267 Commits

Author	SHA1	Message	Date
Anso	be22e3ded1	docs(api-tokens): deep rewrite for v1, expand to fleet automation guide (#1140) ... Rewrite docs/features/api-tokens.mdx (115 → 442 lines) as a full product + technical guide: mental model, scope ladder, prerequisites, step-by-step usage with HTTP/WS/multi-node examples, complete universal- restriction table, cross-node proxy behaviour, lifecycle, rate-limit ceiling, security model, limitations, three example workflows, troubleshooting accordion, FAQ accordion. Replace the single populated-list screenshot with five captured against production: empty state, create form, reveal banner (token value redacted), populated list with all three scope variants, revoke modal. Sibling-doc edits keep tier statements coherent now that API tokens are available on every tier: - docs/api-reference/overview.mdx: drop the Admiral-only Note callout, drop API Tokens from the Admiral-gated license-tier table, correct the rate-limit table to say tokens are keyed per-credential - docs/features/overview.mdx: drop the "Admiral only." sentence - docs/security.mdx: drop "Admiral tier.", move API tokens row to every tier in the security matrix, repoint image to the new populated shot	2026-05-21 21:20:59 -04:00
Anso	08caa914ce	docs: v1 docs refresh (batch 2) (#988) ... * docs(atomic-deployments): refresh page around current UI and behavior Rewrites the page to match the v1 docs refresh template. Corrects several factual errors against the current code, fills in missing detail, and adds a screenshot of the rollback overflow menu. Notable corrections: - Scheduled tasks do not run atomically; only stack editor Deploy and Update, App Store installs, webhook triggers, and image auto-updates pass the atomic flag through to ComposeService. - Rollback lives in the stack editor's More actions overflow menu, not on the action bar directly. The backup timestamp renders as a sub-line of the menu item. - Health probe is a 3-second window with an exit-code check on every container labelled with the compose project name; describe this exactly rather than as 'waits briefly'. - Document where backups live (DATA_DIR/backups/<stack>/), why they are kept outside the compose folder, and that the slot is one per stack with overwrite semantics. - Document the four streamed log markers users see in the deploy progress modal during the atomic flow. - Add a troubleshooting accordion group covering missing menu entry, late crashes outside the probe window, manual-intervention message, and the single-slot retention edge case. * docs(deploy-enforcement): refresh page for v1 and align with current enforcement paths Update the page to match the current pre-flight gate behavior, the v1 modal chrome on the block dialog, and the AccordionGroup troubleshooting pattern used across the v1 docs. Drift items corrected: - Replace the broken vulnerability-scanning/deploy-blocked-dialog.png reference with three fresh captures under docs/images/deploy-enforcement/ (policy list, policy editor, block dialog). - Drop "Recreate from the stack actions menu" and the git-source apply pre-flight claim; neither path runs the gate. - Add bulk label deploy and the auto-update scheduler to the enforced code paths, with a dedicated subsection for the auto-update interaction (alert-and-skip, not 409). - Drop the false claim that severity chips in the block dialog are clickable; the dialog is informational. - Document the compose-parse-fails-closed branch with its synthetic violation label. - Refresh dialog copy to reflect the v1 ModalDestructiveHeader (kicker, title, button variants). - Convert the troubleshooting Q&A into AccordionGroup blocks and add accordions for the compose-parse-error case and the auto-update-skipped case. - Quote the verbatim audit-log summary format. * docs(blueprints): refresh against v1 UI and add federation/state-review coverage * docs(git-sources): refresh page against v1 UI and current behavior Rewrites the page against the v1 docs refresh template (Note tier-gate, sectioned anatomy, AccordionGroup troubleshooting), aligning prose with the live UI labels and the current code paths. Corrections: - Authentication toggle reads "Public (no auth)" / "Personal Access Token" (not "None"), and apply mode "Auto-write files" (not "Auto-write"). - Diff dialog kicker is GIT . PULL PREVIEW; local-edits state opens an Overwrite local edits? confirmation modal whose primary button is Overwrite and apply. - Sidebar pending indicator is a small GitBranch icon, not a brand-color dot, and the image-update dot takes priority over it on the same row. - Pending update banner appears in the panel; Review re-fetches the commit and opens the diff (no client-side payload caching). Adds coverage for: - Anatomy of the panel (pending banner, form, last-applied stat strip, footer actions). - 10-second webhook debounce window. - Pending compose/env content is encrypted at rest in the database, not just the token. - Auth/host failures map to HTTP 400, never 401, so they do not sign the user out. - Per-stack lock serializes pull, apply, and create-from-git so a webhook firing during a manual apply waits rather than racing. - Compose validation has a 10-second budget; clone fetches have a 30-second timeout. - New troubleshooting accordion for Pending commit has changed since this pull was fetched. Recaptures all five screenshots from the v0.74.x production