reachable, preserving the existing missing-runtime, parse-error, and unreachable behavior. The findings persist through the existing drift ledger and surface on the Drift tab, which now labels the two new kinds. * feat: link a Docker network back to its owning stack Add a cross-component open-stack event and make the owning-stack badge on a managed network in Resources a link: clicking it loads that stack on its node and opens the editor, reusing the existing fleet navigation. A latest-ref keeps the window listener current without re-subscribing each render. Image and volume badges are unchanged; only a managed network opts in via the new optional handler. * feat: add the Networking tab to the stack detail panel Add a capability-gated Networking tab that reads the per-stack networking facts and exposure intent. It shows the project networks (with external, internal, and created-by-stack flags), per-service network membership and aliases, published ports with their host-binding scope, network_mode and extra_hosts, and runtime drift, degrading to the declared model when the runtime is unavailable. Users can classify the stack and each service (internal, LAN, reverse proxy, public, and so on) or clear a row to inherit; the controls are read-only when the user cannot edit, and a broken exposure response never tears down the facts view. A new compose-networking capability is added to both registries so older nodes hide the tab, and the tab cross-links to the Doctor for the deploy and security findings. * docs: document the Compose Networking tab Add a feature page covering the Networking tab: the network facts, published ports and host bindings, the exposure-intent classification and inheritance, the exposure-aware Doctor findings, runtime drift, and a troubleshooting section. Register it in the docs navigation next to Compose Doctor. * feat: add a redacted network summary to the Stack Dossier export Append a network exposure section to the dossier Markdown: the stack and per-service exposure intents, the networks with their external and internal flags, and each service's published ports with their binding scope. It carries only names, intents, port numbers, and scope, never an env value or a label value. The summary is fetched only when the user exports (copy or download), so opening the panel costs nothing, and it degrades to omitting the section when the data is unavailable. The whole-fleet dossier export collects the same summary per stack, rethrowing the unauthorized sentinel like the sibling loaders. * feat: add a Fleet networking filter for exposure and drift Add a per-node networking summary that classifies a node's stacks as exposed (a host port published beyond loopback), unknown-exposure (publishes ports with no exposure intent set), or network-drift. It reads each stack's compose with the light dependency parser and one Docker snapshot, so it stays cheap across a node's full stack set, and it skips drift when the runtime is unreachable rather than inventing it. Serve it node-locally at GET /api/networking/summary, and aggregate it fleet-wide at GET /api/fleet/networking-summary: the hub computes its own summary in-process and reaches each remote through its node-local route, degrading an unreachable or older node to a skip. Because the aggregate lives under the proxy-exempt /api/fleet prefix it is never wrongly proxied. The Fleet overview gains a networking filter chip backed by that aggregate, fetched fail-soft and detached so it never gates the grid. * fix: spin the Networking refresh button while it reloads The refresh button silently refetched the same data, so a click gave no feedback. Track a refreshing state and spin the icon while the load is in flight, disabling the button, matching the Compose Doctor preflight button. * fix: apply effective per-service exposure intent to unclassified checks The "unclassified exposure" decisions only consulted the stack-level intent row, so a service classified directly (with no stack row) was still reported as unclassified, and a service explicitly marked unknown over a classified stack was missed. Both the exposure-unclassified preflight rule and the networking summary's unknown-exposure bucket now resolve the effective intent per publishing service (service row overrides stack row), matching the precedence already used by the exposure-internal-published rule. * fix: resolve drift network names via the compose top-level name When a compose file sets a top-level name:, Docker prefixes resource names with that project name instead of the stack directory. The light dependency parser dropped name:, so network-drift normalization compared runtime networks against directory-prefixed names and reported false network-undeclared / network-missing findings. Carry the parsed project name through DeclaredCompose and use it when normalizing declared networks for drift, while still filtering containers by the stack directory.	2026-06-12 02:15:11 -04:00
Anso	38aabe7064	feat: health-gated updates and rollback readiness (#1354 ) * feat: classify stack deploy and update failures with suggested next actions Failed deploy and update responses now carry a failure classification (cause category, headline, and suggested next step) derived from the compose error output. The recovery panel and chip render the classification and include it in copied diagnostics, and gateway-style failures surface as a node-unreachable cause. * feat: add update and rollback readiness reports for stacks Before a manual update, Sencho now shows an advisory readiness verdict computed from the stored preflight result, open drift findings, live container health, the pending image change, the rollback backup slot, and node disk headroom. The Stack Dossier gains a rollback readiness section that states what a rollback can restore and explicitly discloses that volume and bind-mounted data are not covered. Toolbar and sidebar updates now share one update path, and admins can create a fleet snapshot from the readiness dialog before updating. Nodes that do not advertise the capability keep the direct update flow. * feat: observe stack health after updates with a post-deploy health gate After a deploy or update succeeds, Sencho now watches the stack for a configurable observation window and records a passed, failed, or unknown verdict: containers must stay running, healthchecks must report healthy, and restart loops or disappearing containers fail the gate. The deploy panel shows the observation live and holds off auto-closing until the verdict lands, a failed gate surfaces the existing recovery actions including rollback, and the stack timeline records update started and gate verdict events. Scheduled, webhook, bulk, and git-source updates are gated the same way; rollbacks and installs are deliberately not. The gate is observational only and can be tuned or disabled per node under host alert settings. * docs: document health-gated updates and rollback readiness New operator page covering the update readiness dialog, the post-update health gate and its settings, the rollback readiness disclosure, and classified failures, with cross-links from the atomic deployments and deploy progress pages. The API reference gains the readiness and health-gate endpoints, the healthGateId success field, and the failure classification schema on deploy and update error responses. * feat: withhold the success verdict while the health gate observes An update used to show a green Succeeded that a failed health gate then contradicted moments later. The deploy modal now reports Verifying health while the gate observes, shows success only when the gate passes, and makes a failed or unknown gate the headline result; success toasts soften to a verifying message while a gate runs. The mobile recovery card groups its actions behind one bottom-right Take action menu so it stays compact on a phone, with the classified cause still visible on the card. A successful image update now also counts as the last known-good marker in rollback readiness, and the docs gain screenshots of the readiness dialog, gate states, dossier section, and settings. * fix: harden log format strings and the env existence path check Log calls that interpolated the stack name into the console format string now use constant format strings with placeholder arguments, and envExists validates path containment inline at its filesystem access, matching the established patterns used elsewhere in the same files. * test: adapt deploy modal success specs to the post-deploy health gate The deploy feedback modal now withholds its success verdict while the health gate observes the new containers, showing "Verifying health" until the gate passes. The two success-path E2E tests waited for "Succeeded" within the gate's 90s default window and timed out. Shorten the observation window to the 15s minimum for these tests via the settings API, assert the verify-then-succeed sequence the modal actually renders, and restore the default window afterward so the test value does not leak into later runs. * fix: serialize health gate polling and harden gate observation Address race conditions in the post-update health gate found in review. Backend: the gate poller used setInterval, so a Docker observe slower than the 5s tick could overlap the next poll and corrupt the restart and missing-container accounting, and a wedged socket could leave a poll pending forever. Polling is now single-flight: each cycle self-schedules the next only after it settles, and the observe is bounded by an 8s timeout so a hung probe counts as a poll error and resolves the gate unknown after three in a row. Frontend: the gate poller could overlap requests, letting a slow earlier "observing" response overwrite an already-applied terminal verdict. It is now single-flight with a terminal latch, so a late response can never roll the UI back from passed or failed. Also reject a non-digit nodeId on the snapshot coverage route instead of letting parseInt coerce it, document that turning off the deploy progress panel opts out of the live gate UI while the gate still runs server-side, and add gate-coverage tests for the webhook, git source, and auto-update apply paths plus the new single-flight, observe-timeout, and recovery cases.	2026-06-11 00:26:26 -04:00
Anso	52ff0725f4	feat: add Compose Doctor preflight checks for stacks (#1348 ) * feat: add Compose Doctor preflight checks for stacks Add an on-demand, advisory preflight that renders a stack's effective Compose model with `docker compose config` and runs a registry of deterministic checks before deploy, surfacing findings grouped by severity (blocker, high, warning, info) with a remediation for each. Findings cover unset env vars, host-port conflicts on the node, broad 0.0.0.0 exposure, missing bind-mount paths, a mounted Docker socket, privileged and host networking, moving image tags, missing restart policy and healthcheck, Swarm-only deploy fields, missing external networks or volumes, and container_name collisions. The report is node-scoped and stored as the last run per stack, and the route auto-proxies to the active node so a remote stack is checked on the node that owns it. A new Doctor tab on the stack detail panel runs preflight and shows the grouped findings, with a severity dot on the tab when the last run has blocker or high findings. The tab is gated on a compose-doctor capability so older nodes hide it. No environment value is ever stored, returned, or logged: only env key names and structural facts are read, and render failures surface a generic message or the missing required-variable names, never raw stderr. * fix: scroll the stack tab strip when its tabs overflow Adding the Doctor tab can push the per-stack Anatomy tab strip past the panel width on narrower layouts. Make the tab row scroll horizontally with subtle edge fades that appear only while there is more to scroll in that direction, so a panel wide enough to show every tab is unchanged. * fix: add clickable arrows and wheel scroll to the stack tab strip Hiding the scrollbar left mouse users with no way to scroll the overflowing tab row: a vertical wheel does not move a horizontal overflow and native rows do not drag-scroll. Replace the passive edge fades with clickable chevron arrows shown only when the row overflows that edge, and translate a vertical wheel over the row into horizontal scroll. * fix: inline the path-injection barrier in renderConfig CodeQL's path-injection check does not credit the wrapped isPathWithinBase helper as a sanitizer, so move the containment check inline at the spawn cwd sink, matching the canonical barrier used elsewhere in the codebase. Behavior is unchanged: the resolved stack directory must be contained in the compose base and may not be the base itself. * fix: hoist the compose-config spawn into the path-barrier scope The earlier inline barrier sat in a different scope than the spawn cwd sink (separated by the Promise-executor closure) and used a compound guard, so CodeQL did not credit it. Use the exact canonical startsWith barrier and hoist the spawn into the same scope as the check. Behavior is unchanged: the executor runs synchronously in the same tick as the spawn, so handlers still attach before any event can fire.	2026-06-10 11:35:39 -04:00
Anso	842ee7dd0c	feat(fleet): export a whole-fleet Markdown dossier (#1334 ) * feat(fleet): export a whole-fleet Markdown dossier Add an admin-only "Export Dossier" action to the Fleet view that walks every node and stack, pairs each stack's generated Compose anatomy with its operator notes, and downloads a folder-structured homelab-dossier.zip (index, per-node and per-stack pages, plus fleet-wide port, volume, network, env, access-URL, and VLAN/firewall maps). Reuses the existing stack dossier and anatomy Markdown generators by extracting the shared Compose parsers into a frontend lib module. Unreachable nodes are recorded with a reason and never block the export; only env variable names and counts are ever emitted, never values. * fix(fleet): unique stack slugs and reproducible dossier archive Disambiguate stack names on one node that slugify to the same value (e.g. `Web` and `web` on a case-sensitive host) with a per-node slug map shared by the node-page links and the file emission, so neither overwrites the other. Pin a fixed entry timestamp on the zip so the archive bytes are a pure function of the file map rather than the wall clock.	2026-06-07 21:10:02 -04:00
Anso	421177e4a6	feat(stacks): add compose-vs-runtime drift detection (#1329 ) * feat(stacks): add compose-vs-runtime drift engine Add a read-only engine that compares a stack's on-disk compose model against the live Docker runtime and reports where the two diverge. GET /api/stacks/:stackName/drift returns a per-stack report with a status (in-sync, drifted, missing-runtime, unreachable) and typed, service-scoped findings: a declared service with no running container, a running container not declared in compose, an image mismatch, and a published-port mismatch. The report is computed at request time with no persistence and is available on every tier. The check reuses the existing compose parser and Docker dependency snapshot; the compose parser now also captures each service's declared image. Boundaries fail closed: an unreadable compose file reports drifted and an unreachable Docker daemon reports unreachable, never a false in-sync. * fix(stacks): keep drift hasContainers accurate on compose parse error assembleStackDrift hardcoded hasContainers: false on the parse-error path, contradicting the field's contract when the runtime actually has running containers. Compute it once from the container set and reuse it across all return paths. Also add a route test that exercises the successful 200 path for an existing stack on the Community tier (stubbing only the Docker boundary), so a tier gate or handler regression after the existence check is caught. * feat(stacks): add a drift detection tab to the stack view Surface the compose-vs-runtime drift report on the per-stack Anatomy panel as a read-only Drift tab. It shows the stack's status (in sync, drifted, not running, unreachable) and, when drifted, the specific service-scoped reasons with the declared and running values side by side. A re-check action reruns the comparison. The tab lives in the shared anatomy panel, so it appears on both the desktop stack view and the mobile stack detail. Available on every tier. * fix(stacks): sanitize the logged error in the drift report builder The compose-read and Docker-snapshot catch blocks logged the raw error object, whose message can embed the user-controlled stack path (e.g. an ENOENT path). Log the error through the existing sanitizer so a crafted stack name cannot forge log lines, matching the pattern used elsewhere in the stacks router.	2026-06-07 15:48:04 -04:00
Anso	57fe430db8	feat(stacks): add Stack Dossier tab with operator notes and Markdown export (#1326 ) * feat(stacks): add Stack Dossier tab with operator notes and Markdown export Add a Dossier tab beside Anatomy and Activity on the stack detail panel. It shows a read-only summary auto-derived from the stack's Compose anatomy (services, ports, volumes, network, restart policy, env file, source) plus an editable form for the context Sencho cannot infer: purpose, owner, access URLs, static IP, VLAN, and firewall, reverse-proxy, backup, upgrade, recovery, and custom notes. Notes persist per stack and per node in a new stack_dossiers table, reached transparently through the remote-node proxy so a remote stack's dossier round-trips to the node that owns it. Reading a dossier needs stack read permission; saving needs stack edit. The tab exports a single Markdown document combining the generated facts and the operator notes, with copy-to-clipboard and download actions; env values are never exported, only variable names and counts. Available on all tiers. The standalone anatomy copy-as-Markdown shortcut is removed since the Dossier export supersedes it. * fix(stacks): gate dossier reads/writes on stack existence; clear dossier on node delete A dossier endpoint validated the stack name but not that the stack exists, so an editor could PUT a dossier for a name with no stack, leaving an orphan row that a later stack of the same name would inherit. Require the stack to exist (existing requireStackExists guard) on the dossier GET and PUT, returning 404 otherwise. Also clear a node's stack_dossiers rows when the node is deleted, alongside the other node-scoped cleanup, so removing a node leaves no orphan dossiers. Docs: scope the "no secret exported" statement to the generated facts (which only ever carry variable names and counts) and clarify that operator notes are exported exactly as written.	2026-06-06 22:21:30 -04:00
Anso	c0a252026d	feat(appearance): add theme, accent, contrast, and typography personalization (#1307 ) * feat(appearance): add theme, accent, contrast, and typography personalization Expand Settings to Appearance into a full personalization surface and add a quick switcher to the top bar (the palette button between search and notifications). Choices are saved to the browser, sync across tabs, and apply before first paint so there is no flash on reload. - Themes: Dim (the default raised charcoal), OLED true black, Light, and Auto (follows the OS and re-resolves live when it flips). - Accent: an eight-hue wheel (cyan default) that drives the one data color across charts, rails, focus rings, active states, and the ambient glow. - Fine-tune sliders: a master Contrast that spreads page, ink, and borders together, plus Border brightness and Ambient glow. - Typography: swappable interface (Geist / IBM Plex Sans / Hanken Grotesk) and data (Geist Mono / IBM Plex Mono / Fira Code) faces, and a text-size control (continuous slider in Settings, S/M/L/XL presets in the popover, kept in sync). The display serif stays locked as the signature face. Surfaces, borders, and ink derive from per-theme lightness values so the live knobs scale the whole UI through CSS, and the opaque directional borders read on every panel including true black. A live preview reflects changes in real time. Adds a documentation page under Features. * fix(appearance): keep contrast-driven tokens in gamut and add picker keyboard nav Clamp the contrast and knob driven surface, border, and ink lightness so the full slider range stays a valid color. The page now always sits below the card tone, so page/card separation no longer collapses at high contrast in Light; the lit border edge never reaches white in Light at the low end of the knobs; and the OLED and Dim extremes resolve to valid black/white instead of out-of-range values. Add the radiogroup keyboard model (roving tabindex plus Arrow / Home / End) to the accent and type pickers through a shared hook, matching the segmented control. One item is tabbable and arrow keys move focus and selection together.	2026-06-04 01:50:41 -04:00
Anso	c6d1631afe	feat(recovery): add safe-mode recovery surface and emergency CLI (#1286 ) * feat(recovery): add safe-mode recovery surface and emergency CLI Add a read-only Recovery tab under Settings (admin-only) backed by a new GET /api/diagnostics endpoint reporting app version, database integrity, encryption-key status, Docker reachability, account and SSO counts, and non-secret configuration. The endpoint loads without Docker or live metrics so it stays available when the dashboard does not, requires a genuine admin session, and builds its config block from a non-secret allowlist so no credentials are ever exposed. Expand the emergency command-line toolkit beyond the two-factor reset with seven host-level commands: reset-password, create-emergency-admin, clear-sessions, disable-sso, diagnostics, validate-db, and backup-data. Each prints its result, exits with a meaningful status code, and writes an audit entry where it changes state. Document the toolkit in a new operator guide and link it from the recovery and two-factor pages. * feat(recovery): download the emergency command reference as a text file The recovery commands are needed exactly when the dashboard is unreachable, so reading them only in-app is a chicken-and-egg problem. Add a Download button to the command-line section that saves the full `docker compose exec sencho ...` reference as a text file, letting operators keep it on hand before they need it. Reuses a shared download helper with the existing diagnostics export. * fix(recovery): harden diagnostics, backup, and emergency-admin against edge cases Address findings from an independent review of the recovery toolkit: - DiagnosticsService now degrades instead of throwing when a queried table is missing or corrupt: each read falls back and is folded into database.ok, so a broken database reports "problem detected" rather than failing the whole endpoint or showing a misleading healthy state with zeroed counts. - backup-data refuses a destination that resolves to the live database, which would otherwise report success while producing no separate copy. - create-emergency-admin now applies the same username rule as the user- management route, extracted to a shared helper so both stay in sync. Adds tests for a missing read table, a malformed emergency-admin username, and the backup same-target rejection.	2026-06-02 16:11:24 -04:00
Anso	02f98ab90a	docs: add recovery guide and link it from README, quickstart, and troubleshooting (#1283 ) Add a consolidated Recovery page that answers "what do I do if Sencho breaks?" in one place. It covers getting back to a working state when Sencho itself fails, a stack deploy fails, an admin is locked out of sign-in, Docker is unavailable, or a remote node is unreachable, and summarizes each path with a link to the authoritative detail page rather than duplicating it. The page opens by stating the core safety fact: Sencho keeps its state in DATA_DIR and COMPOSE_DIR and treats compose files on disk as the source of truth, so recovery is mostly file-level and running containers are unaffected by a Sencho outage. It points to Backup & Restore as the prerequisite. Link the guide from the README documentation section, the quickstart "where to next" cards, and the top of the troubleshooting page.	2026-06-02 11:43:55 -04:00
Anso	e57799d4df	docs: expand Features subgroups by default (#1148 ) Mintlify nested groups collapse unless `expanded: true` is set on each group object. Adding it to all six Features subgroups so users land on a fully scannable sidebar instead of six folded headers.	2026-05-21 22:02:07 -04:00
Anso	5f7a887ed6	docs: reorganize navigation for feature discoverability (#1147 ) Restructures the Documentation tab so each group answers one operator question. - Split the 12-page "Stacks & Deployments" into Stacks (per-stack work) and Deployment (the act of deploying); promote Resources Hub to a standalone item. - Dissolve the 2-page "Platform" junk drawer: Sidebar moves to Stacks, Host Console moves to Fleet. - Rename "Fleet & Multi-Node" to "Fleet"; absorb Node Compatibility from Reference. Move Scheduled Operations from Fleet to Automation (now a 4-page group covering Scheduled Ops, Auto-Update, Auto-Heal, Webhooks). - Clean up the Reference tab: drop misplaced node-compatibility, move root-level security.mdx into reference/, delete the orphan reference/verifying-images.mdx after porting its Available Tags table into operations/verifying-images.mdx. - Reorder top-level groups: Operations moves above Reference. - Rename two misleading page titles: "Deploy Progress Modal" becomes "Deploy Progress" (drops the UI implementation leak); "Auto-Update Readiness" becomes "Auto-Update Policies" (matches filename and sibling "Auto-Heal Policies"). Verified: docs.json parses as valid JSON, 59 disk .mdx files match 59 nav entries with zero orphans and zero broken refs.	2026-05-21 21:25:23 -04:00
Anso	08caa914ce	docs: v1 docs refresh (batch 2) (#988 ) * docs(atomic-deployments): refresh page around current UI and behavior Rewrites the page to match the v1 docs refresh template. Corrects several factual errors against the current code, fills in missing detail, and adds a screenshot of the rollback overflow menu. Notable corrections: - Scheduled tasks do not run atomically; only stack editor Deploy and Update, App Store installs, webhook triggers, and image auto-updates pass the atomic flag through to ComposeService. - Rollback lives in the stack editor's More actions overflow menu, not on the action bar directly. The backup timestamp renders as a sub-line of the menu item. - Health probe is a 3-second window with an exit-code check on every container labelled with the compose project name; describe this exactly rather than as 'waits briefly'. - Document where backups live (DATA_DIR/backups/<stack>/), why they are kept outside the compose folder, and that the slot is one per stack with overwrite semantics. - Document the four streamed log markers users see in the deploy progress modal during the atomic flow. - Add a troubleshooting accordion group covering missing menu entry, late crashes outside the probe window, manual-intervention message, and the single-slot retention edge case. * docs(deploy-enforcement): refresh page for v1 and align with current enforcement paths Update the page to match the current pre-flight gate behavior, the v1 modal chrome on the block dialog, and the AccordionGroup troubleshooting pattern used across the v1 docs. Drift items corrected: - Replace the broken vulnerability-scanning/deploy-blocked-dialog.png reference with three fresh captures under docs/images/deploy-enforcement/ (policy list, policy editor, block dialog). - Drop "Recreate from the stack actions menu" and the git-source apply pre-flight claim; neither path runs the gate. - Add bulk label deploy and the auto-update scheduler to the enforced code paths, with a dedicated subsection for the auto-update interaction (alert-and-skip, not 409). - Drop the false claim that severity chips in the block dialog are clickable; the dialog is informational. - Document the compose-parse-fails-closed branch with its synthetic violation label. - Refresh dialog copy to reflect the v1 ModalDestructiveHeader (kicker, title, button variants). - Convert the troubleshooting Q&A into AccordionGroup blocks and add accordions for the compose-parse-error case and the auto-update-skipped case. - Quote the verbatim audit-log summary format. * docs(blueprints): refresh against v1 UI and add federation/state-review coverage * docs(git-sources): refresh page against v1 UI and current behavior Rewrites the page against the v1 docs refresh template (Note tier-gate, sectioned anatomy, AccordionGroup troubleshooting), aligning prose with the live UI labels and the current code paths. Corrections: - Authentication toggle reads "Public (no auth)" / "Personal Access Token" (not "None"), and apply mode "Auto-write files" (not "Auto-write"). - Diff dialog kicker is GIT . PULL PREVIEW; local-edits state opens an Overwrite local edits? confirmation modal whose primary button is Overwrite and apply. - Sidebar pending indicator is a small GitBranch icon, not a brand-color dot, and the image-update dot takes priority over it on the same row. - Pending update banner appears in the panel; Review re-fetches the commit and opens the diff (no client-side payload caching). Adds coverage for: - Anatomy of the panel (pending banner, form, last-applied stat strip, footer actions). - 10-second webhook debounce window. - Pending compose/env content is encrypted at rest in the database, not just the token. - Auth/host failures map to HTTP 400, never 401, so they do not sign the user out. - Per-stack lock serializes pull, apply, and create-from-git so a webhook firing during a manual apply waits rather than racing. - Compose validation has a 10-second budget; clone fetches have a 30-second timeout. - New troubleshooting accordion for Pending commit has changed since this pull was fetched. Recaptures all five screenshots from the v0.74.x production node, signed in as admin: panel, create-from-git tab, pull-preview diff dialog, sidebar GitBranch pending icon, webhook Action select with Git source sync highlighted. * docs(stack-labels): refresh page for v1 sidebar grouping and fleet-action surface - Lead with the v1 behavior the previous page did not cover: the sidebar groups stacks under collapsible label headers (PINNED first, label buckets sorted by stack count desc then name asc, UNLABELED last) with a count chip per group. Trailing colored dots on each row (max 3 + N overflow, paid-only) supplement the headers. - Drop the stale claim that a label-pill filter bar lives between search and the stack list; that UI no longer exists. - Drop the right-click-on-pill bulk actions table (Deploy all / Stop all / Restart all). The legacy per-node action endpoint stays in the backend but no longer has a UI binding, so the page documents only what users can click today. - Document the two Skipper+ Fleet Action cards: Stop fleet by label (name match across nodes, autocomplete, per-node breakdown, HTTP 429 on per-node concurrency) and Bulk label assign (per-node, replace semantics, clear on empty selection). - Document the inline 'New label' form inside the stack right-click / three-dot Labels submenu, the Settings - Advanced - Labels masthead N/50 stat, the LABELS - NEW / EDIT modal kickers, and the LABELS - DELETE - IRREVERSIBLE confirmation copy verbatim. - Document the Fleet Overview Tags multi-select filter (filters by stack labels aggregated across nodes), with cross-link to fleet-view. - Capture every screenshot fresh from production signed in as admin: sidebar-grouping, context-menu-labels, inline-create-form, settings-labels, create-label-dialog, fleet-tags-filter, fleet-actions. Drop the now-stale sidebar-with-labels, sidebar-filtered, and bulk-actions-menu captures. * docs(dashboard): refresh page for v1 layout (status masthead, gauges, fleet heartbeat, restart map) Aligns docs/features/dashboard.mdx with the redesigned Home tab. Replaces the obsolete Recent Activity feed coverage with the actual DashboardActivityCard split (Fleet Heartbeat when remote nodes are registered, Stack Restarts (7d) otherwise) and recaptures every screenshot from the v0.74.x production node. * docs(global-search): refresh page for v1 palette - Note tier and role gating on the Pages list (Auto-Update, Console, Schedules, Audit) so the prose matches what the top bar exposes. - Document the ACTIVE chip on the currently active node row. - Document the 50-result cap counter and the Searching... loading state. - Mention the ~250 ms debounce and clarify that filename matching includes the file extension. - Replace stack screenshot with a redesigned capture and add empty-state Pages and Nodes captures showing the ACTIVE chip. * docs(global-observability): refresh page for v1 layout (masthead, signal rail, filter strip, paused-resume chip) Full rewrite against the current Logs tab and the v1 docs refresh template (hero Frame, sectioned anatomy, AccordionGroup troubleshooting, refresh-cadence table). Replaces the single overview screenshot with seven captures under docs/images/global-observability/ (overview, masthead, signal-rail, filter-strip, feed-bands, paused-resume-chip, error-only-filter), all from the v0.75.x production node signed in as admin with PII scrubbed (profile chip patched to AD, in-feed LAN IPs and third-party hostnames substituted via DOM injection while the stream was paused). Aligns prose with the actual UI labels and code: - Masthead kicker reads LIVE LOGS · NODE · <NAME> with LOCAL for the local node; state word toggles Streaming / Idle / Offline; SESSION uses uppercase letter suffixes (1H 43M / 0M 12S) per formatUptime. - Signal rail tile counts are scoped to the 2000-entry buffer and reset with Clear; CONTAINERS is buffer-bound, not a monotonic accumulator. - Filter strip controls quoted verbatim (Stacks · All / Stacks · n, segmented controls All / Out / Err and All / Info / Warn / Error). - Feed row anatomy: severity dot, timestamp, brand-cyan container name with stack/container tooltip, message tinted by source. Row tint follows detected level, which is regex-based, so an STDOUT line containing ERROR: still classifies as ERROR. - Day bands: NOW, Nm AGO, Nh AGO, calendar date. - Empty states: two-tier kicker over caption (Awaiting events / No matches). - Pause keeps the SSE buffer filling up to the 2000-entry cap; resume pill reads <n> NEW · RESUME and counts the queue, not total arrivals during the pause. - Download filename and row format quoted: sencho-logs-<ISO8601>.txt and [<ISO>] [<stack>/<container>] <LEVEL>: <message>. Documents behavior the previous page never covered: - Active-node scoping; node switch resets the stream and the buffer. - SSE primary transport with 30-second server heartbeat and a 5-second polling fallback against /api/logs/global (server-capped at 500 lines per snapshot). - Initial replay of the last 500 lines per container when the SSE connection opens, so the feed has context immediately. - Display limits (2000 client buffer, 300 rendered rows, Showing last 300 of N overflow notice). - Refresh cadence table covering UI tick, flush cadence, polling cadence, SSE heartbeat, sparkline window, and the Idle threshold. Adds a seven-accordion troubleshooting block (Offline state, gray Idle dot, ERROR-without-tint, growing Resume pill, Clear-cutoff lag, node-switch buffer drop, fleet-wide aggregation expectations). Tightens the closing Note so it makes clear that Notification Log Retention does not govern this live container stream. * docs(alerts-notifications): refresh page for v1 and absorb notification-routing Full v1 template rewrite of /features/alerts-notifications. Bundles in the entire Notification Routing page so a reader sees channels, routing, per-stack rules, and retention in one place; deletes the standalone notification-routing.mdx and points all five cross-link sites at the new in-page anchor. * docs(alerts-notifications): drop "What's not in scope" section The page should describe what Sencho does, not enumerate what it does not ship. Users find missing integrations through the Webhook section and the routing matcher reference; the explicit disclaimer added noise without adding guidance. * docs(audit-log): refresh page for v1 layout, expanded action list, troubleshooting accordion - Clarify that the search/method/date filter strip lives in Table view only. Stream view always shows the unfiltered chronological feed. - Fold the total-entries readout into the card subtitle wording where it actually renders, instead of describing it as a separate header element. - Sharpen the Peak hour off-hours window to the literal 08:00 to 17:59 working window the tile keys off, plus the 5% / 20% failure-rate tints. - Note that the Actors tile names a sample actor alongside the new-IP count. - Expand the example actions list to cover surfaces that have shipped since the last edit: per-service stack lifecycle, node cordon/uncordon, fleet replica role changes, Sencho Cloud Backup operations, Fleet Secrets, and blueprint federation pin updates. - Correct the Settings path: Settings · Developer · Data retention card, Audit log input, Save settings button. - Add a Troubleshooting AccordionGroup matching the rest of the v1-refresh pages: missing tab, filter scope, anomaly thresholds, export cap, and retention pruning. - Replace all four screenshots with fresh captures of the current UI. * docs(multi-node): refresh page for v1 layout, pilot agent mode, refreshed table columns Rewrites docs/features/multi-node.mdx against the current product. The previous page predated the v1 Settings hub redesign and the Pilot Agent enrollment model, so it documented only the Distributed API Proxy add-node flow and missed the new Mode, Endpoint, and Labels columns on the Nodes table. Restructures the page into 13 sections: intro, How it works, the local node, Choose a remote mode (decision table comparing Pilot Agent vs Distributed API Proxy), Add a remote node: Pilot Agent (three steps plus re-enrollment), Add a remote node: Distributed API Proxy (three steps), Switching between nodes, the Nodes table (full column reference), What Settings apply per node (verified against settings/registry.ts), License enforcement across nodes, Editing and deleting nodes, Security (token security, transport encryption, why no application-layer TLS), and Troubleshooting (AccordionGroup matching the v1 template used on audit-log, atomic-deployments, and deploy-progress pages). Refreshes seven screenshots against the production node signed in as admin, scrubbing IPs and usernames before capture: full Nodes panel overview, Generate Node Token card with a placeholder token, Add node modal in Pilot Agent mode, Add node modal in Distributed API Proxy mode (with the inline plain-HTTP warning visible), Edit modal showing the Regenerate enrollment token card for a pilot agent, Pilot enrollment modal with the docker run command, refreshed node switcher popover, and a close-up of the table columns. Drops the obsolete add-node-form.png, http-warning.png, and per-node-scheduling/ folder. * docs(fleet-view): refresh page for v1 layout, expanded tabs, cordon, sheet-based updates - Aligns the Overview, Status, and Node Updates content with today's UI: the masthead's `The fleet` headline plus CPU / MEM / CONTAINERS stat tiles, the eight-tab strip (Overview, Snapshots, Status, Deployments, Traffic, Federation, Fleet Actions, Secrets) with per-tier visibility, and the Check Updates surface that is now a system sheet rather than a modal. - Documents the toolbar (search, sort, filter popover with Status / Type / Severity / Tags sections) and the Grid / Topology segmented control including the topology graph's status pill (Online / Critical / Offline), connector colouring, ReactFlow controls and minimap. - Documents the per-card surfaces that were missing from the prior page: Cordoned badge with cross-reference to Fleet Federation, fleet stack label dots in the drill-down, container drill-down rows (state dot, badge, image, status, open-in-editor