node, signed in as admin: panel, create-from-git tab, pull-preview diff dialog, sidebar GitBranch pending icon, webhook Action select with Git source sync highlighted. * docs(stack-labels): refresh page for v1 sidebar grouping and fleet-action surface - Lead with the v1 behavior the previous page did not cover: the sidebar groups stacks under collapsible label headers (PINNED first, label buckets sorted by stack count desc then name asc, UNLABELED last) with a count chip per group. Trailing colored dots on each row (max 3 + N overflow, paid-only) supplement the headers. - Drop the stale claim that a label-pill filter bar lives between search and the stack list; that UI no longer exists. - Drop the right-click-on-pill bulk actions table (Deploy all / Stop all / Restart all). The legacy per-node action endpoint stays in the backend but no longer has a UI binding, so the page documents only what users can click today. - Document the two Skipper+ Fleet Action cards: Stop fleet by label (name match across nodes, autocomplete, per-node breakdown, HTTP 429 on per-node concurrency) and Bulk label assign (per-node, replace semantics, clear on empty selection). - Document the inline 'New label' form inside the stack right-click / three-dot Labels submenu, the Settings - Advanced - Labels masthead N/50 stat, the LABELS - NEW / EDIT modal kickers, and the LABELS - DELETE - IRREVERSIBLE confirmation copy verbatim. - Document the Fleet Overview Tags multi-select filter (filters by stack labels aggregated across nodes), with cross-link to fleet-view. - Capture every screenshot fresh from production signed in as admin: sidebar-grouping, context-menu-labels, inline-create-form, settings-labels, create-label-dialog, fleet-tags-filter, fleet-actions. Drop the now-stale sidebar-with-labels, sidebar-filtered, and bulk-actions-menu captures. * docs(dashboard): refresh page for v1 layout (status masthead, gauges, fleet heartbeat, restart map) Aligns docs/features/dashboard.mdx with the redesigned Home tab. Replaces the obsolete Recent Activity feed coverage with the actual DashboardActivityCard split (Fleet Heartbeat when remote nodes are registered, Stack Restarts (7d) otherwise) and recaptures every screenshot from the v0.74.x production node. * docs(global-search): refresh page for v1 palette - Note tier and role gating on the Pages list (Auto-Update, Console, Schedules, Audit) so the prose matches what the top bar exposes. - Document the ACTIVE chip on the currently active node row. - Document the 50-result cap counter and the Searching... loading state. - Mention the ~250 ms debounce and clarify that filename matching includes the file extension. - Replace stack screenshot with a redesigned capture and add empty-state Pages and Nodes captures showing the ACTIVE chip. * docs(global-observability): refresh page for v1 layout (masthead, signal rail, filter strip, paused-resume chip) Full rewrite against the current Logs tab and the v1 docs refresh template (hero Frame, sectioned anatomy, AccordionGroup troubleshooting, refresh-cadence table). Replaces the single overview screenshot with seven captures under docs/images/global-observability/ (overview, masthead, signal-rail, filter-strip, feed-bands, paused-resume-chip, error-only-filter), all from the v0.75.x production node signed in as admin with PII scrubbed (profile chip patched to AD, in-feed LAN IPs and third-party hostnames substituted via DOM injection while the stream was paused). Aligns prose with the actual UI labels and code: - Masthead kicker reads LIVE LOGS · NODE · <NAME> with LOCAL for the local node; state word toggles Streaming / Idle / Offline; SESSION uses uppercase letter suffixes (1H 43M / 0M 12S) per formatUptime. - Signal rail tile counts are scoped to the 2000-entry buffer and reset with Clear; CONTAINERS is buffer-bound, not a monotonic accumulator. - Filter strip controls quoted verbatim (Stacks · All / Stacks · n, segmented controls All / Out / Err and All / Info / Warn / Error). - Feed row anatomy: severity dot, timestamp, brand-cyan container name with stack/container tooltip, message tinted by source. Row tint follows detected level, which is regex-based, so an STDOUT line containing ERROR: still classifies as ERROR. - Day bands: NOW, Nm AGO, Nh AGO, calendar date. - Empty states: two-tier kicker over caption (Awaiting events / No matches). - Pause keeps the SSE buffer filling up to the 2000-entry cap; resume pill reads <n> NEW · RESUME and counts the queue, not total arrivals during the pause. - Download filename and row format quoted: sencho-logs-<ISO8601>.txt and [<ISO>] [<stack>/<container>] <LEVEL>: <message>. Documents behavior the previous page never covered: - Active-node scoping; node switch resets the stream and the buffer. - SSE primary transport with 30-second server heartbeat and a 5-second polling fallback against /api/logs/global (server-capped at 500 lines per snapshot). - Initial replay of the last 500 lines per container when the SSE connection opens, so the feed has context immediately. - Display limits (2000 client buffer, 300 rendered rows, Showing last 300 of N overflow notice). - Refresh cadence table covering UI tick, flush cadence, polling cadence, SSE heartbeat, sparkline window, and the Idle threshold. Adds a seven-accordion troubleshooting block (Offline state, gray Idle dot, ERROR-without-tint, growing Resume pill, Clear-cutoff