hover button), and the Admiral three-dot Node actions menu for cordon / uncordon. - Documents the Node Updates sheet anatomy (Recheck and Update all (n) header actions, four summary cards, node table columns, Update flow, reconnecting overlay timing, admin enforcement) and the GitHub Releases with Docker Hub fallback resolution path with its 30-minute cache. - Replaces every stale screenshot with a fresh capture (overview, topology, drill-down, status tab, node updates sheet) and removes the obsolete files plus the empty docs/images/fleet/ folder. - Reformats troubleshooting as an AccordionGroup matching dashboard, multi-node, and audit-log refreshes. * docs(fleet-backups): refresh page for redesigned fleet and settings UI Replace all six screenshots with current production captures. Update content to reflect the new fleet header card, eight-tab layout, full- page Cloud Backup settings with header stats, and corrected navigation paths. Add cloud backup rows to the access control table. * docs(fleet-backups): convert troubleshooting to AccordionGroup pattern Match the foldable-accordion pattern used across the v1 docs refresh batch. Merges the standalone Cloud Backup troubleshooting subsection into a single Troubleshooting section at the bottom of the page with seven accordions covering skipped nodes, two restore failure modes, three cloud-upload failure modes, and a diagnostic logging entry. * docs(remote-updates): refresh page for v1 sheet, accordion troubleshooting, factual fixes Rewrites the page against the v1 docs refresh template (Note tier gate, sectioned mechanism deep-dive, Frame screenshots with detailed alt text, inline AccordionGroup troubleshooting), bringing it in line with the recently-refreshed fleet-view, fleet-backups, dashboard, and audit-log pages. The page is repositioned as the mechanism deep-dive (prerequisites, what runs on a node during an update, completion and failure detection, recovery actions). The full UI tour for the Node updates sheet remains in fleet-view so the two pages stop overlapping; remote-updates now links into fleet-view#node-updates instead of restating the table anatomy. Captures three screenshots from the production node, signed in as admin: fleet-node-updates.png shows the Node updates sheet with eight nodes and seven remote updates available; local-update-confirm.png shows the LOCAL · UPDATE alert dialog with the Cancel and Update & restart buttons; node-card-update-available.png shows the Opsix card with the Update available pill and the Update to v0.76.7 outline button. Corrects several factual claims that no longer matched the current code: - The remote early-fail threshold is about 3 minutes, matching EARLY_FAIL_MS in backend/src/routes/fleet.ts, not 90 seconds. - The Recheck button sits in the sheet header, not the footer. - The component is a SystemSheet, so the page now consistently calls it the Node updates sheet instead of a dialog, with lowercase "Node updates" and lowercase "Update all (n)" matching the live UI. - Reconnecting overlay polls /api/health every 3 seconds, not "every few seconds". - The local Failed badge surfaces as soon as the helper writes its error file, by the 3-minute mark at the latest. Documents the LocalUpdateConfirmDialog kicker, title, body, and CTA verbatim, the Triggering... loading state on the Update buttons, the four completion signals the gateway accepts (version change, process startedAt change, offline-then-online transition, version at or above the comparison target after 15 seconds), and the 60-second auto-clear of the Updated badge. Drops references to two screenshots that never existed (fleet-node-updating.png, fleet-node-failed.png); the in-flight and failed states are described in prose instead, the same way fleet-view handles them. * docs(scheduled-operations): refresh page for v1 timeline, fleet-wide update action, sheet-based run history Rewrites the Scheduled Operations page against the v1 template (Note tier gate, sectioned anatomy, Frame screenshots, AccordionGroup troubleshooting) applied to sibling pages in this batch. Captures seven fresh screenshots against the production node signed in as admin (timeline, all-tasks, action-picker, create-restart, create-prune, create-scan, run-history) and removes every legacy PNG. Documents the new "Auto-update All Stacks" action that was absent from the page, extends the Skipper allow-list to all four Skipper actions (Auto-update Stack, Auto-update All Stacks, Fleet Snapshot, Vulnerability Scan) and clarifies that the action picker hides operations the active tier cannot run. Corrects several factual claims that no longer matched the code: - Scheduled scan completion is `info`/`scan_finding` on a clean run and `warning`/`scan_finding` when findings are present (not `info`/`system` as previously stated). Cross-link now points at `alerts-notifications#vulnerability-scanning`. - Lifecycle actions (auto_backup, auto_stop, auto_down, auto_start) execute against the local Sencho instance only; only Auto-update Stack / All Stacks have a remote-proxy code path. The page reinstates the guidance to schedule remote lifecycle operations from that node's own UI. - Run history lives in a right-side sheet with a "Schedules › <task> › Runs" breadcrumb and a Download CSV secondary action. - Timeline masthead is described in terms of the v1 visual (`NEXT 24 HOURS` kicker, italic display heading, monospace date range, right-anchored Next pill with countdown, glowing cyan now rail, six-tick bottom axis). * docs(rbac): refresh RBAC & user management page against v1 template Bring /features/rbac onto the v1 docs refresh template (Note tier gate, sectioned anatomy, Frame screenshots, AccordionGroup troubleshooting). Recapture five screenshots from the production node signed in as admin and remove the three stale captures under docs/images/rbac/. Corrections vs. the prior page: - Deployer no longer claims node:read in the permission matrix; the backend grants only stack:read and stack:deploy. - Add the system:registries row (container registry management). - Document the form as inline below the Add user button (not a modal). - Note the (you) marker on the signed-in admin's row and the disabled delete icon on that row. Additions: - Settings nav location and hub-only visibility. - 2FA reset row action with verbatim modal kicker, title, and body. - Five-failure / 15-minute MFA lockout behavior and admin reset recovery. - Token-version session-security table covering deletion, role change, password change, and admin 2FA reset. - SSO password-fields-hidden line quoted verbatim and the per-provider Require MFA toggle. - Audit-log emissions list for every user-management mutation. - API tokens cross-link explaining the user-vs-machine boundary. - Scoped permissions section retightened: scoped role picker is Deployer / Node Admin / Admin only; resource type is Stack or Node. AccordionGroup with eight troubleshooting entries covering missing nav, greyed role options, seat-limit errors, unexpected sign-outs, scoped deployer mismatches, missing shield icon, re-locking MFA accounts, and SSO role drift at provisioning. * docs(2fa): refresh two-factor authentication and admin guide against v1 template Bring /features/two-factor-authentication and /operations/two-factor-admin onto the v1 docs refresh template (Note tier gate, sectioned anatomy, Frame screenshots with descriptive alt text, AccordionGroup troubleshooting, verbatim modal copy with kicker callouts). Recapture every screenshot under docs/images/two-factor-auth/ from a fresh session and add six new captures for surfaces the prior page did not document. Corrections vs the prior pages: - Panel rename: Settings -> Account & Security is now Settings -> Account, under the Identity group of the settings sidebar. Replaced every occurrence on both pages. - Enrol dialog titles match the current modal: Pair your authenticator, Confirm the pairing, Save your recovery codes (was: Set up 2FA, Confirm, Save your backup codes). Step rail 01 PAIR / 02 CONFIRM / 03 ARCHIVE documented. - Manual-entry affordance is the always-visible Secret manual entry row with a copy icon, not the toggleable Can't scan Show secret key link. - Confirm step auto-submits on the sixth digit; no submit button. Verified in MfaChallenge.tsx and MfaEnrollDialog.tsx and called out explicitly. - Authenticator-app list trimmed to match in-app copy (1Password, Bitwarden, Google Authenticator, or any TOTP app). Authy and Microsoft Authenticator dropped because the dialog does not mention them. - Disable dialog: kicker SECURITY MFA DISABLE, title Turn off two-factor, destructive header, Disable button. Replaces the prior Disable 2FA paragraph that did not describe the dialog chrome. - Regenerate dialog: two-step flow with kicker SECURITY BACKUP CODES, Confirm identity then New recovery codes, with the verbatim PREVIOUS CODES HAVE BEEN INVALIDATED warn rail on the show step. Documented that the dialog only accepts a TOTP, not a backup code. - Per-user SSO toggle label corrected: Require 2FA on SSO sign-in (was: Require 2FA even when signing in via SSO). Added the per-provider vs per-user distinction on both pages (admins can also enable Require MFA on the SSO provider config, which is independent of the per-user toggle). - Admin reset modal: verbatim USERS RESET 2FA kicker, Reset 2FA for <username> title, full-body copy reproduced. Documented that the reset bumps the target's token version and invalidates active sessions. Additions: - Sign-in throttle: five failed verifications lock the account for 15 minutes, server returns 423 with Retry-After, UI shows the Retry in MM:SS countdown plus Rate limited label. Lockout recovery section explains that the counter only clears on a successful sign-in, so retries after the window expires re-lock immediately. - Account panel anatomy section enumerates the three rows (Authenticator app, Backup codes, Require 2FA on SSO sign-in) plus the destructive Disable 2FA link, and the masthead 2FA on / BACKUP N left chips. - Recovery codes section now covers all three count states (3 plus, 1 to 2, 0) with verbatim helper text, tone, and the standalone No backup codes left callout that renders at zero. New screenshots for the 2-remaining and 0-remaining states. - Cross-references to the admin operations page (CLI fallback, token version rotation, what a reset changes in the DB), the SSO page, and the RBAC page (per-provider Require MFA toggle, SSO auto-provisioning). Troubleshooting on the feature page rewritten as an AccordionGroup with nine entries: clock drift, wrong account selected, QR will not scan, lost phone with no codes, lost codes with authenticator, ran out of codes, unexpected SSO prompt (with both toggle causes), repeated lockout after the window expires, missing shield icon on Users panel. The admin operations page also gains the SSO + 2FA two-toggles table so administrators can answer the per-user vs per-provider question without context-switching between pages. Six new images added; six existing images replaced. Total 14 captures. * docs(rbac,host-console): drop enforcement-boundary detail from tier-gate notes Operator-facing docs should state tier or role requirements once, in plain customer-facing language, and leave the enforcement chain to the source. Two surfaces on the v1-refreshed pages over-specified the gate: - `features/rbac.mdx::Scoped permissions`: the Note enumerated both the UI hide on Skipper and the `/api/users/:id/roles` write rejection. The first half ("Scoped permissions require Admiral.") is the operator-relevant fact; the rest reads as a fence specification, which is awkward for an open-core product where the gate is readable in source anyway. Trimmed to just the tier claim. - `features/host-console.mdx::Availability`: the paragraph already says who can use the console and that the Console tab is hidden on Community or Skipper. The trailing "Attempting to access the console endpoint directly without the correct license or role is rejected" is the same bypass-prevention coda. Dropped. No functional behavior change; the gates themselves are untouched. * docs(sso): refresh SSO & LDAP authentication page against v1 template Rewrites docs/features/sso.mdx against the v1 docs refresh template (intro + tier callout, sectioned Configuration anatomy, Frame screenshots, AccordionGroup troubleshooting), bringing it in line with the previously refreshed two-factor-authentication and rbac pages on this branch. Recaptures all four screenshots from the production node signed in as admin: sso-settings (overview with the five collapsible provider cards), sso-settings-ldap (LDAP form expanded), sso-settings-oidc (Google form expanded), sso-settings-custom-oidc (Custom OIDC form expanded with all eleven fields). Refreshes the Settings UI section to match the redesigned panel: each provider is a collapsible card with an Active badge on the header, an enable / disable toggle pill, and a footer with Save, Test Connection (green check or red X next to the button), and Remove (only after a config has been saved). Documents the static callback-URL helper that sits below all five cards. Clarifies that the per-OIDC claim mapping environment variables (SSO_OIDC__ID_CLAIM, _USERNAME_CLAIM, _EMAIL_CLAIM) are accepted for Google, GitHub, and Okta, not just Custom OIDC. The Settings UI hides those fields on the presets because the defaults match. Converts the troubleshooting section to an AccordionGroup with five entries (Test Connection discovery failure, issuer validation error, wrong username or missing email after sign-in, invalid redirect URI, SSO buttons missing on the login page). Cross-links the operations troubleshooting page for setup-time errors. Tightens the LDAP TLS env var note to spell out the literal string 'false' requirement. Syncs the Combining SSO with 2FA section to use the live toggle label 'Require 2FA on SSO sign-in'. docs(sso): drop the Community-tier Custom OIDC workaround tip The Tip walked through how a Community-tier operator could integrate Google, GitHub, or Okta by pointing Custom OIDC at the provider's discovery URL, bypassing the Skipper preset gate. Operator docs should state the tier rule once and stop; they should not describe how to circumvent it. The tier matrix above the removed block already names which providers are paid; the Custom OIDC row already lists "any spec-compliant OIDC provider" as its scope. That is enough. * docs(vulnerability-scanning): refresh page for v1 UI and corrected tier mapping The page was last revised before the v1 visual redesign and before the tier-mapping changes shipped in v0.81.2 (open Community access to secret scanning, compose misconfig scanning, scan history, and scan comparison). This refresh: - Rewrites the tier matrix to match the shipped Community / Skipper / Admiral split. Secret detection, compose misconfig scanning, scan history, scan comparison, and misconfig acknowledgements are now correctly marked as Community. Scheduled fleet scans, scan policies with block_on_deploy, SBOM, SARIF, and Trivy auto-update stay paid. - Drops two stale Notes that said secret detection and compose misconfig scanning required Skipper or Admiral. The page now states each tier requirement once, in plain language. - Refreshes all six existing screenshots from the production node: resources-badges, scan-details-sheet, scan-history-sheet, scan-compare-sheet, security-settings, app-store-toggle. - Adds a new scan-config-button screenshot showing the stack-page overflow menu where Scan config now lives. - Describes the scan drawer header accurately: Re-scan + Compare + CSV + SARIF as top-level buttons, with SBOM as a separate button below the summary. - Updates the compose misconfig flow to point at the stack overflow menu (not the Deploy controls). - Converts the troubleshooting section to a single AccordionGroup per the v1 template, and audits each entry for legacy phrasing and the removed tier claims. - Adds a TRIVY_BIN reference to the How it works section so operators know about the host-binary override. * docs(cve-suppressions): refresh page for v1 UI and corrected suppression specifics - Recapture all three screenshots from the production node signed in as admin under `docs/images/cve-suppressions/` (`settings-panel`, `create-dialog`, `suppressed-row`). The previous file referenced three image paths that did not exist in the repo. - Align prose with the actual UI labels: - Dialog kicker `SUPPRESSIONS . NEW`, title `New suppression`. - Field labels match the form: `CVE or advisory ID`, `Package (optional)`, `Image pattern (optional)`, `Reason`, `Expires in (days, optional)`. - Remove confirmation reads `Remove suppression` with kicker `SUPPRESSIONS . REMOVE . IRREVERSIBLE`. - Factual corrections: - Fleet sync truncation cap is 5,000 rows (not 10,000). - State the admin-role requirement once in the lead Note. - Drop references to a `Fleet . Sync status` page and a `Reanchor` button; neither exists in the UI. The reanchor flow is an admin API call and is documented in /features/fleet-sync. - Sharpen the specificity scoring section (package + image scores 3, package only 2, image only 1, neither 0) so the order matches the read-time filter logic. - Note that the image-pattern glob is case-sensitive. - New coverage: - Suppressing directly from a scan result, including which fields are read-only in that inline flow and when to fall back to Settings to broaden scope. - The `replicated` and `expired` row badges in the panel. - Hovering the package column on a suppressed row to surface the Reason. - Two distinct read-only modes: viewing a remote node from the hub (panel hidden, banner shown) versus signing into a replica instance (panel visible, read-only). - SARIF export carries suppressions through as `kind: external, status: accepted`, cross-linked to the Vulnerability Scanning page. - Convert troubleshooting to AccordionGroup with six entries; update the truncation entry to reflect the 5,000-row cap. * docs(private-registries): refresh page for v1 UI and fleet-wide credential model Rewrites the page against the v1 docs template (Note tier gate, opening Frame, sectioned anatomy, AccordionGroup troubleshooting) and replaces every screenshot with a fresh capture taken against the current product. Corrects several factual claims that no longer matched the current code: - Registries are stored once on the control instance and applied fleet-wide, not configured per node. The old Multi-node behavior section and the matching troubleshooting entry described a per-node model that the product no longer has. - The Registries section is hidden on remote nodes (global scope) and on Sencho versions that do not surface the feature. New troubleshooting entries explain both visibility states. - The feature is admin-only on Admiral. Non-admin operators do not see the section even on Admiral; previous copy implied any Admiral license user could manage credentials. - Registry endpoints are not reachable from API tokens; only an admin browser session can manage credentials. The Security section now states this without naming internal route paths. Documents UI behavior the previous page omitted: the inline form (not modal), the four type-specific form variants, the Docker Hub read-only URL field, the destructive delete confirmation with its stack-pull warning, the masthead REGISTRIES count, and the empty-state callout copy. Screenshots replaced: - registries-overview.png: section with one configured GHCR card and the masthead stat at one. - registries-empty.png: empty state with the Add registry button and callout. - registries-add-form.png: inline form with the Docker Hub default and the read-only URL field. - registries-ecr-form.png: form switched to ECR, showing the AWS Region field and the relabelled AWS credential inputs. - registries-card-detail.png: card close-up with the three action icons and the metadata row. - registries-delete-confirm.png: destructive ConfirmModal with the kicker, title, and stack-pull warning body. - registries-with-entry.png removed (superseded by registries-overview.png and registries-card-detail.png). * docs(auto-update): refresh readiness page for v1 redesign Bring the Auto-Update Readiness doc in line with the shipped UI: - Replace the hero screenshot with a fresh capture of the redesigned board (italic-display hero, brand-cyan accent, per-node groups with local/remote pills, dashed-border changelog separator). - Rewrite the card-anatomy list. Drop the rollback-target bullet (the field exists in the backend payload but is not rendered). Add the "Rebuild available" inline label and the primary-image / multi-service count line. - Rewrite the risk-tags table as a risk-badges table using the actual badge labels and colors emitted by the UI (Safe / Review / Blocked with the corresponding icons; Digest rebuild for non-semver tags). - Add an Empty state section and document the per-node group header. - Tighten the hero subtitle paragraph to match the actual UI string (only major-bump count is surfaced separately; preview failures are not). - Fix workflow step 4: major-bump apply path is the stack lifecycle Update action, not the Schedules editor (a scheduled task hits the same block). - Add the 2-minute manual-refresh cooldown to the Recheck workflow. - Remove the broken cross-link to the non-existent /features/image-update-detection page and inline the 6-hour cadence fact from ImageUpdateService.INTERVAL_MS. - Convert troubleshooting to AccordionGroup format per the troubleshoot ing convention used on /features/deploy-progress. - Sync the Auto-Update entry in /features/overview.mdx to the new badge labels and the corrected hero-counter description. * docs(auto-update): fix Auto-Update entry point in Workflow step 1 Workflow step 1 said "Open the Auto-Update view from the sidebar." The Auto-Update view is opened from the top nav strip (alongside Home, Fleet, Resources, App Store, Logs, Schedules, Console, Audit). The sidebar carries the stack list and the per-stack right-click / kebab context menu that toggles auto-updates on or off; it does not house the Auto-Update top-level view. * docs(auto-update): trim enforcement detail from per-stack control note State the tier requirement once and stop, per Directive 27. The "The toggle does not appear on Community" sentence enumerates the enforcement effect of the gate, which the source already reflects; operator docs do not need to narrate it. * docs(auto-heal): refresh page for v1 UI and policy hardening Rewrite Auto-Heal Policies docs against the current Stack Monitor sheet: corrects the Max restarts / hr field label, documents the per-policy enable toggle, the consecutive-failures pill, the full Recent activity action set (including Docker unavailable), the 30s evaluation cadence, multi-node behavior, notification dispatches, and the dashboard Configuration status counter. Replaces the broken /images/auto-heal-policies/policy-sheet.png reference with three fresh screenshots captured against a live node: the sheet on the Auto-heal tab, a single policy row, and the expanded Recent activity panel. * docs(webhooks): refresh page for v1 UI, correct tier and add Git source sync - Fix tier note: gate is Skipper or Admiral, management is admin-only. - Update Settings path to Settings -> Alerts -> Webhooks; document the read-only Node field and the green secret-reveal callout. - Add the missing Git source sync action and the git-pull override value. - Refresh the configured-webhooks card description: action/stack/node badges, On/Off toggle, copy URL, and the Recent executions disclosure. - Tighten the trigger section with a constant-time signature check note and a status/body/meaning response table. - Add an Accordion troubleshooting block covering common signature failures, the 404 case, no-op actions on 202, and git-pull prereqs. - Re-capture all three screenshots from the v1 UI. * docs(webhooks): wrap troubleshooting accordions in AccordionGroup * docs(sidebar): refresh page for v1 redesign with filter chips, bulk mode, row anatomy, and troubleshooting Rewrites the Stack Sidebar page against the live v1 sidebar and the v1 docs refresh template (Frame screenshots, Note tier callouts, AccordionGroup troubleshooting). Recaptures all four existing screenshots and adds three new captures: filter chips, row anatomy, and bulk mode. Adds coverage for features the previous page omitted entirely: the ALL / UP / DOWN / UPDATES filter chips with their counts cap and collapse toggle; bulk mode (B key, sticky toolbar with Start / Stop / Restart, and Update gated on Skipper or Admiral); stack-row anatomy (status pill, label dots with +N overflow, image-update dot vs Git source icon priority, hover kebab); the Auto-update toggle, Schedule task, and Open App entries in the context menu; the B shortcut for bulk mode. Corrects three claims that no longer matched the code or UI: Auto-Heal is gated on Skipper or Admiral, not universal; the global Ctrl+K opens the command palette, not the sidebar search box; the activity footer kicker reads LIVE / IDLE with the verbatim copy from SidebarActivityTicker. Documents the in-menu ↗ and L › glyphs as visual hints rather than global keybindings to match useStackKeyboardShortcuts.ts. * docs(sidebar): trim enforcement-effect sentence from context-menu tier note State the Skipper / Admiral requirement once and stop, per Directive 27. The "They do not appear in the menu on Community" clause described the enforcement effect alongside the gate, which the directive bans in operator-facing docs. * docs(host-console): refresh page for v1 UI and clarify shell metadata Rewrite the Host Console page to match the current Cockpit layout (masthead + terminal well + chip strip), replace the legacy PowerShell screenshot with a fresh bash capture, and document the masthead tone states, kicker, metadata pills, and session/heartbeat behavior. Trim the security section to state the tier and role rule once. * docs(licensing): refresh page for v1 UI, corrected pricing, and trial flow Rewrites the Licensing & Billing page to match the redesigned v1 Settings layout. The previous draft still described the legacy Settings Hub: in-app "Upgrade your plan" Skipper/Admiral cards, "Start monthly trial" / "Start annual trial" buttons, the "Have a license key?" field, "Manage Subscription" with a capital S, "Deactivate License" as the button label, and the license-active.png asset rendering the literal "Sencho Pro" string in the card title. None of that exists in the current product. - Refreshes the Plans table to the live pricing on sencho.io/pricing and adds an Enterprise mention with the floor price ($3,500/year). Skipper now $11.99 annual / $14.99 monthly / $449 lifetime, Admiral now $69.99 annual / $89.99 monthly / $2,499 lifetime. - Rebuilds the Feature breakdown from a code-level audit of every requirePaid, requireAdmiral, requireScheduledTaskTier, and requireTierForSsoProvider call site in backend/src/routes, not from the marketing page. Notable code-grounded items: CVE suppressions on Community (no requirePaid guard), manual fleet snapshots on Community (scheduled snapshots on Skipper), Sencho Mesh under Admiral (entire mesh.ts router is requireAdmiral), and scheduled-task tiering names update/scan/snapshot as the Skipper subset with everything else under Admiral. - Rewrites the Free trial flow end to end. The previous steps told operators to click in-app "Start monthly trial" or "Start annual trial" buttons; no such buttons exist. The new flow starts on sencho.io/pricing, switches to the Annual or Monthly tab, clicks "Start 14-day trial" on the Admiral card, completes the Lemon Squeezy checkout (card-required, no charge before day 14), and pastes the issued key into Settings -> License -> License key. - Adds a new "The Plan section" anatomy block describing the masthead SCOPE / PLAN / DURATION (or RENEWS, TRIAL, STATUS) stat pills and the Plan card fields (Customer, Product, masked License key, status helper). - Adds a new "License states" reference table covering Community / Trial / Active subscription / Active lifetime / Expired / Disabled, what each surface renders, and which of the Plan / Activate / Pricing sections is visible in each state. - Corrects every UI label that drifted: section heading is Activate, field label is License key (not "Have a license key?"), buttons are Manage subscription (lowercase s) and Deactivate (not "Deactivate License"), and the action-row hint reads "Lemon Squeezy manages billing". - Documents the redesigned profile dropdown: identity header with initials chip, role badge, and tier badge, then Settings, conditional Billing, Documentation, Feedback, an Appearance segmented control, and Log Out. Billing only appears when the license is an active non-lifetime subscription. - Replaces all four screenshots under docs/images/licensing/: license-admiral-active.png (production Admiral lifetime view), profile-menu.png (redesigned popover), and two new captures for the Community-tier surfaces (license-activate-section.png, license-community.png). Removes the stale license-active.png (legacy "Sencho Pro" card) and profile-billing.png (legacy dropdown). * docs(settings-reference): refresh page for v1 UI with new sections and masthead Rewrites docs/reference/settings.mdx against the current Settings Hub so a reader encounters an accurate map of every section. Adds the previously missing Cloud Backup and Security sections, restructures System Limits into Host thresholds and Docker hygiene subsections (GiB units, "Global crash capture" toggle), fixes the Account password minimum to 8 chars and documents the two-factor subsection, refreshes License/Routing/Webhooks/App Store with the field labels actually rendered today, and documents the masthead pills (SCOPE/NODE, EDITED, plus the per-section stats like 2FA, PLAN, CHANNELS, ROUTES, WEBHOOKS, LABELS, TRIVY, POLICIES, PROVIDER, USED, SNAPSHOTS, DEV MODE). Replaces five existing screenshots that predated the v1 redesign and adds five new captures: Account with the 2FA card, License panel, System Limits with both subsections, Security with the Trivy installer, and Cloud Backup with Sencho Cloud Backup provisioned. All shots taken against the production node. * docs(licensing): drop billing-provider name from operator-facing copy The previous draft named the third-party billing provider in nine places (checkout, receipt email, error toast verbatim, Customer / Product field descriptions, the action-row hint, the billing portal, and the validation API). Operator docs don't need to advertise which vendor sits behind the checkout, billing portal, and validation calls. Rewrite each instance to describe what the operator sees and does without naming the upstream service. * docs(node-compatibility): refresh page for v1 UI with lock card visuals and current capability list - Replaces the legacy "dim + blur + pill overlay" description with the current CapabilityGate behavior: a centered lock card with an Unplug icon, title "<feature> is not available on this node", and a body line that names the node and its running version. - Corrects the tier-interaction section: on the wrong tier the entry point is hidden entirely, so the lock card only appears for users who already cleared the license gate. - Documents the public /api/meta endpoint, the 5-minute success cache, the 30-second failure cache, and the lazy-fetch behavior visible in the switcher (the version pill appears once a node has been visited). - Refreshes the capability table against the current CapabilityRegistry list, adding container-exec and vulnerability-scanning, with a note that vulnerability-scanning is only advertised when Trivy is installed. - Adds three production screenshots captured on the live fleet: switcher popover with mixed-version pills (one node on v0.76.9, rest on v0.81.11), a real lock card on an older pilot agent, and the Connection Details panel from Settings · Nodes. * docs(security): refresh security architecture page for v1 UI Add Fleet Secrets and Webhook signatures cards plus tier-matrix rows for shipped-but-undocumented features. Rename SSO presets from "one-click" to "preset providers" (presets still require OAuth-app provisioning on the upstream IdP). Update settings paths to the v1 middle-dot convention: Settings · Users, Settings · Account, Settings · Developer · Data retention. Extend the encryption-at-rest list with registry credentials and Fleet Secrets bundle payloads (both sealed with the same AES-256-GCM data key) and clarify the password section with bcrypt cost factor 10. Add a Webhook signature authentication subsection covering the per-webhook HMAC-SHA256 secret, one-shot display, masked preview thereafter, and constant-time comparison on inbound triggers. Replace the API Tokens screenshot with a fresh capture against the v1 Settings · Identity · API Tokens panel. * docs(security-advisories): retire reference page The reference/security-advisories page does not survive the v1 docs refresh: - Misuses the term "Security Advisories", which industry-wide refers to published notices for confirmed product CVEs (ID, severity, affected versions, fix version, remediation). The retired page was a narrative changelog of internal hardening work between v0.19 and v0.25.2. - The narrative is also frozen at v0.25.2 (April 2026) while current release is v0.81.11. Refreshing it would require backfilling ~56 release entries' worth of hardening copy. - The framing is uniformly "improved from prior behavior" (minimum 8 characters up from 6, 1-year token expiry previously without expiry, CORS previously allowed all origins, users should upgrade promptly). Sencho has not shipped publicly; there are no users to address as upgraders. All operationally relevant content already lives elsewhere: the security architecture page covers the current posture, verifying-images covers the supply-chain attestations, cve-suppressions covers operator acknowledgment, vulnerability-scanning covers the in-app scanner, and contact + the security architecture page both surface the disclosure path. Published Sencho-product advisories, when any exist, will appear on the GitHub Security tab, which is already linked from those pages. Inbound-link audit returned a single hit on the nav entry itself; no other doc, README, or operator artifact deep-links the slug. * docs: rewrite Pilot Agent page with deep architecture and operations reference Reframes docs/features/pilot-agent.mdx as the architecture-and-operations companion to the operator walkthrough in Multi-Node Management. Adds a mental model section, an explicit security and trust model, a full agent env-var reference, an honest limitations list, and a 5-item FAQ. Verifies every constant and label against the current backend source. Refreshes four production screenshots (admin login, scrubbed) and resolves the previously-broken /images/pilot-agent/enrollment-dialog.png reference. Adjacent edits keep the cross-linking coherent: - multi-node.mdx adds a one-line forward link to the rewritten page - security.mdx adds a Pilot Agent tunnel credentials subsection * docs(fleet-federation): deep rewrite with production screenshots Rewrites the Fleet Federation page against the v1 docs refresh template following the recent fleet-view, pilot-agent, and multi-node refreshes. Doubles the page length (92 to 204 lines) while keeping the cut-line v1 MVP scope: operator-driven placement controls (cordon + pin) for Blueprints, no expansion into mesh/sync/pilot territory. What changed: - Adds four production-captured screenshots under docs/images/fleet-federation/: the Federation tab with a cordoned node populated, the node-card kebab menu showing the Cordon node entry, the cordon confirmation dialog with a reason filled in, and a node card displaying the Cordoned pill. - Expands the page to eleven sections: opening summary, philosophy (kept), key capabilities, prerequisites, step-by-step usage with embedded screenshots, behaviour and lifecycle table, security and audit, limitations and non-goals (expanded), practical workflows (new: OS patching, host-to-host migration, gateway pinning), troubleshooting (eight accordions, up from five), and a Where Federation fits cross-link table. - Documents the exact production UI strings observed: the cordon dialog description, the uncordon confirmation copy, the reason field cap (256 chars), and the audit log action names (node.cordon, node.uncordon, blueprint.pin). - Documents the audit visibility surface so operators know how to filter the Audit view for cordon and pin history. - Adds eight cross-links to sibling pages (Fleet View, Multi-Node, Pilot Agent, Mesh, Fleet Actions, Fleet Sync, Blueprints, Licensing) with one-line scope contrasts so newcomers can place Federation in the broader fleet picture. - Tightens lifecycle table to operator-relevant terms (no DB column names) and audit section to operator-facing wording (no middleware names), keeping the page operator-focused rather than implementation-focused. Validation: - Captured screenshots against the production node logged in as admin, using Playwright MCP. Cordoned and pinned actions reverted; audit log confirmed the matched cordon/uncordon pair. - Verified every cross-link target exists in the v1-refresh worktree (/features/fleet-view, /features/multi-node, /features/pilot-agent, /features/sencho-mesh, /features/fleet-actions, /features/fleet-sync, /features/blueprint-model, /features/licensing). - Compliance: no em dashes, no PII, no "previously"/"used to" framing, no fence-spec language, tier rule stated once in plain language. * docs(fleet-federation): drop fence-spec phrasing in the open-core context Sencho is open-core: anyone can clone the repo and read the tier gate. Operator docs that name exactly where the UI gate sits ("hidden at the Community and Skipper tiers", "lower-tier users do not see the toggle", "only the Federation tab is gated") work as a dig-target for a tech-savvy reader and undercut the open-core posture. Directive 27 already bans enforcement-chain spelling; the open-core threat model makes the same phrasings risky even when they describe UI surfaces rather than route guards. Removes three instances of the pattern on this page: - Top Note callout: drops "The tab is hidden at the Community and Skipper tiers." Keeps the one-line requirement: "Federation is an Admiral feature. Cordon and pin actions require an admin user role." - Security and audit section: drops the sentence enumerating which UI affordances are hidden from which tiers. Keeps the customer-visible behavior (the Cordoned pill stays visible at every tier as a read-only signal). - Troubleshooting "Federation tab is not visible" accordion: rewrites to lead with the requirement and the role check, drops the "Federation is hidden by design" and "only the toggle and the Federation tab are gated" phrasings. Other claims on the page unchanged; rule is still stated once in plain language at the top of the page. * docs(fleet-sync): deep rewrite with production screenshots Replace fleet-sync.mdx with a verified end-to-end reference. The previous page named two replicated resources but the code syncs three, described a sync-status panel and a fleet-vs-node scope picker that do not exist in the shipped UI, and was missing prerequisites and several edge cases. Highlights of the rewrite: - Names all three replicated resources (scan policies, CVE suppressions, misconfig acknowledgements) and treats them uniformly. - Drops the sync-status-panel and node-scope-picker UI claims; both move to the Limitations section as honest caveats. - Adds prerequisites covering the paid-tier requirement on the control, admin-role requirement, proxy-mode remotes, and reachability. - Expands lifecycle coverage: per-node serialised pushes, add-node backfill, monotonic pushedAt, per-resource watermarks, identity-drift notifications, the 5000-row truncation cap, stale-target warnings, audit-log entries on the replica. - New "Where Fleet Sync fits" closing table cross-linking to Fleet View, Multi-Node Management, Pilot Agent, Vulnerability