lag, node-switch buffer drop, fleet-wide aggregation expectations). Tightens the closing Note so it makes clear that Notification Log Retention does not govern this live container stream. * docs(alerts-notifications): refresh page for v1 and absorb notification-routing Full v1 template rewrite of /features/alerts-notifications. Bundles in the entire Notification Routing page so a reader sees channels, routing, per-stack rules, and retention in one place; deletes the standalone notification-routing.mdx and points all five cross-link sites at the new in-page anchor. * docs(alerts-notifications): drop "What's not in scope" section The page should describe what Sencho does, not enumerate what it does not ship. Users find missing integrations through the Webhook section and the routing matcher reference; the explicit disclaimer added noise without adding guidance. * docs(audit-log): refresh page for v1 layout, expanded action list, troubleshooting accordion - Clarify that the search/method/date filter strip lives in Table view only. Stream view always shows the unfiltered chronological feed. - Fold the total-entries readout into the card subtitle wording where it actually renders, instead of describing it as a separate header element. - Sharpen the Peak hour off-hours window to the literal 08:00 to 17:59 working window the tile keys off, plus the 5% / 20% failure-rate tints. - Note that the Actors tile names a sample actor alongside the new-IP count. - Expand the example actions list to cover surfaces that have shipped since the last edit: per-service stack lifecycle, node cordon/uncordon, fleet replica role changes, Sencho Cloud Backup operations, Fleet Secrets, and blueprint federation pin updates. - Correct the Settings path: Settings · Developer · Data retention card, Audit log input, Save settings button. - Add a Troubleshooting AccordionGroup matching the rest of the v1-refresh pages: missing tab, filter scope, anomaly thresholds, export cap, and retention pruning. - Replace all four screenshots with fresh captures of the current UI. * docs(multi-node): refresh page for v1 layout, pilot agent mode, refreshed table columns Rewrites docs/features/multi-node.mdx against the current product. The previous page predated the v1 Settings hub redesign and the Pilot Agent enrollment model, so it documented only the Distributed API Proxy add-node flow and missed the new Mode, Endpoint, and Labels columns on the Nodes table. Restructures the page into 13 sections: intro, How it works, the local node, Choose a remote mode (decision table comparing Pilot Agent vs Distributed API Proxy), Add a remote node: Pilot Agent (three steps plus re-enrollment), Add a remote node: Distributed API Proxy (three steps), Switching between nodes, the Nodes table (full column reference), What Settings apply per node (verified against settings/registry.ts), License enforcement across nodes, Editing and deleting nodes, Security (token security, transport encryption, why no application-layer TLS), and Troubleshooting (AccordionGroup matching the v1 template used on audit-log, atomic-deployments, and deploy-progress pages). Refreshes seven screenshots against the production node signed in as admin, scrubbing IPs and usernames before capture: full Nodes panel overview, Generate Node Token card with a placeholder token, Add node modal in Pilot Agent mode, Add node modal in Distributed API Proxy mode (with the inline plain-HTTP warning visible), Edit modal showing the Regenerate enrollment token card for a pilot agent, Pilot enrollment modal with the docker run command, refreshed node switcher popover, and a close-up of the table columns. Drops the obsolete add-node-form.png, http-warning.png, and per-node-scheduling/ folder. * docs(fleet-view): refresh page for v1 layout, expanded tabs, cordon, sheet-based updates - Aligns the Overview, Status, and Node Updates content with today's UI: the masthead's `The fleet` headline plus CPU / MEM / CONTAINERS stat tiles, the eight-tab strip (Overview, Snapshots, Status, Deployments, Traffic, Federation, Fleet Actions, Secrets) with per-tier visibility, and the Check Updates surface that is now a system sheet rather than a modal. - Documents the toolbar (search, sort, filter popover with Status / Type / Severity / Tags sections) and the Grid / Topology segmented control including the topology graph's status pill (Online / Critical / Offline), connector colouring, ReactFlow controls and minimap. - Documents the per-card surfaces that were missing from the prior page: Cordoned badge with cross-reference to Fleet Federation, fleet stack label dots in the drill-down, container drill-down rows (state dot, badge, image, status, open-in-editor hover button), and the Admiral three-dot Node actions menu for cordon / uncordon. - Documents the Node Updates sheet anatomy (Recheck and Update all (n) header actions, four summary cards, node table columns, Update flow, reconnecting overlay timing, admin enforcement) and the GitHub Releases with Docker Hub fallback resolution path with its 30-minute cache. - Replaces every stale screenshot with a fresh capture (overview, topology, drill-down, status tab, node updates sheet) and removes the obsolete files plus the empty docs/images/fleet/ folder. - Reformats troubleshooting as an AccordionGroup matching dashboard, multi-node, and audit-log refreshes. * docs(fleet-backups): refresh