Scanning, CVE Suppressions, Fleet Federation, Fleet Actions, and Licensing. - Two fresh production screenshots: control Security panel and the "Scanner is per-node" callout shown when proxying to a remote. * docs(fleet-actions): deep rewrite with production screenshots Three cards are documented end to end: Stop fleet by label, Bulk label assign, and Prune Docker resources fleet-wide. Adds the execution-path distinction (control-orchestrated fan-out vs single-node proxy), per-card behaviour and partial-failure semantics, prerequisites, limitations, practical workflows, an Accordion troubleshooting section, and a Where Fleet Actions fits comparison table linking the surrounding Fleet view features. Corrects the prior page's tab-neighborhood claim, confirm-dialog wording, autocomplete-vs-request scope, and missing batch ceiling. Replaces the ten-day-old single screenshot with five fresh production captures under docs/images/fleet-actions/. * docs(fleet-secrets): deep rewrite with production screenshots Full rewrite of /features/fleet-secrets matching the fleet-actions structure. Replaces the sparse v1 page (no Frames, inline Q&A) with a gold-standard layout: opening Frame, single Note for the tier gate, 'What it covers' table, mental model, prerequisites, create + edit + versions + push (Target / Preview / Results) sections each with a production Frame, Import from stack section, behaviour and lifecycle table, audit-trail mapping with the six exact audit strings, limitations and non-goals, practical workflows, AccordionGroup troubleshooting, and a Where-it-fits cross-link table. Adds six fresh production screenshots under docs/images/fleet-secrets/ : overview, create, versions, target, preview, and results. Documents the Import-from-stack flow (depends on the bundle editor's new Import action) and uses the post-rename 'Send' wording on the bundle-row action (depends on the aria-label fix). Corrects three factual drifts vs the code: env-key regex described as 'letter or underscore, then letters/digits/underscores; case- sensitive' to match ^[A-Za-z_][A-Za-z0-9_]$ ; documents only the 'ok' and 'failed' status pills (the 'skipped' enum value is unused); replaces the bogus 'stack not found' troubleshooting entry with the real 'env file not declared' cause. Drops the fence-spec phrasing 'The tab is hidden on Community.' per Directive 31; the tier requirement is now stated once in plain language. docs(sencho-mesh): deep rewrite with mental model, lifecycle, security, screenshots Replace the feature-reference page with a deep product + technical guide. Adds: - Opening hook framing audience and problem (cross-node service-to-service without a separate VPN or service-mesh sidecar). - Mental model: three moving parts (sencho_mesh bridge, alias registry, cross-node transport) with direction-of-flow described in prose. - Key capabilities, prerequisites, step-by-step usage with inline screenshots. - Full lifecycle section covering opt-in, opt-out, sticky stack-stopped state, peer reconnect, and the proxy-mode bridge with its real default (persistent, env-override for idle). - Security and trust boundaries split into authentication, inbound exposure, encryption, audit, and app-layer caveats. - Limitations and non-goals: one-alias-per-port, port 1852 reserved, central-relay for remote-to-remote, shared 1024-stream pool with the Pilot tunnel, no L7, host-network unsupported, in-memory activity log. - Three concrete workflow examples and a complete troubleshooting accordion (every data-plane reason, every probe stage, every unreachable cause) plus a Common questions FAQ. - Where Mesh fits CardGroup linking Pilot Agent, Multi-Node, Federation, Licensing. Corrections vs prior text: - Tab is labelled Traffic in the UI (not Routing); all navigation references updated. - Proxy-mode bridge default is no idle close (env-overridable to opt into idle teardown); prior 5-minute-teardown claim removed. - Audit trail scope tightened: only opt-in / opt-out write durable rows; tunnel-state and probe events live in the in-memory activity log. Adds seven production screenshots under docs/images/sencho-mesh covering Table view, opt-in sheet, graph (Tunnels and Aliases edge modes), Diagnostics, activity log, and per-stack topology. * docs(blueprints): add missing detail-state-review screenshot Captures the Blueprint detail sheet with a deployment row in the "Awaiting confirmation" status (stateful first-deploy gate), to fix the broken image referenced at blueprint-model.mdx:132. mint broken-links now reports zero broken references. * docs(blueprints): deep rewrite with mental model, lifecycle, security, prerequisites Restructures the Blueprints page against the v1-refresh template used by the recently-refreshed mesh, secrets, and atomic-deployments pages. Adds a mental model, prerequisites table, lifecycle and status-transition map, security and trust boundaries section, practical workflows, common questions accordion, and a Where Blueprints fits CardGroup. Removes the internal-style rollout and watch-plan section. Replaces all nine production screenshots with fresh captures against the production node signed in as admin, and adds two new captures (federation pin policy table, stateless eviction dialog). Rewrites the tier-gate Note to drop the fence-spec phrasing that violated Directive 31. Every retained claim is anchored to current backend or frontend code. * docs(pilot-agent): recapture enrollment dialog with compose payload Replaces the pre-0.84 docker-run capture with the current dialog (Compose file, two-step instructions, "Copy compose file" button) and refines the alt text to describe the captured content. URL and token redacted to placeholder values during capture.	2026-05-20 08:43:18 -04:00
Anso	0f0b22c51a	feat(fleet): Fleet Secrets tab with env-var bundles (v1 MVP) (#965 ) * feat(fleet): add Fleet Secrets tab with versioned env-var bundles (Skipper+) Centralized, encrypted-at-rest secret bundles that can be pushed to labeled nodes' stacks. Each save bumps a monotonic version; each push records a per-node-per-version row in `secret_pushes` plus an entry in `audit_log`. Conflict detection shows added/changed/unchanged/removed (informational) diffs before write. Overlay merge preserves keys missing from the bundle. - Adds `secrets`, `secret_versions`, `secret_pushes` tables. - New `SecretsService` reuses CryptoService for AES-256-GCM, NodeLabelService for selectors, and direct fetch + Bearer for outbound calls to remote nodes. - New `secretsRouter` with 9 endpoints under `/api/secrets`, gated by `requirePaid`. Mounted after the auth gate. - Audit summary patterns added for the new routes. - New Fleet › Secrets tab with bundle list, editor sheet (key=value rows, versions tab), and push wizard (selector, target stack, env file picker, per-node diff preview, results pills). - Documentation: docs/features/fleet-secrets.mdx + docs.json nav entry. - 26 Vitest cases cover parser, encryption, versioning, push aggregation, tier gating. * fix(fleet): use const for rawValue in env parser ESLint prefer-const flagged the let declaration as a CI-blocking error; the variable is never reassigned.	2026-05-07 06:03:39 -04:00
Anso	52b46753af	feat(fleet): add Federation tab with cordon and pin policy (Admiral) (#964 ) Ships the v1 MVP for the Federation tab as placement control, not placement automation: - Cordon a node: marks the node unschedulable so the BlueprintReconciler skips it for new placements only. Existing deployments continue to drift-check and redeploy on revision changes; cordon never triggers withdraw or eviction. Toggle on the NodeCard kebab (Admiral, admin role); Cordoned pill renders for all tiers. - Pin a blueprint to a node: stores blueprints.pinned_node_id, replacing the desired set with the pinned node regardless of selector. Pin overrides cordon by design. Action lives only in the Federation tab; BlueprintDetail and the deployment table show read-only Pinned indicators. Backend: idempotent migrations add nodes.cordoned/cordoned_at/cordoned_reason and blueprints.pinned_node_id. New routes POST /api/nodes/:id/cordon, POST /api/nodes/:id/uncordon, PUT /api/blueprints/:id/pin, all gated by requireAdmiral plus requireAdmin. Audit summaries added so the existing auditLog middleware records every operator action. deleteNode clears dangling pins. Reconciler: pin override evaluated before selector match; cordon filter applied only to the new-placement branch (deploy/stateReview without an existing deployment). 11 new Vitest cases cover cordon filter, pin override, pin-overrides-cordon, missing pin target, pin shrinks desired set (stateless withdraw + stateful evict_blocked), and pin clearing on node delete. Frontend: new FederationTab.tsx with cordoned-nodes summary and pin-policy table. Federation moved out of the experimental flag into {isAdmiral && (...)} + AdmiralGate, mirroring the Routing tab pattern. Secrets stays under experimental. Tests pass: backend tsc, full Vitest suite (1704 passed), frontend tsc -b, ESLint (0 errors). Manual verification via the local dev instance confirmed the tab is hidden at Community, the kebab and pill render at Admiral, and cordon and pin endpoints round-trip end to end. Refs cut-line-1.0.md Federation v1 MVP.	2026-05-07 05:55:00 -04:00
Anso	77d5ff58d3	feat(fleet): add Fleet Actions tab for cross-node bulk operations (#963 ) * feat(fleet): add Fleet Actions tab for cross-node bulk operations Introduces a new "Actions" sub-tab in Fleet view with two Skipper+ cards that fill gaps in the existing surface: - Stop fleet by label: matches a label name across every node and stops every stack assigned to it, reporting per-node and per-stack results. - Bulk label assign: applies the same label set to many stacks on one node in a single round trip. Other bulk operations stay in their existing homes (sidebar bulk mode, Schedules, NodeUpdatesSheet) to avoid duplicate surfaces. Backend: - POST /api/fleet/labels/fleet-stop (gateway-orchestrated, multi-node) - POST /api/fleet-actions/labels/bulk-assign (per-node, capped at 1000) - Tightens /api/fleet proxy-exempt prefix to /api/fleet/ so /api/fleet-actions/* is routed through the proxy for per-node calls. - Exports activeBulkActions from labels.ts so fleet-stop and label-action share the per-node lock and cannot double-stop the same containers. - Extracts containerActionForStack helper from stacks.ts for reuse. * chore(fleet): rename Actions tab to Fleet Actions and reorder Fleet sub-tabs - Tab label "Actions" -> "Fleet Actions" so the surface is unambiguous alongside Schedules and the sidebar bulk bar. - Reorder Fleet sub-tabs as Overview / Snapshots / Status \| Deployments / Traffic / Fleet Actions, with the separator after Status. - Rename "Traffic · Routing" -> "Traffic" and update Sencho Mesh docs to match the shorter label. - Update Fleet Actions docs to the new tab name and placement.	2026-05-07 05:41:53 -04:00
Anso	aa00dc2b89	docs: split Features by capability and tighten nav (#956 ) Subdivide the 40-page Features sidebar into six capability subgroups (Stacks & Deployments, Observability, Fleet & Multi-Node, Security & Identity, Automation, Platform) so users find features by purpose rather than scrolling a flat list. Move the licensing page into the Reference group where it belongs and reorder Reference for scan-ability. Reorder the Operations group by lifecycle: install, upgrade, backup, troubleshoot, then per-feature admin tools. Nav-only change. No .mdx files were moved or renamed; every page keeps its existing URL. Tier badges already inside each page are unchanged.	2026-05-06 21:22:18 -04:00
Anso	e5391e66cb	feat(blueprints): add Fleet > Deployments tab UI, node labels, and docs (#861 ) Implements the frontend layer for the Blueprint Model feature (backend landed in PR #860). Fleet > Deployments tab is now live for Skipper+ users; Community users see the existing locked badge. Key additions: - blueprintsApi.ts: typed apiFetch wrappers (localOnly: true on all calls) - BlueprintCatalog: featured hero, filter pills, classification-chipped tile grid - BlueprintEditor: Monaco YAML editor with debounced live classification, label/node selector, three-mode drift radio cards, create/edit modes - BlueprintDeploymentTable: per-node status rows with action buttons (Confirm deploy, Retry, Withdraw/Evict, DATA PINNED HERE for stateful) - EvictionDialog: dual-affordance (Snapshot then evict / Evict and destroy) - StateReviewDialog: fresh-deploy acceptance gate for stateful blueprints - BlueprintClassificationBanner: real-time stateless/stateful/unknown banner - DeploymentsTab: wires catalog, empty state, and create dialog - BlueprintDetail: Sheet with Apply/Edit/overflow, themed delete dialog - NodeLabelPicker + NodeLabelPill: label CRUD per node in NodeManager - FleetView: gates Deployments tab behind isPaid; mounts DeploymentsTab - NodeManager: Labels column with NodeLabelPicker (Skipper+ users) - docs/features/blueprint-model.mdx + docs.json entry + 6 screenshots	2026-05-01 19:47:05 -04:00
Anso	7663f4cd8b	feat(fleet): sencho mesh in traffic and routing tab (#858 ) * feat(fleet): sencho mesh in traffic and routing tab Lights up Sencho Mesh: cross-node container forwarding rendered as if the container next to you were on localhost. Builds on the dormant TCP frame plumbing from the prior PR (pilot tunnel TCP frames + sencho-mesh sidecar package) and exposes the Admiral-only orchestrator surface. Backend - New mesh_stacks table (per-node opt-ins) + nodes.mesh_enabled column via DatabaseService.migrateMeshTables. - MeshService singleton: sidecar lifecycle via Dockerode, opt-in/out with cascading override regeneration, request-based resolver from sidecar control WS, cross-node TCP forwarding via PilotTunnelManager (same-node fast path included), in-memory 1000-event activity ring buffer with durable mirror to audit_log for state-change events, per-node and per-route diagnostics, and the Test upstream probe. - MeshComposeOverride: pure YAML generator that injects extra_hosts using host-gateway. The user's docker-compose.yml is never mutated; overrides live under DATA_DIR/mesh/overrides. - ComposeService deploy/update splice the override file when the stack is opted in; non-mesh stacks behave identically to today. - Pilot agent resolveMeshTarget consults the local mesh_stacks table (defense in depth) and resolves Compose containers via Dockerode. - /api/mesh router with 13 Admiral-gated endpoints covering status, enable/disable, stack opt-in/out, alias listing, per-route diagnostic, Test upstream probe, per-node diagnostic, sidecar restart, activity log paginated and SSE. - meshControl WS slot at /api/mesh/control validates the mesh_sidecar JWT minted by MeshService; dispatched as upgrade slot 2 (canonical order preserved). Frontend - New Traffic Routing tab in FleetView, gated by isAdmiral and wrapped in AdmiralGate. Tab uses the cyan brand glyph and italic-serif state typography from the audit. - RoutingTab masthead with mesh activity drawer, per-node card grid with TogglePill, alias rows with five-state pill taxonomy (healthy / degraded / unreachable / tunnel-down / not-authorized), inline Test buttons. - Four sheets: opt-in picker with port-collision inline error, per-route detail with diagnostic + filtered activity, per-node diagnostics with active streams + resolver cache + restart action, fleet-wide activity log with filters. - meshRouteState helper centralizes pill-state mapping; pure-function tests cover all five states. Docs - User docs at /docs/features/sencho-mesh.mdx covering opt-in, troubleshooting, security model (4 guarantees + 4 explicit non-guarantees), and V1 limitations. - Internal architecture and runbook pages. - websocket-dispatch internal doc updated with the new slot. * fix(mesh): validate stack name before path use; fix test DB lifecycle Two surgical fixes against the prior PR. Path-injection (CodeQL js/path-injection): MeshService.optInStack, optOutStack, ensureStackOverride, and removeStackOverride now validate stackName via isValidStackName from utils/validation, reject malicious names at the API boundary, and additionally check isPathWithinBase on the resolved override file path for defense in depth. The dataflow from req.params.stackName to fs.writeFile no longer reaches an unsanitized path expression. Test DB lifecycle: mesh-service.test.ts used per-test setupTestDb / cleanupTestDb, which deletes the temp dir while DatabaseService still holds an open SQLite handle. On Linux CI this raises SQLITE_READONLY_DBMOVED on the next prepare() because the inode has been unlinked. Switched to file-scoped beforeAll/afterAll matching agents-routes.test.ts, with a per-test beforeEach that truncates mesh_stacks plus non-default nodes and resets the MeshService singleton in-memory state. Adds a new test case asserting the path-traversal rejection. * fix(compose): use discovered compose filename instead of hardcoded docker-compose.yml composeArgs() hardcoded `-f docker-compose.yml` for every deploy. Sencho writes its canonical compose file as `compose.yaml`, so any stack created via the UI failed to deploy with `open ...docker-compose.yml: no such file or directory`. When no mesh override applies, drop the explicit `-f` so docker compose's built-in discovery resolves the actual filename. When an override exists, look up the real base filename via FileSystemService.getComposeFilename() and pass both files explicitly. Also hoist the MeshService import to module top now that the dependency is known to be acyclic, and revert the matching unit-test assertion.	2026-05-01 01:50:53 -04:00
Anso	3e01daf76f	feat(stack): per-stack activity timeline with actor attribution (#852 ) * feat(stack): per-stack activity timeline with actor attribution Adds an Activity tab to the Stack Anatomy panel showing a timestamped event log for each stack: deploys, restarts, starts, stops, and image updates, attributed to the user who triggered them or 'system' for automated actions. Backend: - Extends notification_history with actor_username column (idempotent migration) and a partial composite index on (node_id, stack_name, timestamp DESC) for efficient per-stack lookups. - NotificationService.dispatchAlert() accepts an optional actor that is written to the new column. - Success-side dispatchAlert calls added after deploy, bulkContainerOp (start/stop/restart), and update handlers in routes/stacks.ts so user-initiated operations are recorded, not just failures. - New GET /api/stacks/:stackName/activity?limit&before endpoint with stack:read permission gate and cursor-based pagination. Frontend: - StackAnatomyPanel grows an Anatomy / Activity tab pair using the existing Tabs primitive. - StackActivityTimeline fetches the initial 50 events, paginates on demand, and prepends live events arriving over the existing WS notifications stream without duplicates. - NotificationPanel bell dropdown suppresses user-initiated success events (start/stop/restart/deploy/update triggered by a real user), keeping the tray focused on alerts and system events. * docs(stack): add stack activity timeline feature page and internal arch docs * fix(test): add actor_username to notification-routing history assertions dispatchAlert now passes actor_username to addNotificationHistory after the activity timeline PR added the column. Update the two exact-match assertions that were failing because the expected object shape was missing this field.	2026-04-30 19:53:23 -04:00
SaelixCode	3da0aa6036	chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/*/.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.	2026-04-29 09:24:20 -04:00
Anso	3668c71860	feat(security): add SBOM attestations, VEX document, and retire .trivyignore (#790 ) * feat(security): add SBOM attestations, VEX document, and retire .trivyignore Add OpenVEX triage document (security/vex/sencho.openvex.json) for the 5 residual CVEs vendored inside docker/compose v5.1.2 that were carried over from the previous PR. All 5 are marked not_affected with justifications. Configure Trivy in both CI and release workflows to consume the VEX document via trivy.yaml so the same source of truth gates PR scans and release scans. Delete .trivyignore, which is fully superseded by the VEX file. Add two new release pipeline steps after image publication: - CycloneDX 1.6 SBOM via anchore/sbom-action (also installs syft) - SPDX 2.3 SBOM via syft directly (reuses OCI layer cache from prior step) Both are attached as cosign OCI referrer attestations (keyless, OIDC-signed) and uploaded as GitHub Release assets alongside the OpenVEX file. Bump docker-publish.yml permissions from contents:read to contents:write, required for softprops/action-gh-release to create Release assets. Add docs/operations/verifying-images.mdx with copy-paste verification commands for all supply-chain artifacts: signature, SLSA provenance, CycloneDX SBOM, SPDX SBOM, OpenVEX, and Rekor entry. Update docs.json navigation and expand the Supply chain security section in docs/security.mdx. Add a Verifying Release Artifacts section to SECURITY.md. * fix(vex): cover otel SDK CVE-2026-39883 in rebuilt Docker CLI binary The rebuilt Docker CLI v29.4.0 vendors otel/sdk v1.42.0, which still contains CVE-2026-39883 (BSD kenv PATH hijacking; fixed in v1.43.0). docker-compose v5.1.2 vendors otel/sdk v1.38.0 separately. The original VEX statement only covered the compose binary's location and version, so Trivy's scan of /usr/local/bin/docker was not suppressed. Add a second subcomponent entry for the CLI binary path with the correct vendored version. The not_affected justification (BSD-only code path; we ship linux/amd64 and linux/arm64 only) holds for both binaries. * fix(ci): use list form for vulnerability.vex in trivy.yaml Trivy's config schema requires vulnerability.vex to be a list (mapped to the multi-value --vex flag). The previous bare-string value was silently dropped, so the OpenVEX document was never loaded and HIGH findings already covered by VEX statements still failed the scan. * fix(ci): mirror VEX CVE in .trivyignore for local-image scan Trivy does not emit an OCI purl for locally-built images without a RepoDigests entry (aquasecurity/trivy#9399), so OpenVEX product matching against the CI build target sencho:pr-test resolves to no artifact and every statement is silently dropped. The VEX document remains the canonical triage record and is still attached as a cosign attestation on the published image; this file just mirrors the single CVE that surfaces on the local scan so CI does not block on a finding already triaged in VEX. Updates the Trivy step comment to document the relationship between the two files.	2026-04-26 23:21:11 -04:00
Anso	801a098a5b	feat(files): per-stack file explorer (#780 ) * feat(files): backend foundation for stack file explorer Install multer for multipart file upload handling. Add isValidRelativeStackPath to validation.ts to guard client-supplied relative paths against traversal, absolute paths, NUL bytes, backslash injection, and double-slash segments. Add isBinaryBuffer to a new binaryDetect.ts utility for heuristic text/binary detection via NUL-byte fast exit and non-printable byte ratio sampling. * fix(files): reject bare dot segments in isValidRelativeStackPath * feat(files): add safe stack-scoped file I/O methods to FileSystemService Adds FileEntry interface and seven new public methods to FileSystemService for stack-scoped file operations: listStackDirectory, readStackFile, streamStackFile, writeStackFile, deleteStackPath, mkdirStackPath, and statStackEntry. Each method routes through a private resolveSafeStackPath helper that enforces two-phase path containment: a pre-realpath lexical check plus a post-realpath symlink-escape check. ENOENT targets are handled by walking up to the deepest existing ancestor, realpaths that ancestor, and reattaching the remaining suffix. Binary detection delegates to isBinaryBuffer; path safety delegates to isPathWithinBase. Protected file names and the MIME map are module-level constants to avoid repeated allocation. * feat(files): frontend API wrappers and Monaco language helper * fix(files): tighten stackFilesApi error handling and localOnly support * fix(files): FileSystemService safety and correctness fixes * feat(files): add file explorer API endpoints to stacks router * feat(files): FileTree and FileTreeNode components * fix(files): route security hardening and stream cleanup * fix(files): FileTree accessibility, icon stroke, stale fetch guard Add strokeWidth={1.5} to all Lucide icons in FileTreeNode to match the design system. Add aria-expanded to directory rows for accessibility. Guard handleDirClick .then() callbacks against stale stack name references when the component re-renders with a new stack. Add toast.info fallbacks when compose.yaml or .env is clicked without a navigation callback registered. * feat(files): FileViewer, FileUploadDropzone, NewFolderDialog, DeleteFileConfirm * fix(files): resolve code quality findings in file explorer components - Move editorOptions useMemo above conditional returns in FileViewer (Rules of Hooks fix) - Fix blob download: append anchor to DOM before click, defer URL revoke 100ms - Keep protected-file confirm input visible during NOT_EMPTY recursive retry in DeleteFileConfirm - Remove non-functional cursor-pointer/onClick from Community upgrade pill in FileUploadDropzone - Add success toast on folder creation in NewFolderDialog - Switch all (e as Error).message casts to instanceof Error narrowing * test(files): unit tests for binary detection, stack path safety, and file explorer routes - binary-detection.test.ts: covers isBinaryBuffer edge cases (empty, NUL, PNG header, threshold boundary, sampleBytes parameter) - filesystem-stack-paths.test.ts: covers isValidRelativeStackPath (accepts/ rejects matrix) and FileSystemService stack methods against a real temp dir (listStackDirectory sort and protection flags, readStackFile text/binary/ oversized paths, writeStackFile/Buffer, deleteStackPath, mkdirStackPath, traversal guard); platform-specific empty-dir/NOT_EMPTY cases skip on Windows - stack-files-routes.test.ts: route-level integration tests for all seven file explorer endpoints; covers auth gating, Community-tier 403 gates, input validation, 413 TOO_LARGE upload limit, and 204/200 happy paths * feat(files): StackFileExplorer container with lazy tree, viewer, and action bar * fix(files): add Download button to explorer toolbar, fix Community upgrade pill, reset state on stack change * test(files): add missing test coverage for file explorer routes and service * feat(files): add Files tab to EditorLayout with StackFileExplorer integration * fix(files): add defensive activeTab guard to saveFile and discardChanges * test(files): unit tests for FileTree expand/collapse and FileViewer render modes Covers the three FileViewer content modes (text/Monaco, binary panel, oversized panel) and the FileTree expand/collapse/cache cycle: first expand fetches the subdirectory, second click collapses without a fetch, third click re-expands from the in-memory cache without a second fetch. * test(e2e): file explorer community and skipper+ flows Covers the full file-explorer feature surface in two describe blocks: Community (read-only): intercepts /api/license to simulate community tier, confirms the upgrade pill is visible in the left pane, and asserts that the Save button is absent after opening a text file. Skipper+ (full CRUD): uploads a text file and confirms it appears in the tree; edits config/app.conf and saves via Monaco; deletes an uploaded file and asserts the tree entry is gone; issues a raw HTTP request to the download endpoint and checks for status 200 and the content-disposition: attachment header. Also adds data-testid="file-action-delete" to the action bar Delete button in StackFileExplorer for stable targeting, and exports waitForStacksLoaded from e2e/helpers.ts to eliminate the three identical local copies in stacks, deploy-log-panel, and stack-files spec files. * fix(e2e): improve test isolation and selector stability in stack-files spec Move beforeEach seed to beforeAll/afterAll so fixtures are created once per suite, not before every test. Extract shared seedSuite/teardownSuite helpers to eliminate the duplicate beforeAll/afterAll blocks. Wrap teardown in try/catch so failures log a warning rather than masking test results. Replace waitForTimeout(500) with a deterministic expect on the file tree sentinel. Add data-testid="anatomy-files-btn" and data-testid="delete-confirm-btn" to replace the fragile button text/positional selectors. Assert Save button starts disabled before editing. * docs(files): add stack file explorer documentation Add user-facing guide for the stack file explorer feature covering tier access (Community read-only, Skipper+ read-write), viewing limits, upload/download caps, protected file routing, and troubleshooting. Update the editor page to reference the new guide and register the page in the navigation. * fix(docs): use canonical Skipper tier name in file explorer overview card * fix(files): resolve lint errors blocking CI Remove unnecessary backslash escape before double-quote in the Content-Disposition regex (no-useless-escape). Replace five synchronous setState resets at the top of the FileTree mount effect with a React key prop on the FileTree element in StackFileExplorer so remounting resets state automatically, eliminating the react-hooks/set-state-in-effect violation. * test(files): fix e2e seeding to work on community-tier CI Replace the browser-side paid upload/mkdir API calls in seedTestStack with direct Node fs writes. The upload and folder endpoints require Skipper+ so they returned 403 on CI, which runs with no license set. Stack creation via POST /api/stacks stays as an API call since it is community-allowed and keeps the backend registry in sync. Add a per-test tier check in the Skipper+ beforeEach that skips gracefully when the instance is community, matching the pattern in auto-heal-policies.	2026-04-26 13:05:19 -04:00
Anso	dd9d33813b	feat(deploy-logs): opt-in deploy progress modal with structured log rows (#779 ) * feat(notifications): dispatch deploy_failure alert on stack action errors * feat(terminal): add onReady and onMessage callback props * feat(deploy-logs): add DeployLogContext with runWithLog API * feat(deploy-logs): add DeployLogPanel bottom drawer with resize and minimize * feat(deploy-logs): wire DeployLogContext to App and EditorLayout action runners * test(deploy-logs): add E2E test for deploy log panel open, failure, and minimize * docs(deploy-logs): add user-facing and internal architecture docs * feat(deploy-logs): redesign as opt-in modal with structured log rows Replace the full-width bottom drawer (DeployLogPanel) with a centered modal that streams structured log output for deploy, stop, restart, update, install, and Git apply operations. The modal is disabled by default; users opt in from Settings -> Appearance. Core changes: - New DeployFeedbackContext with runWithLog() API: if opt-in is off, silently bypasses the UI so all call sites degrade to the existing toast behavior without code changes. - composeLogParser.ts: pure parser that strips ANSI escapes and classifies compose output into stage badges (PULL, BUILD, CREATE, START, STOP, DOWN, WARN, ERR, LOG). 15 unit tests. - StructuredLogRow.tsx: memoized row with timestamp, stage badge, and message. Error rows get a rose left rail; warn rows get a tinted bg. - DeployFeedbackModal: Dialog-based, max-w-640px/max-h-70vh, elapsed timer, auto-close 4s on success (hover cancels), persistent on failure. Raw xterm output collapsible in footer. - DeployFeedbackPill: minimized state anchored top-right, survives navigation, click restores modal. - Wires App Store install (action: install), Git apply (action: deploy), and Git pull (action: update) in addition to the existing EditorLayout actions. - Fixes Terminal.tsx WS URL in generic mode (was connecting to root path not proxied by Vite; now uses /ws). - Settings: adds "Show deploy progress modal" checkbox to Appearance. - Docs: renames deploy-logs.mdx to deploy-progress.mdx; updates internal architecture doc. * fix(deploy-logs): connect Terminal in generic mode and move pill to bottom-center Terminal was passed stackName which routes it to the stack logs WS (container stdout). In that mode onReady is never called, so the deployStarted gate never resolves and the compose command never runs. Remove stackName so Terminal uses generic WS mode, which calls onReady on open and streams compose output. Also reposition the minimized pill from top-right to bottom-center (fixed bottom-6 left-1/2 -translate-x-1/2) per UX feedback. * docs(deploy-logs): update pill position to bottom center * test(deploy-logs): rewrite E2E spec for deploy feedback modal The old spec targeted the removed bottom-drawer DeployLogPanel and used the wrong field name when calling POST /api/stacks (sent 'name' but the endpoint reads 'stackName'), causing every test to fail with a 400 before any UI assertions ran. Fixes: - POST /api/stacks body now uses 'stackName' matching the API contract - All locators updated to target the new DeployFeedbackModal and DeployFeedbackPill components (data-testid attributes added) - Added enableDeployFeedback helper to opt-in via localStorage before each test that expects the modal (feature is off by default) - Added opt-in OFF test to confirm the modal is suppressed when disabled - Minimize/expand test now asserts the pill appears and contains the stack name before clicking to restore the modal * test(deploy-logs): fix compose file write endpoint in E2E helper createStackViaApi was calling PUT /api/stacks/:name/files/docker-compose.yml which does not exist. The correct endpoint is PUT /api/stacks/:name with { content } in the body. * test(deploy-logs): use addInitScript to persist opt-in across reloads The opt-in flag was set via page.evaluate before setupDeployStack, which calls page.reload() and loginAs (a second navigation). Although localStorage should persist across same-origin reloads, the React tree was reading 'false' on remount in CI. Switching to addInitScript guarantees the localStorage value is set before any page script on every navigation, so useDeployFeedbackEnabled's useState initializer always sees the right value when React mounts. * test(deploy-logs): verify localStorage and re-dispatch event before deploy Adds syncDeployFeedbackState() called right before each deploy click in the ON tests. It both verifies localStorage is set (failing the test loudly with a clear message if not) and re-dispatches the SENCHO_SETTINGS_CHANGED event to defeat any stale React state after navigation. If the modal still does not appear with the assertion green, the issue is downstream of localStorage and we have a clear signal. * test(deploy-logs): wait for React re-render after dispatching opt-in event After syncDeployFeedbackState dispatches SENCHO_SETTINGS_CHANGED, React schedules the state update but does not flush it synchronously. The click that follows can fire against the stale closure where isEnabled is still false, so runWithLog takes its early-return path and the modal never opens. A 200ms wait is enough to let React commit the new state before the next interaction. * test(deploy-logs): wait for stack file fetch before clicking deploy deployStack() in EditorLayout returns early at 'if (!selectedFile)' without calling runWithLog. selectedFile is set inside loadFile() after GET /api/stacks/:name resolves. The previous setup clicked the stack in the sidebar and immediately asked the test to click Deploy, racing the fetch. CI backend logs confirmed no deploy POST ever fired for the ON tests, while the OFF test passed only because it asserts non-existence. Now setup awaits both the stack click and the file response together, then verifies the action bar's deploy button is visible before returning. * test(deploy-logs): wait for network idle and capture browser logs Adds a networkidle wait plus a 500ms settle after the stack click so React commits selectedFile and any follow-up env/container/backup fetches drain before the deploy click. Also mirrors browser console errors and pageerrors into the Playwright output so the next failure ships with the React stack trace instead of just a 'modal not visible' message. * test(deploy-logs): temporary debug logging in runWithLog Adds a console.log at the entry of runWithLog so we can see in CI logs whether it is being called and what isEnabled value the closure has. Also widens the test's console capture to include these debug lines. This is diagnostic only and will be removed once the root cause of the modal-not-opening-in-CI failure is identified. * test(deploy-logs): debug log at deployStack entry to trace click path Adds console.log at the first line of deployStack handler so we can confirm in CI whether the click is reaching it at all and what selectedFile/isStackBusy resolve to. Combined with the existing runWithLog debug logs, this isolates whether the modal failure is in deployStack guarding out, runWithLog early-returning, or something else entirely. * test(deploy-logs): drop filter, log every browser console msg The previous filter only emitted error/warning plus the deploy-feedback substring. The deploy-feedback debug logs never appeared, so we don't yet know whether the log itself is firing. Remove the filter so the full console stream shows up in CI. * test(deploy-logs): app-level console log to verify capture pipeline If even an unconditional log at App component render time does not appear in CI browser logs, then the console capture listener is broken or the dispatched logs are being filtered upstream of Playwright. This isolates whether the issue is in the production code or the test harness. * test(deploy-logs): use testid locator for stack action button Replaces the regex-based getByRole locator (/Deploy\|Start/i) with getByTestId('stack-deploy-button'). The regex matched something other than the actual deploy button: backend logs proved no deploy POST ever fired, and instrumentation confirmed neither deployStack nor runWithLog ran on click despite the test claiming success. Adds data-testid='stack-deploy-button' to both the Restart and Start button branches in EditorLayout's action bar so the same locator works whether the stack is running or not. Also drops the temporary debug console.log entries in deployStack, runWithLog, and App, and restores the test's console listener filter to only emit error and warning messages. * test(deploy-logs): park cursor in corner so auto-close countdown fires After clicking the deploy button, the cursor lands inside the centered modal. The modal pauses its 4s auto-close countdown on hover, so the HAPPY test was waiting for a close that never happened. page.mouse.move to (0,0) parks the cursor outside the modal before the success banner appears, letting the countdown complete. * test(deploy-logs): drop redundant loginAs after page.reload page.reload preserves auth cookies, so the page lands back on the dashboard without needing a fresh login. The loginAs call after reload was racing on isLoginPage(): a transient login-page state during page load made loginAs commit to filling #username, then the dashboard committed and #username never came back. Playwright's auto-wait then hung the fill until the test's 120s timeout, which also dragged later stacks.spec tests down with collateral timeouts. waitForStacksLoaded is enough to confirm we're on the dashboard with the sidebar populated before clicking the new stack. * test(e2e): make loginAs race-safe when login page is a false positive isLoginPage() reports the page as a login screen if the Login button locator reports visible at the moment of the check. Under CI load (more real container deploys from the deploy-log-panel suite), the auth context can render the login form for one paint, then redirect to the dashboard. The original code committed to filling #username and hung until the test timeout when the field was no longer there. Now the login branch waits up to 2s for #username to actually appear before filling. If it never appears, we fall through to the dashboard check instead of hanging.	2026-04-26 00:43:54 -04:00