page for redesigned fleet and settings UI Replace all six screenshots with current production captures. Update content to reflect the new fleet header card, eight-tab layout, full- page Cloud Backup settings with header stats, and corrected navigation paths. Add cloud backup rows to the access control table. * docs(fleet-backups): convert troubleshooting to AccordionGroup pattern Match the foldable-accordion pattern used across the v1 docs refresh batch. Merges the standalone Cloud Backup troubleshooting subsection into a single Troubleshooting section at the bottom of the page with seven accordions covering skipped nodes, two restore failure modes, three cloud-upload failure modes, and a diagnostic logging entry. * docs(remote-updates): refresh page for v1 sheet, accordion troubleshooting, factual fixes Rewrites the page against the v1 docs refresh template (Note tier gate, sectioned mechanism deep-dive, Frame screenshots with detailed alt text, inline AccordionGroup troubleshooting), bringing it in line with the recently-refreshed fleet-view, fleet-backups, dashboard, and audit-log pages. The page is repositioned as the mechanism deep-dive (prerequisites, what runs on a node during an update, completion and failure detection, recovery actions). The full UI tour for the Node updates sheet remains in fleet-view so the two pages stop overlapping; remote-updates now links into fleet-view#node-updates instead of restating the table anatomy. Captures three screenshots from the production node, signed in as admin: fleet-node-updates.png shows the Node updates sheet with eight nodes and seven remote updates available; local-update-confirm.png shows the LOCAL · UPDATE alert dialog with the Cancel and Update & restart buttons; node-card-update-available.png shows the Opsix card with the Update available pill and the Update to v0.76.7 outline button. Corrects several factual claims that no longer matched the current code: - The remote early-fail threshold is about 3 minutes, matching EARLY_FAIL_MS in backend/src/routes/fleet.ts, not 90 seconds. - The Recheck button sits in the sheet header, not the footer. - The component is a SystemSheet, so the page now consistently calls it the Node updates sheet instead of a dialog, with lowercase "Node updates" and lowercase "Update all (n)" matching the live UI. - Reconnecting overlay polls /api/health every 3 seconds, not "every few seconds". - The local Failed badge surfaces as soon as the helper writes its error file, by the 3-minute mark at the latest. Documents the LocalUpdateConfirmDialog kicker, title, body, and CTA verbatim, the Triggering... loading state on the Update buttons, the four completion signals the gateway accepts (version change, process startedAt change, offline-then-online transition, version at or above the comparison target after 15 seconds), and the 60-second auto-clear of the Updated badge. Drops references to two screenshots that never existed (fleet-node-updating.png, fleet-node-failed.png); the in-flight and failed states are described in prose instead, the same way fleet-view handles them. * docs(scheduled-operations): refresh page for v1 timeline, fleet-wide update action, sheet-based run history Rewrites the Scheduled Operations page against the v1 template (Note tier gate, sectioned anatomy, Frame screenshots, AccordionGroup troubleshooting) applied to sibling pages in this batch. Captures seven fresh screenshots against the production node signed in as admin (timeline, all-tasks, action-picker, create-restart, create-prune, create-scan, run-history) and removes every legacy PNG. Documents the new "Auto-update All Stacks" action that was absent from the page, extends the Skipper allow-list to all four Skipper actions (Auto-update Stack, Auto-update All Stacks, Fleet Snapshot, Vulnerability Scan) and clarifies that the action picker hides operations the active tier cannot run. Corrects several factual claims that no longer matched the code: - Scheduled scan completion is `info`/`scan_finding` on a clean run and `warning`/`scan_finding` when findings are present (not `info`/`system` as previously stated). Cross-link now points at `alerts-notifications#vulnerability-scanning`. - Lifecycle actions (auto_backup, auto_stop, auto_down, auto_start) execute against the local Sencho instance only; only Auto-update Stack / All Stacks have a remote-proxy code path. The page reinstates the guidance to schedule remote lifecycle operations from that node's own UI. - Run history lives in a right-side sheet with a "Schedules › <task> › Runs" breadcrumb and a Download CSV secondary action. - Timeline masthead is described in terms of the v1 visual (`NEXT 24 HOURS` kicker, italic display heading, monospace date range, right-anchored Next pill with countdown, glowing cyan now rail, six-tick bottom axis). * docs(rbac): refresh RBAC & user management page against v1 template Bring /features/rbac onto the v1 docs refresh template (Note tier gate, sectioned anatomy, Frame screenshots, AccordionGroup troubleshooting). Recapture five screenshots from the production node signed in as admin and remove the three stale captures under docs/images/rbac/. Corrections vs. the prior page: - Deployer no longer claims node:read in the permission matrix; the backend grants only stack:read and stack:deploy. - Add the system:registries row (container registry management). - Document the form as inline below the Add user button (not a modal). - Note the (you) marker on the signed-in admin's row and the disabled delete icon on that row. Additions: - Settings nav location and hub-only visibility. - 2FA reset row action with verbatim modal kicker, title, and body. - Five-failure / 15-minute MFA lockout behavior and admin reset recovery. - Token-version session-security table covering deletion, role change, password change, and admin 2FA reset. - SSO password-fields-hidden line quoted verbatim and the per-provider Require MFA toggle. - Audit-log emissions list for every user-management mutation. - API tokens cross-link explaining the user-vs-machine boundary. - Scoped permissions section retightened: scoped role picker is Deployer / Node Admin / Admin only; resource type is Stack or Node. AccordionGroup with eight troubleshooting entries covering missing nav, greyed role options, seat-limit errors, unexpected sign-outs, scoped deployer mismatches, missing shield icon, re-locking MFA accounts, and SSO role drift at provisioning. * docs(2fa): refresh two-factor authentication and admin guide against v1 template Bring /features/two-factor-authentication and /operations/two-factor-admin onto the v1 docs refresh template (Note tier gate, sectioned anatomy, Frame screenshots with descriptive alt text, AccordionGroup troubleshooting, verbatim modal copy with kicker callouts). Recapture every screenshot under docs/images/two-factor-auth/ from a fresh session and add six new captures for surfaces the prior page did not document. Corrections vs the prior pages: - Panel rename: Settings -> Account & Security is now Settings -> Account, under the Identity group of the settings sidebar. Replaced every occurrence on both pages. - Enrol dialog titles match the current modal: Pair your authenticator, Confirm the pairing, Save your recovery codes (was: Set up 2FA, Confirm, Save your backup codes). Step rail 01 PAIR / 02 CONFIRM / 03 ARCHIVE documented. - Manual-entry affordance is the always-visible Secret manual entry row with a copy icon, not the toggleable Can't scan Show secret key link. - Confirm step auto-submits on the sixth digit; no submit button. Verified in MfaChallenge.tsx and MfaEnrollDialog.tsx and called out explicitly. - Authenticator-app list trimmed to match in-app copy (1Password, Bitwarden, Google Authenticator, or any TOTP app). Authy and Microsoft Authenticator dropped because the dialog does not mention them. - Disable dialog: kicker SECURITY MFA DISABLE, title Turn off two-factor, destructive header, Disable button. Replaces the prior Disable 2FA paragraph that did not describe the dialog chrome. - Regenerate dialog: two-step flow with kicker SECURITY BACKUP CODES, Confirm identity then New recovery codes, with the verbatim PREVIOUS CODES HAVE BEEN INVALIDATED warn rail on the show step. Documented that the dialog only accepts a TOTP, not a backup code. - Per-user SSO toggle label corrected: Require 2FA on SSO sign-in (was: Require 2FA even when signing in via SSO). Added the per-provider vs per-user distinction on both pages (admins can also enable Require MFA on the SSO provider config, which is independent of the per-user toggle). - Admin reset modal: verbatim USERS RESET 2FA kicker, Reset 2FA for <username> title, full-body copy reproduced. Documented that the reset bumps the target's token version and invalidates active sessions. Additions: - Sign-in throttle: five failed verifications lock the account for 15 minutes, server returns 423 with Retry-After, UI shows the Retry in MM:SS countdown plus Rate limited label. Lockout recovery section explains that the counter only clears on a successful sign-in, so retries after the window expires re-lock immediately. - Account panel anatomy section enumerates the three rows (Authenticator app, Backup codes, Require 2FA on SSO sign-in) plus the destructive Disable 2FA link, and the masthead 2FA on / BACKUP N left chips. - Recovery codes section now covers all three count states (3 plus, 1 to 2, 0) with verbatim helper text, tone, and the standalone No backup codes left callout that renders at zero. New screenshots for the 2-remaining and 0-remaining states. - Cross-references to the admin operations page (CLI fallback, token version rotation, what a reset changes in the DB), the SSO page, and the RBAC page (per-provider Require MFA toggle, SSO auto-provisioning). Troubleshooting on the feature page rewritten as an AccordionGroup with nine entries: clock drift, wrong account selected, QR will not scan, lost phone with no codes, lost codes with authenticator, ran out of codes, unexpected SSO prompt (with both toggle causes), repeated lockout after the window expires, missing shield icon on Users panel. The admin operations page also gains the SSO + 2FA two-toggles table so administrators can answer the per-user vs per-provider question without context-switching between pages. Six new images added; six existing images replaced. Total 14 captures. * docs(rbac,host-console): drop enforcement-boundary detail from tier-gate notes Operator-facing docs should state tier or role requirements once, in plain customer-facing language, and leave the enforcement chain to the source. Two surfaces on the v1-refreshed pages over-specified the gate: - `features/rbac.mdx::Scoped permissions`: the Note enumerated both the UI hide on Skipper and the `/api/users/:id/roles` write