Anso	661b9c638b	feat(security): enforce scan policies as a pre-deploy gate (#719 ) Policies with block_on_deploy=1 now scan every stack image before docker compose up runs and reject the deploy with HTTP 409 on violation. The UI opens a dialog listing offending images; admins can override per deploy with ?ignorePolicy=true, and every bypass is recorded in the audit log with the originating route, actor, policy, and image list. When Trivy is not installed on the target node the gate fails open with a warning notification, so teams are never locked out by tooling state. Post-deploy and scheduled scans still evaluate matching policies and dispatch warnings on violations to surface drift on long-running stacks. Public API additions: policy and suppression CRUD under /api/security, plus the documented 409 block-response shape on all deploy paths.	2026-04-21 00:14:11 -04:00
Anso	856de35a52	feat(search): add global Ctrl+K command palette (#711 ) * feat(search): add global command palette with cross-node stacks Press Ctrl+K from anywhere to open a search palette that jumps to pages, switches nodes, or opens stacks on any online node in the fleet. Trigger lives as an icon in the top bar. Replaces the former sidebar-scoped Ctrl+K handler. The cross-node stack search fan-out is extracted into a shared hook so the sidebar and palette stay in sync on the same debounce + abort shape. * fix(search): drop render-time ref write and effect-based query reset Replace `nodesRef.current = nodes` during render with direct use of `nodes` in the stack select callback, and fold the query-reset logic into a single `onOpenChange` handler so it no longer runs via an effect. Both changes resolve react-hooks rule violations that broke frontend lint in CI.	2026-04-20 13:57:40 -04:00
Anso	370b67d7ec	feat(sidebar): cockpit redesign with grouped stacks and activity footer (#702 ) * chore: ignore .superpowers/ brainstorm scratch dir * feat(sidebar): add useStackMenuItems hook with grouped menu model Pure transform hook that converts StackMenuCtx into four ordered MenuGroup arrays (inspect, organize, lifecycle, destructive). Shared type contract in sidebar-types.ts gives both the ContextMenu and DropdownMenu a single source of truth so they cannot drift. Covered by 8 unit tests. * refactor(sidebar): stabilize useStackMenuItems memoization deps Destructure menuVisibility flags into primitive deps so inline object literals from callers do not defeat memoization. Add a test confirming isBusy disables all lifecycle items. * feat(sidebar): add usePinnedStacks hook with per-node localStorage * refactor(sidebar): stabilize usePinnedStacks eviction signal and isPinned dep Change evictedOldest shape to { file, seq } so consumer effects re-fire on repeated evictions. Narrow isPinned's useCallback dep to the current node's pinned list so it only rebinds on local changes. Add test for eviction side-effect and a second test for the seq counter. * feat(sidebar): add useSidebarGroupCollapse hook with per-node keys * refactor(sidebar): tighten useSidebarGroupCollapse effect ordering Collapse the two write/read effects into a single skip-next-write ref pattern so switching nodes no longer writes the previous node's map under the new key before hydration. Also skip the no-op mount write. Add test for setCollapsed. * feat(sidebar): add row + group-header style helpers * feat(sidebar): add SidebarBrand with mono kicker + serif hero * feat(sidebar): add SidebarActions wrapper for create + scan * feat(sidebar): extract SidebarSearch with kbd pill * feat(sidebar): add StackRow with cyan-rail active state * refactor(sidebar): dedupe tooltip markup in StackRow, widen test coverage Extract a local RowTooltip helper so the update and git-pending branches share the CursorProvider scaffolding. Add four behavioral tests covering click, keyboard activation, kebab stop-propagation, and the busy loader branch. * feat(sidebar): unify context + kebab menus via useStackMenuItems * feat(sidebar): add StackGroup with collapse and pinned variant * feat(sidebar): add StackList with pinned + label groups * feat(sidebar): add SidebarActivityTicker with idle fallback * feat(sidebar): add StackSidebar container composing the regions * feat(sidebar): replace sidebar block with StackSidebar composition * docs(sidebar): add stack sidebar feature page with screenshots * fix(sidebar): satisfy react-hooks purity and memoization rules * fix(sidebar): restore "Sencho Logo" alt text for E2E selector	2026-04-19 21:45:01 -04:00
Anso	5bb4b01953	feat: auto-heal policies for unhealthy containers (#671 ) * feat(db): add auto_heal_policies and auto_heal_history schema and CRUD Adds two new SQLite tables (auto_heal_policies, auto_heal_history) to DatabaseService.initSchema() and exposes CRUD methods: getAutoHealPolicies, getAutoHealPolicy, addAutoHealPolicy, updateAutoHealPolicy, deleteAutoHealPolicy, recordAutoHealHistory, getAutoHealHistory, incrementConsecutiveFailures, resetConsecutiveFailures, setPolicyEnabled. Also adds AutoHealPolicy and AutoHealHistoryEntry TypeScript interfaces. * feat(events): track health-status duration and expose state accessors - Add healthStatus and unhealthySince fields to InternalContainerState - onHealthStatus now records unhealthySince timestamp on first transition to unhealthy, and clears it when the container recovers or restarts - onStart resets both fields so a restarted container begins from 'starting' - Add listContainerStates() and getContainerState() public accessors for use by the upcoming AutoHealService evaluator * fix(auto-heal): key allowlist in updateAutoHealPolicy, cascade delete, extract ContainerHealthSnapshot * feat: add AutoHealService evaluator singleton Polls every 30 s, matches containers to enabled policies via Compose labels, and restarts containers that have been unhealthy beyond the configured threshold. Enforces cooldown, per-hour rate cap, and recent-user-action suppression; auto-disables policies after repeated consecutive failures. Also adds DockerEventManager.getService() accessor required by the evaluator. * fix(auto-heal): prune stale restartTimestamps, guard undefined policy id - Prune restartTimestamps entries for containers no longer running after each container list fetch, preventing unbounded map growth from dead container IDs. - Guard against policies with undefined id at the start of the per-policy loop; warn and skip rather than proceed with a non-null assertion. - Extract handleAutoDisable private helper to bring executeHeal under 30 lines and isolate the auto-disable side-effect sequence. - Move ContainerInfo type to module scope. * feat: add auto-heal API routes and wire AutoHealService lifecycle Registers five REST endpoints under /api/auto-heal/policies (list, create, patch, delete, history) with requirePaid + requireAdmin guards and Zod validation. Wires AutoHealService.start()/stop() into the server startup and graceful-shutdown blocks alongside MonitorService. * test: add AutoHealService and DatabaseService auto-heal unit tests - 15 unit tests for AutoHealService.shouldHeal covering all decision branches (healthy state, duration threshold, user-action suppression, cooldown, rate limiting, and correct skipReason values) - 13 integration tests for DatabaseService auto-heal CRUD: policy round-trip, stack-name filter, partial update, cascade delete, history ordering/limit, consecutive failure counters, and setPolicyEnabled toggle * fix: log AutoHealService shutdown errors consistently * fix(api): requireAdmin-first guard order and try/catch on auto-heal routes * feat(ui): add StackAutoHealSheet component * feat(ui): add Auto-Heal context menu item to EditorLayout * fix(ui): StackAutoHealSheet label, token, a11y, and useEffect fixes - Rename 'All services in stack' to 'All services' in combobox options and placeholder - Replace text-green-600 with text-success design token in actionColorClass - Add htmlFor/id pairs to all four numeric form inputs for accessibility - Inline fetch logic into useEffect, removing stale closure risk and eslint-disable comment - Remove now-unused fetchPolicies and fetchServices standalone functions - Update 'Auto-disable after' label to 'Auto-disable after (failures)' for clarity - Add toast.error in policy fetch failure path; services fetch silently skips as before * docs: add auto-heal-policies feature documentation * test(e2e): add auto-heal policies CRUD spec * fix(docs): correct auto-heal-policies nav position in docs.json	2026-04-17 22:45:06 -04:00
Anso	8e7a567f69	feat: pilot agent outbound-mode for remote nodes (#667 ) * feat: pilot agent outbound-mode for remote nodes Adds a second mode for managing remote nodes: the agent dials an outbound WebSocket tunnel to the primary, so the remote host no longer needs an inbound port, a reachable URL, or its own TLS certificate. Works behind NAT, residential routers, and corporate firewalls. The primary multiplexes HTTP and WebSocket requests over a single tunnel via a hybrid JSON + binary frame protocol, bridged through a per-tunnel loopback server so existing proxy and upgrade handlers route pilot-mode nodes identically to proxy-mode ones. Enrollment uses a single-use 15-minute pilot_enroll JWT exchanged for a long-lived pilot_tunnel credential on first connect. Proxy mode continues to work unchanged and both modes are supported side-by-side. * test(e2e): switch to proxy mode before asserting api_url field Remote nodes default to Pilot Agent mode, which hides the api_url input. The SSRF-validation tests need proxy mode, so the helper now selects Distributed API Proxy after picking Remote type before asserting the field is visible. * fix(e2e): wire Combobox id prop so node-mode selector resolves The Combobox trigger button had no id, leaving its Label orphaned and making getByRole name-based lookups fail. Adding id to the primitive, passing id="node-mode" from NodeManager, and updating the E2E helper to use #node-mode fixes both the a11y regression and the CI timeout.	2026-04-17 20:31:43 -04:00
Anso	732fc95415	feat(security): fleet-replicated CVE suppression list (#650 ) Operators can accept known-benign findings once and have Sencho filter them out of scan drawers, comparison views, and other read surfaces. Suppressions replicate from the control instance to every remote node. * New cve_suppressions table with a COALESCE-based unique index so NULL scope slots collide the way users expect * Admin + paid-tier CRUD routes; writes are rejected on replicas * Read-time filter enriches vulnerability details and compare payloads without mutating stored counts * Settings > Security panel for managing rules, per-CVE suppress action in the scan drawer, dimmed rows with a shield-off indicator * Vitest unit tests for the filter (glob, expiry, specificity) and route tests (auth, tier, replica, UNIQUE conflict)	2026-04-17 05:16:34 -04:00
Anso	708d15b2b3	feat(fleet): replicate scan policies across managed nodes (#649 ) Scan policies now propagate from the control Sencho instance to every registered remote. The control is the source of truth; replicas render rules read-only with a managed-by-control banner. Pushes fire on every policy write, record per-node success and failure on a new fleet_sync_status table, and use node_proxy Bearer tokens exclusively so only sibling Senchos can apply incoming sync payloads. Policy scope now travels as a string identity (api_url or a local sentinel) so node-scoped rules evaluate correctly on each target.	2026-04-16 23:57:08 -04:00
Anso	c9cd6990d2	feat(images): Trivy-powered vulnerability scanning (#635 ) * feat(images): Trivy-powered vulnerability scanning Scan container images for known CVEs via Trivy. On-demand scanning and severity badges are available on every tier; scheduled scans, scan policies, SBOM generation, and scan history are gated to Skipper+. - New TrivyService (binary detection, per-image scan, SBOM, digest cache) - Three new tables: vulnerability_scans, vulnerability_details, scan_policies - 12 routes under /api/security (scan, results, summaries, SBOM, policies, compare) - Post-deploy async scans wired into all five deploy paths, with a per-deploy opt-out toggle in the App Store deploy sheet - "scan" action type added to SchedulerService for fleet-wide recurring scans - Frontend: severity badges in Resources Hub with animated cursor detail, scan results drawer with vulnerability table and filters, and a new Security section in Settings for scan policy CRUD - Policy threshold violations dispatch a warning or critical alert based on the policy's block_on_deploy flag; deploys themselves are never blocked * fix(security): compute scan age in useEffect to satisfy react-hooks/purity	2026-04-16 15:03:36 -04:00
Anso	4c5aa73196	docs: add security architecture overview page (#634 ) Add docs/security.mdx with the full auth stack as the lead section: password auth, SSO (5 providers + generic OIDC), TOTP MFA, JWT sessions, API tokens, RBAC (5 roles), audit logging, AES-256-GCM encryption, rate limiting, and node-to-node authentication. Includes tier availability matrix, permission matrix, production hardening checklist, and vulnerability reporting section. Links to dedicated feature pages for configuration details. Add navigation entry in docs.json Reference group.	2026-04-16 09:01:15 -04:00
Anso	7d78c9fe22	feat(auth): add TOTP two-factor authentication with backup codes (#615 ) * feat(auth): add TOTP two-factor authentication with backup codes Adds RFC 6238 time-based one-time password support to every tier, integrated with the existing password and SSO login paths. Backend: - New MfaService wrapping otplib with a plus or minus 1 step tolerance, base32 secret generation, and hashed single-use backup codes (bcrypt). - user_mfa and mfa_used_tokens tables in DatabaseService. The second table is a DB-backed replay blacklist, purged on a 60s interval. - authMiddleware now recognizes an mfa_pending scope. A token carrying that scope is rejected on every route except the MFA challenge and logout, so no API surface is reachable before the second factor clears. - /api/auth/login issues only a short-lived mfa_pending cookie when the user has MFA enrolled. /api/auth/login/mfa consumes that cookie, verifies the code (or backup code), and swaps in a real session. - /api/auth/mfa/* routes for status, enrol/start, enrol/confirm, disable, backup-code regenerate, and SSO-bypass opt-in. - Admin recovery path: POST /api/users/:id/mfa/reset clears the target's MFA state, bumps token_version, and writes an audit log entry. - CLI emergency fallback: backend/src/cli/resetMfa.ts is wired via `npm run reset-mfa <username>` and also exported for tests. - SSO flows (LDAP and OIDC) gate on user_mfa.sso_enforce_mfa before issuing a session; default behaviour keeps the SSO path frictionless. - Per-user lockout after 5 consecutive failed codes (15 min). Frontend: - AppStatus gains an mfa-challenge branch driven by /api/auth/status. - New MfaChallenge screen, MfaEnrollDialog (QR plus manual secret plus backup codes), MfaDisableDialog, MfaBackupCodesDialog. - Account section shows a Two-factor authentication card with enrol, regenerate, disable, and the SSO-enforce toggle (shown only when SSO providers are configured). - Users section gains a Reset 2FA action for admins. Docs: - New user guide at features/two-factor-authentication.mdx. - New admin guide at operations/two-factor-admin.mdx. - SSO page cross-links to the 2FA doc. * fix(mfa): drop unused TEST_PASSWORD import and stale eslint disable * fix(mfa): simplify e2e openAccountSettings helper to match working pattern * fix(mfa): make e2e suite self-contained and always clean up Test #2 called loginAs() before the MFA challenge step, which waited for the dashboard indicator that never appears once the previous test enrolled the user. That timeout skipped the rest of the serial block, including the disable step, leaving MFA enabled and breaking every later spec. Two fixes: - Tests #2 and #3 now navigate directly to the login page instead of piggybacking on loginAs, which only handles the password-only path. - A new afterAll hook unconditionally disables MFA via the API using two unused backup codes, so the DB is reset even if a test fails midway. * fix(e2e): use backup code for mfa recovery to avoid totp replay race The final recovery step in the backup-code replay test previously generated a fresh TOTP to sign back in. When the timing landed inside the same 30-second window that test #2 consumed, the server's replay blacklist correctly rejected it, producing a ~50% flake rate. Backup codes are single-use and sidestep the replay window, so the recovery becomes deterministic. * fix(e2e): drive mfa disable test through the challenge screen Test #4 called loginAs after test #3 left MFA enabled, but loginAs waits for the dashboard indicator and does not handle the challenge screen, so it timed out. Drive the login manually, satisfy the challenge with a backup code, and use a backup code for the disable step too to avoid any TOTP replay-window race against earlier tests in the serial block.	2026-04-15 18:45:51 -04:00
Anso	377df7e546	feat(git-sources): link stacks to Git repositories with diff-and-apply workflow (#600 ) * feat(git-sources): link stacks to Git repositories with diff-and-apply workflow Add Git Sources so any stack can point at an HTTPS Git repository, branch, and compose file path. Pulls fetch + validate the incoming commit, store a diffable pending snapshot, and apply writes only after explicit confirmation (or automatically, per the configured apply mode). Sibling .env sync is optional. Works on the Community tier. Apply modes: - Review only: mark pending, wait for manual apply in the diff dialog - Auto-write: write compose + env to disk, do not redeploy - Auto-deploy: write files and run docker compose up -d Webhook integration: webhooks can target the new "git-pull" action to trigger a sync from CI. Per-source debounce prevents runaway pipelines from hammering the repository host. Tokens are encrypted at rest and never returned to the frontend. Docs and tests included. Screenshots and Playwright E2E flows to follow. * fix(git-sources): drop unnecessary useMemo on commit sha slice React Compiler's lint rule rejected the manual dependency list because the inferred dep ('pull') was less specific than the written one ('pull?.commitSha'). The computation is a cheap 7-char slice, so drop the useMemo entirely rather than fight the rule. * test(git-sources): add Playwright E2E flows and drop orphan source rows on stack delete - E2E coverage: non-HTTPS URL rejected client-side, unreachable repo surfaces a toast error on save, and configure+remove walks the AlertDialog confirm path. - Deleting a stack now also drops its linked Git source row so a future stack with the same name starts clean rather than inheriting a stale config.	2026-04-14 21:13:17 -04:00
Anso	2a2efb847e	feat(release): sign and attest published docker images (#480 ) Every published Sencho Docker image is now signed with Sigstore cosign using GitHub Actions keyless OIDC, and ships with an embedded SBOM plus SLSA provenance attestation attached as OCI referrers on the image. Users can verify the signature and inspect the attestations themselves before pulling an image into production. cosign verify saelix/sencho:<tag> \ --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com The release pipeline now also publishes a new moving minor tag (saelix/sencho:X.Y, e.g. 0.42) alongside the existing latest and immutable X.Y.Z tags, so operators who want the latest patch on a given minor line can pin without chasing every release. Since every 0.x minor is potentially breaking, the {{major}}-only tag is deferred until 1.0. cosign is installed via the sigstore/cosign-installer action pinned to a full commit SHA. The signing step batches every tag produced by metadata-action into a single cosign invocation pinned to the built digest, so all tags resolve to the same manifest and we save N-1 Rekor/Fulcio round trips. The job declares id-token: write so the ambient OIDC token can be minted. A new docs page (docs/reference/verifying-images.mdx) walks users through installing cosign, verifying an image, and inspecting the SBOM and provenance with docker buildx imagetools. A note calls out that signatures start shipping with v0.43.0, so older images failing verification is expected behavior and not tampering.	2026-04-10 13:46:27 -04:00