rejection. The first half ("Scoped permissions require Admiral.") is the operator-relevant fact; the rest reads as a fence specification, which is awkward for an open-core product where the gate is readable in source anyway. Trimmed to just the tier claim. - `features/host-console.mdx::Availability`: the paragraph already says who can use the console and that the Console tab is hidden on Community or Skipper. The trailing "Attempting to access the console endpoint directly without the correct license or role is rejected" is the same bypass-prevention coda. Dropped. No functional behavior change; the gates themselves are untouched. * docs(sso): refresh SSO & LDAP authentication page against v1 template Rewrites docs/features/sso.mdx against the v1 docs refresh template (intro + tier callout, sectioned Configuration anatomy, Frame screenshots, AccordionGroup troubleshooting), bringing it in line with the previously refreshed two-factor-authentication and rbac pages on this branch. Recaptures all four screenshots from the production node signed in as admin: sso-settings (overview with the five collapsible provider cards), sso-settings-ldap (LDAP form expanded), sso-settings-oidc (Google form expanded), sso-settings-custom-oidc (Custom OIDC form expanded with all eleven fields). Refreshes the Settings UI section to match the redesigned panel: each provider is a collapsible card with an Active badge on the header, an enable / disable toggle pill, and a footer with Save, Test Connection (green check or red X next to the button), and Remove (only after a config has been saved). Documents the static callback-URL helper that sits below all five cards. Clarifies that the per-OIDC claim mapping environment variables (SSO_OIDC_*_ID_CLAIM, *_USERNAME_CLAIM, *_EMAIL_CLAIM) are accepted for Google, GitHub, and Okta, not just Custom OIDC. The Settings UI hides those fields on the presets because the defaults match. Converts the troubleshooting section to an AccordionGroup with five entries (Test Connection discovery failure, issuer validation error, wrong username or missing email after sign-in, invalid redirect URI, SSO buttons missing on the login page). Cross-links the operations troubleshooting page for setup-time errors. Tightens the LDAP TLS env var note to spell out the literal string 'false' requirement. Syncs the Combining SSO with 2FA section to use the live toggle label 'Require 2FA on SSO sign-in'. * docs(sso): drop the Community-tier Custom OIDC workaround tip The Tip walked through how a Community-tier operator could integrate Google, GitHub, or Okta by pointing Custom OIDC at the provider's discovery URL, bypassing the Skipper preset gate. Operator docs should state the tier rule once and stop; they should not describe how to circumvent it. The tier matrix above the removed block already names which providers are paid; the Custom OIDC row already lists "any spec-compliant OIDC provider" as its scope. That is enough. * docs(vulnerability-scanning): refresh page for v1 UI and corrected tier mapping The page was last revised before the v1 visual redesign and before the tier-mapping changes shipped in v0.81.2 (open Community access to secret scanning, compose misconfig scanning, scan history, and scan comparison). This refresh: - Rewrites the tier matrix to match the shipped Community / Skipper / Admiral split. Secret detection, compose misconfig scanning, scan history, scan comparison, and misconfig acknowledgements are now correctly marked as Community. Scheduled fleet scans, scan policies with block_on_deploy, SBOM, SARIF, and Trivy auto-update stay paid. - Drops two stale Notes that said secret detection and compose misconfig scanning required Skipper or Admiral. The page now states each tier requirement once, in plain language. - Refreshes all six existing screenshots from the production node: resources-badges, scan-details-sheet, scan-history-sheet, scan-compare-sheet, security-settings, app-store-toggle. - Adds a new scan-config-button screenshot showing the stack-page overflow menu where Scan config now lives. - Describes the scan drawer header accurately: Re-scan + Compare + CSV + SARIF as top-level buttons, with SBOM as a separate button below the summary. - Updates the compose misconfig flow to point at the stack overflow menu (not the Deploy controls). - Converts the troubleshooting section to a single AccordionGroup per the v1 template, and audits each entry for legacy phrasing and the removed tier claims. - Adds a TRIVY_BIN reference to the How it works section so operators know about the host-binary override. * docs(cve-suppressions): refresh page for v1 UI and corrected suppression specifics - Recapture all three screenshots from the production node signed in as admin under `docs/images/cve-suppressions/` (`settings-panel`, `create-dialog`, `suppressed-row`). The previous file referenced three image paths that did not exist in the repo. - Align prose with the actual UI labels: - Dialog kicker `SUPPRESSIONS . NEW`, title `New suppression`. - Field labels match the form: `CVE or advisory ID`, `Package (optional)`, `Image pattern (optional)`, `Reason`, `Expires in (days, optional)`. - Remove confirmation reads `Remove suppression` with kicker `SUPPRESSIONS . REMOVE . IRREVERSIBLE`. - Factual corrections: - Fleet sync truncation cap is 5,000 rows (not 10,000). - State the admin-role requirement once in the lead Note. - Drop references to a `Fleet . Sync status` page and a `Reanchor` button; neither exists in the UI. The reanchor flow is an admin API call and is documented in /features/fleet-sync. - Sharpen the specificity scoring section (package + image scores 3, package only 2, image only 1, neither 0) so the order matches the read-time filter logic. - Note that the image-pattern glob is case-sensitive. - New coverage: - Suppressing directly from a scan result, including which fields are read-only in that inline flow and when to fall back to Settings to broaden scope. - The `replicated` and `expired` row badges in the panel. - Hovering the package column on a suppressed row to surface the Reason. - Two distinct read-only modes: viewing a remote node from the hub (panel hidden, banner shown) versus signing into a replica instance (panel visible, read-only). - SARIF export carries suppressions through as `kind: external, status: accepted`, cross-linked to the Vulnerability Scanning page. - Convert troubleshooting to AccordionGroup with six entries; update the truncation entry to reflect the 5,000-row cap. * docs(private-registries): refresh page for v1 UI and fleet-wide credential model Rewrites the page against the v1 docs template (Note tier gate, opening Frame, sectioned anatomy, AccordionGroup troubleshooting) and replaces every screenshot with a fresh capture taken against the current product. Corrects several factual claims that no longer matched the current code: - Registries are stored once on the control instance and applied fleet-wide, not configured per node. The old Multi-node behavior section and the matching troubleshooting entry described a per-node model that the product no longer has. - The Registries section is hidden on remote nodes (global scope) and on Sencho versions that do not surface the feature. New troubleshooting entries explain both visibility states. - The feature is admin-only on Admiral. Non-admin operators do not see the section even on Admiral; previous copy implied any Admiral license user could manage credentials. - Registry endpoints are not reachable from API tokens; only an admin browser session can manage credentials. The Security section now states this without naming internal route paths. Documents UI behavior the previous page omitted: the inline form (not modal), the four type-specific form variants, the Docker Hub read-only URL field, the destructive delete confirmation with its stack-pull warning, the masthead REGISTRIES count, and the empty-state callout copy. Screenshots replaced: - registries-overview.png: section with one configured GHCR card and the masthead stat at one. - registries-empty.png: empty state with the Add registry button and callout. - registries-add-form.png: inline form with the Docker Hub default and the read-only URL field. - registries-ecr-form.png: form switched to ECR, showing the AWS Region field and the relabelled AWS credential inputs. - registries-card-detail.png: card close-up with the three action icons and the metadata row. - registries-delete-confirm.png: destructive ConfirmModal with the kicker, title, and stack-pull warning body. - registries-with-entry.png removed (superseded by registries-overview.png and registries-card-detail.png). * docs(auto-update): refresh readiness page for v1 redesign Bring the Auto-Update Readiness doc in line with the shipped UI: - Replace the hero screenshot with a fresh capture of the redesigned board (italic-display hero, brand-cyan accent, per-node groups with local/remote pills, dashed-border changelog separator). - Rewrite the card-anatomy list. Drop the rollback-target bullet (the field exists in the backend payload but is not rendered). Add the "Rebuild available" inline label and the primary-image / multi-service count line. - Rewrite the risk-tags table as a risk-badges table using the actual badge labels and colors emitted by the UI (Safe / Review / Blocked with the corresponding icons; Digest rebuild for non-semver tags). - Add an Empty state section and document the per-node group header. - Tighten the hero subtitle paragraph to match the actual UI string (only major-bump count is surfaced separately; preview failures are not). - Fix workflow step 4: major-bump apply path is the stack lifecycle Update action, not the Schedules editor (a scheduled task hits the same block). - Add the 2-minute manual-refresh cooldown to the Recheck workflow. - Remove the broken cross-link to the non-existent /features/image-update-detection page and inline the 6-hour cadence fact from ImageUpdateService.INTERVAL_MS. - Convert troubleshooting to AccordionGroup format per the troubleshoot ing convention used on /features/deploy-progress. - Sync the Auto-Update entry in /features/overview.mdx to the new badge labels and the corrected hero-counter description. * docs(auto-update): fix Auto-Update entry point in Workflow step 1 Workflow step 1 said "Open the Auto-Update view from the sidebar." The Auto-Update view is opened from the top nav strip (alongside Home, Fleet, Resources, App Store, Logs, Schedules, Console, Audit). The sidebar carries the stack list and the per-stack right-click / kebab context menu that toggles auto-updates on or off; it does not house the Auto-Update top-level view. * docs(auto-update): trim enforcement detail from per-stack control note State the tier requirement once and stop, per Directive 