Anso	8e0857e7f6	feat(contact): add official contact emails throughout app and docs (#428 ) Surface six dedicated email channels (support, contact, licensing, security, privacy, conduct) across contextually appropriate locations: - security.txt: create .well-known/security.txt for app (RFC 9116) - SECURITY.md: add security@sencho.io as alternative to GitHub reporting - PaidGate/AdmiralGate: add licensing@sencho.io to upgrade prompts - docs: new Contact & Support reference page listing all channels - CHANGELOG: document additions under [Unreleased] Website changes (separate repo): privacy@sencho.io in Privacy/Terms pages, licensing@sencho.io in Refund page and pricing footer, contact@sencho.io in website footer.	2026-04-08 09:52:42 -04:00
Anso	a1804c8fbe	docs: comprehensive review and refresh of all documentation (#374 ) * docs: comprehensive review and refresh of all documentation pages Reviewed every doc page against the current app state after the v0.38 dashboard redesign. Updated content, fixed inaccuracies, and refreshed all screenshots at 1920x1080. Pages updated: - introduction: expanded feature list to 25 items across 6 subsections - quickstart: fixed docker run command (Docker Hub, auto JWT, COMPOSE_DIR) - configuration: replaced personal paths with generic /home/user/docker - sso-quickstart: fixed Settings navigation reference - sso: added SSO_LDAP_DISPLAY_NAME env var - overview: added 8 missing feature sections (labels, API tokens, schedules, etc.) - dashboard: complete rewrite for new health bar, gauges, stack health table - stack-management: updated for UP/DN indicators, rollback button, split actions - editor: rewritten for two-column layout, inline stats, embedded terminal - resources: updated Quick Clean docs, added network topology and inspect - app-store: updated categories, deploy sheet details, permission gate, settings - openapi.yaml: fixed YAML parsing error on line 1831 Screenshots refreshed: 14 images across 6 feature areas. * docs: review and update observability, console, multi-node, and compatibility pages - Global Observability: fix log format fields, add download button docs, split display limits into memory buffer vs rendered rows, correct settings labels - Host Console: remove internal implementation details per security docs policy, add stack directory behavior, expand header bar docs, remove unverified scrollback claim - Multi-Node: add Compose Directory field, document connection test details panel, fix edit/delete node behavior, simplify token security section, remove internal details - Node Compatibility: add missing self-update capability, remove internal endpoint paths and cache TTL, move from Features to Reference group in navigation - Refresh all screenshots for the redesigned UI (7 images) * docs: review and refresh fleet, remote updates, labels, alerts, routing, and webhooks pages - Fleet View: added node updates modal, container detail, version/update/critical badges, Tags filter - Remote Updates: removed internal details, added capability cross-link, fast polling - Stack Labels: three creation methods, two assignment methods, 10 colors, bulk actions screenshot - Alerts & Notifications: fixed metric labels, added notification popover detail, status banner - Notification Routing: HTTPS requirement, rule card layout, channel terminology fix - Webhooks: corrected license tier to Admiral, matched action labels to UI, removed internal security details, added local-only note - Troubleshooting: centralized entries from remote-updates, stack-labels, notification-routing - Refreshed all screenshots at 1920x1080, removed 11 orphaned images * docs: review and refresh RBAC, user management, and atomic deployments pages - RBAC: added missing Auditor role (5th role), updated permission matrix, fixed license tier references, documented username/password validation rules, self-deletion protection - Atomic Deployments: added "Which operations are protected" section covering webhooks/schedules/app store, removed internal backup path, fixed license tier to Skipper/Admiral - Screenshots: cropped to dialog element per updated strategic cropping guideline, removed 2 orphaned images * docs: review and refresh fleet-wide backups and audit log pages Update fleet-backups page to reflect current inline create form, add scheduled snapshots section, document the detail view and restore dialog, expand RBAC table to all five roles. Update audit log page to document expanded row detail fields, pagination, refresh button, and data retention screenshot. Replace all screenshots with fresh captures at 1920x720. * docs: review and refresh API tokens and private registries pages - API Tokens: clarify Full Admin scope, add Managing tokens section with card details, document revocation confirmation dialog, add usage tracking to security model, refresh screenshot - Private Registries: add Managing registries section with card details and action buttons, document edit behavior, fix URL auto-fill description, remove encryption algorithm name per security policy, fix grammar, refresh both screenshots * docs: review and refresh auto-update policies, scheduled operations, and SSO pages - Auto-Update Policies: document all 8 table columns, expand action buttons, add "All Stacks" wildcard option, fix field labels, add CSV export and pagination details, refresh screenshots - Scheduled Operations: fix System Prune target description, add Task List table columns, restructure create dialog fields with action-specific annotations, rewrite execution history with column table, refresh screenshots - SSO: remove encryption algorithm name per security policy, add LDAP and OIDC configuration field tables, document provider card controls (Save, Test Connection, Remove, Active badge), refresh screenshots - Move SSO troubleshooting entries to centralized troubleshooting page * docs: review and refresh licensing & billing page Update upgrade card feature lists to match actual tier gating (Skipper: fleet view, webhooks, labels, atomic deployments, backups, auto-update policies; Admiral: scoped RBAC, SSO, audit log, host console, API tokens, private registries, scheduled operations). Add flex layout to align upgrade card buttons at the bottom. Replace stale screenshot with fresh community and active license captures. Add feature breakdown subsection and profile menu billing shortcut to docs. * docs: review and refresh settings reference and security advisories pages Settings Reference: add 5 missing sections (SSO, API Tokens, Registries, Labels, Routing), expand Users from 2 to 5 roles, fix System Limits and Developer field labels to match UI, restructure Developer into Streaming and Data Retention sub-tables, update App Store and Support sections, refresh overview screenshot. Security Advisories: restructure into versioned sections (v0.25.x hardening and v0.19-v0.24 CVE remediation), expand from 3 bullet points to 10 specific improvements, fix GitHub URL from SaelixCode to AnsoCode, redact internal details per security docs policy. Remove "Sencho Pro" product name from all three pages, replaced with tier names (Community, Skipper, Admiral). * docs: review and refresh troubleshooting page, remove architecture and development guides - Rewrote forgotten password section to remove exposed SQL and table names - Updated all Settings navigation paths to Profile > Settings > X - Fixed network topology from "tab" to "view mode", added Pro license note - Updated Prune Networks to current "Prune Dead Networks" label - Corrected update check cooldown from vague to 2 minutes - Consolidated two network creation error sections into one - Removed hardcoded version reference (v0.34.0) - Replaced em dashes throughout - Deleted architecture.mdx (exposes internal implementation details) - Deleted development.mdx (contributor guide belongs in repo, not public docs) - Removed both pages from docs.json navigation * docs: review and refresh operations pages (backup, upgrade, self-hosting, troubleshooting) Backup & Restore: - Added missing encryption.key to all backup/restore procedures - Added Warning about restoring db without matching encryption key - Added cross-reference to Fleet-Wide Backups for paid tiers - Removed false claim about no built-in backup scheduler - Updated cron example to include encryption key copy Upgrading Sencho: - Removed internal migration details (table names, column specs, encryption algorithm) - Replaced with high-level migration summary per security docs policy - Added encryption.key to pre-upgrade backup command - Updated version pinning example from 0.25.3 to 0.38.0 - Added Remote Updates cross-reference for Skipper/Admiral users Self-Hosting Best Practices: - Removed JWT_SECRET from env var table (auto-generated, not an env var) - Removed PORT from env var table (hardcoded to 3000, not configurable) - Added API_RATE_LIMIT to env var table (actually exists in code) - Fixed listen port description from "configurable" to "fixed" - Updated resource recommendations based on measured footprint audit - Removed su-exec reference (internal implementation detail) - Upgraded data directory Note to Warning with file names Troubleshooting: - Fixed "Pro features" heading to "Paid features" with correct tier names	2026-04-04 21:32:51 -04:00
Anso	87b5908288	feat(fleet): add remote node update management (#353 ) Add the ability to check for outdated nodes and trigger over-the-air updates from Fleet View. Nodes self-update by pulling the latest Docker image and recreating their container via the "last breath" pattern. Backend: - SelfUpdateService: self-container identification via HOSTNAME + Docker Compose labels, triggers pull + force-recreate - CapabilityRegistry: runtime capability disabling via disableCapability() - POST /api/system/update (202 + deferred self-update) - GET /api/fleet/update-status (version comparison across fleet) - POST /api/fleet/nodes/:nodeId/update (single node) - POST /api/fleet/update-all (bulk remote update) - In-memory update tracker with 5-min timeout Frontend: - Node Updates modal with summary stats, search filter, table layout, per-node Update buttons, and bulk Update All - Version badges and update-available indicators on node cards - ReconnectingOverlay for local node updates (polls /api/health) - 5s fast-poll when any node is actively updating - UpdateStatusBadge shared component for consistent badge rendering Requires Skipper (Pro) tier. Nodes must be deployed via Docker Compose with Docker socket access.	2026-04-03 01:39:22 -04:00
Anso	ee75811e25	feat(nodes): add capability-based node compatibility negotiation (#350 ) * feat(nodes): add capability-based node compatibility negotiation Each Sencho instance now exposes /api/meta with its version and supported capabilities. When the user switches nodes, the frontend fetches this metadata and disables features the remote node doesn't support via a CapabilityGate overlay. Version is shown in the node switcher dropdown and connection test results. - Backend: CapabilityRegistry with static capability list and fetchRemoteMeta helper - Backend: /api/meta (public) and /api/nodes/:id/meta (auth) endpoints - Frontend: NodeContext enhanced with per-node meta caching (5min TTL) - Frontend: CapabilityGate component with typed Capability union - Frontend: 13 features wrapped with capability gates - Docs: node-compatibility.mdx + OpenAPI spec updates * fix(nodes): revert to require() for package.json version reading The static import fails in the Docker multi-stage build because the root package.json is not copied into the backend-builder stage. The require() call resolves at runtime when the file is available.	2026-04-03 00:06:34 -04:00
Anso	1b573f542a	feat(notifications): add shared notification routing rules (Admiral tier) (#347 ) Route stack alerts to specific Discord, Slack, or webhook channels instead of the single global endpoint. Includes per-rule enable/disable, priority ordering, and automatic fallback to global agents when no rule matches. - Add notification_routes table, interface, and CRUD in DatabaseService - Add routing logic in NotificationService.dispatchAlert with optional stackName - Pass stack context from MonitorService (crash/health) and SchedulerService - Add 5 API endpoints gated with requireAdmin + requireAdmiral - Add NotificationRoutingSection UI with Combobox stack picker, channel tabs - Parallel webhook dispatch via Promise.allSettled - 10 unit tests covering routing, fallback, and edge cases - Documentation with screenshots at docs/features/notification-routing.mdx	2026-04-02 22:22:27 -04:00
Anso	28e7be652c	feat(labels): add stack labels for organizing, filtering, and bulk actions (#341 ) * feat(labels): add stack_labels schema and DatabaseService CRUD methods * feat(labels): add label CRUD, assignment, and bulk action API routes * feat(labels): add oklch label color palette for light and dark themes * feat(labels): add LabelPill and LabelDot reusable components * feat(labels): add LabelAssignPopover component for inline label management * feat(labels): add label pill bar, label dots, and label assignment to sidebar * feat(labels): add label filtering and label dots to fleet view * feat(labels): add label-scoped bulk actions (deploy/stop/restart all) * docs: add Stack Labels feature documentation * fix(labels): use context menu sub-menu for label assignment and add settings integration Replace broken Popover-inside-ContextMenu pattern with native Radix ContextMenuSub for reliable label toggling on right-click. Wrap ContextMenuSubContent in a Portal to prevent overflow clipping. Add "Manage labels..." item that opens Settings directly to Labels section. Fix close button overlap in LabelsSection header. Add LabelsSection settings component with full CRUD, assignment counts, and ProGate. Add initialSection prop to SettingsModal for deep-linking. Include screenshots for documentation. * docs: update stack labels documentation with screenshots and corrected instructions * fix(labels): address security and quality issues from code review - Add NaN validation on parseInt(req.params.id) in label routes - Scope updateLabel/deleteLabel by nodeId to prevent cross-node IDOR - Validate labelIds belong to correct node in setStackLabels - Add requireAdmin check on bulk action endpoint - Replace error: any with error: unknown and proper narrowing - Remove unused Label import from index.ts - Remove unused isPro prop from LabelsSection - Add strokeWidth={1.5} to Check icons per design system * chore: update CHANGELOG with stack labels feature	2026-04-02 19:25:43 -04:00
Anso	7d9dcc77d4	docs: remediate documentation gaps across quickstart, backup, config, API spec, and operations guides (#330 ) - Fix Cyrillic character in quickstart image ref and correct registry to Docker Hub (saelix/sencho) - Correct backup guide WAL references (Sencho uses SQLite default journal mode) - Add SSL/TLS reverse proxy examples for Nginx, Traefik, and new Caddy configuration - Add missing env vars (PORT, DATA_DIR, NODE_ENV, FRONTEND_URL, SSO_LDAP_DISPLAY_NAME) to .env.example - Add upgrade & migration guide documenting automatic schema migrations - Add self-hosting best practices (1:1 path rule, Docker socket security, resource recs) - Add architecture overview (system design, request flow, database schema, multi-node model) - Add development & contributor guide (setup, tests, code style, PR workflow) - Update OpenAPI spec from v0.23.0 to v0.25.3 with Registries and Image Updates endpoints - Update docs.json navigation with all new pages and API groups	2026-04-01 23:17:32 -04:00
Anso	28c7a8fd54	feat(auto-update): add auto-update policies and fix image update detection (#297 ) * feat(auto-update): add auto-update policies and fix image update detection Auto-Update Policies (Skipper+ tier): - New scheduled task action type 'update' for check-then-update flow - Dedicated AutoUpdatePoliciesView with CRUD, cron presets, and run history - Conditional tier gating: Skipper gets auto-update, Admiral gets full scheduled ops - Backend executeUpdate: checks digests, pulls only if newer, atomic redeploy Image Update Detection fixes (all tiers): - Fix stack name key mismatch: use working_dir label instead of project label - Add 5-minute periodic frontend polling for background check results - Replace fixed 3s timeout with polling-based manual refresh via /api/image-updates/status - Clear update status after successful stack update * fix(ui): remove Skipper tier badge from Auto-Update Policies header * fix(ui): remove auto-update action from Scheduled Operations view Admiral users have a dedicated Auto-Update view — showing update tasks in Scheduled Operations too was confusing duplication. Each view now owns a distinct, non-overlapping set of action types. * fix(auto-update): fix node-stack linking and add All Stacks option - Stack dropdown now re-fetches when node selection changes using fetchForNode, and resets the selected stack - Node selector moved above stack selector with stack disabled until a node is picked - Added "All Stacks" wildcard option that checks and updates every stack on the selected node - Backend executeUpdate refactored to iterate over all stacks when target_id is "", with per-stack error isolation refactor(ui): replace Select dropdowns with searchable Combobox component Add a reusable Combobox component with inline search and use it for Node/Stack selectors in both Auto-Update Policies and Scheduled Operations dialogs. Also fixes node-stack linking bug where changing node didn't update the stack list. * fix(ui): resolve CI TypeScript errors in Combobox and ScheduledOperationsView Add missing searchPlaceholder prop to ComboboxProps interface and remove dead 'update' action filter that conflicted with the narrowed type union. * fix(ui): use Geist Sans font in toast component The toast renders via React portal on document.body, bypassing the app's font inheritance. Add explicit font-family declaration using var(--font-sans) to match Sencho's design system.	2026-04-01 00:22:47 -04:00
Anso	8d988d6b08	docs: disable API playground for self-hosted compatibility (#295 ) Sencho is self-hosted so the Mintlify "Try it" playground can never reach a user's instance (CORS + localhost). Switch to "simple" mode which keeps the endpoint URL/method as a copyable reference without the misleading Send button.	2026-03-31 18:57:38 -04:00
Anso	eae83c997b	docs: add OpenAPI 3.1 spec and API Reference tab (#294 ) Add a complete OpenAPI 3.1 specification covering ~55 public API endpoints across 8 categories (Stacks, Containers, API Tokens, Webhooks, Nodes, Fleet, Scheduled Tasks, Health). Wire it into Mintlify via native OpenAPI rendering with an interactive "Try It" playground and a dedicated API Reference tab. Includes an API overview page documenting authentication, token scopes, node routing, error format, license tier requirements, and WebSocket endpoints.	2026-03-31 16:13:07 -04:00
Anso	36ebd5a9c1	fix(docker): upgrade Compose v2.40.3 → v5.1.1 to remediate dependency CVEs (#283 ) Compose v2.40.3 was compiled with Go 1.24.9, grpc 1.74.2, and x/crypto 0.38.0 — all below the minimum safe versions identified in the March 2026 security audit. Upgrading to v5.1.1 (Go 1.25.8, x/crypto 0.46.0) resolves CVE-2025-68121, CVE-2025-61726, CVE-2025-61729, CVE-2026-25679, and CVE-2025-47913. CVE-2026-33186 (grpc ≥1.79.3) remains unresolved — no upstream Docker CLI or Compose release includes grpc past 1.78.0 yet. CVE-2026-33671 (picomatch) and CVE-2026-33747/33748 (buildkit) were already patched in prior releases.	2026-03-30 17:46:44 -04:00

1 2

63 Commits