27. The "The toggle does not appear on Community" sentence enumerates the enforcement effect of the gate, which the source already reflects; operator docs do not need to narrate it. * docs(auto-heal): refresh page for v1 UI and policy hardening Rewrite Auto-Heal Policies docs against the current Stack Monitor sheet: corrects the Max restarts / hr field label, documents the per-policy enable toggle, the consecutive-failures pill, the full Recent activity action set (including Docker unavailable), the 30s evaluation cadence, multi-node behavior, notification dispatches, and the dashboard Configuration status counter. Replaces the broken /images/auto-heal-policies/policy-sheet.png reference with three fresh screenshots captured against a live node: the sheet on the Auto-heal tab, a single policy row, and the expanded Recent activity panel. * docs(webhooks): refresh page for v1 UI, correct tier and add Git source sync - Fix tier note: gate is Skipper or Admiral, management is admin-only. - Update Settings path to Settings -> Alerts -> Webhooks; document the read-only Node field and the green secret-reveal callout. - Add the missing Git source sync action and the git-pull override value. - Refresh the configured-webhooks card description: action/stack/node badges, On/Off toggle, copy URL, and the Recent executions disclosure. - Tighten the trigger section with a constant-time signature check note and a status/body/meaning response table. - Add an Accordion troubleshooting block covering common signature failures, the 404 case, no-op actions on 202, and git-pull prereqs. - Re-capture all three screenshots from the v1 UI. * docs(webhooks): wrap troubleshooting accordions in AccordionGroup * docs(sidebar): refresh page for v1 redesign with filter chips, bulk mode, row anatomy, and troubleshooting Rewrites the Stack Sidebar page against the live v1 sidebar and the v1 docs refresh template (Frame screenshots, Note tier callouts, AccordionGroup troubleshooting). Recaptures all four existing screenshots and adds three new captures: filter chips, row anatomy, and bulk mode. Adds coverage for features the previous page omitted entirely: the ALL / UP / DOWN / UPDATES filter chips with their counts cap and collapse toggle; bulk mode (B key, sticky toolbar with Start / Stop / Restart, and Update gated on Skipper or Admiral); stack-row anatomy (status pill, label dots with +N overflow, image-update dot vs Git source icon priority, hover kebab); the Auto-update toggle, Schedule task, and Open App entries in the context menu; the B shortcut for bulk mode. Corrects three claims that no longer matched the code or UI: Auto-Heal is gated on Skipper or Admiral, not universal; the global Ctrl+K opens the command palette, not the sidebar search box; the activity footer kicker reads LIVE / IDLE with the verbatim copy from SidebarActivityTicker. Documents the in-menu ↗ and L › glyphs as visual hints rather than global keybindings to match useStackKeyboardShortcuts.ts. * docs(sidebar): trim enforcement-effect sentence from context-menu tier note State the Skipper / Admiral requirement once and stop, per Directive 27. The "They do not appear in the menu on Community" clause described the enforcement effect alongside the gate, which the directive bans in operator-facing docs. * docs(host-console): refresh page for v1 UI and clarify shell metadata Rewrite the Host Console page to match the current Cockpit layout (masthead + terminal well + chip strip), replace the legacy PowerShell screenshot with a fresh bash capture, and document the masthead tone states, kicker, metadata pills, and session/heartbeat behavior. Trim the security section to state the tier and role rule once. * docs(licensing): refresh page for v1 UI, corrected pricing, and trial flow Rewrites the Licensing & Billing page to match the redesigned v1 Settings layout. The previous draft still described the legacy Settings Hub: in-app "Upgrade your plan" Skipper/Admiral cards, "Start monthly trial" / "Start annual trial" buttons, the "Have a license key?" field, "Manage Subscription" with a capital S, "Deactivate License" as the button label, and the license-active.png asset rendering the literal "Sencho Pro" string in the card title. None of that exists in the current product. - Refreshes the Plans table to the live pricing on sencho.io/pricing and adds an Enterprise mention with the floor price ($3,500/year). Skipper now $11.99 annual / $14.99 monthly / $449 lifetime, Admiral now $69.99 annual / $89.99 monthly / $2,499 lifetime. - Rebuilds the Feature breakdown from a code-level audit of every requirePaid, requireAdmiral, requireScheduledTaskTier, and requireTierForSsoProvider call site in backend/src/routes, not from the marketing page. Notable code-grounded items: CVE suppressions on Community (no requirePaid guard), manual fleet snapshots on Community (scheduled snapshots on Skipper), Sencho Mesh under Admiral (entire mesh.ts router is requireAdmiral), and scheduled-task tiering names update/scan/snapshot as the Skipper subset with everything else under Admiral. - Rewrites the Free trial flow end to end. The previous steps told operators to click in-app "Start monthly trial" or "Start annual trial" buttons; no such buttons exist. The new flow starts on sencho.io/pricing, switches to the Annual or Monthly tab, clicks "Start 14-day trial" on the Admiral card, completes the Lemon Squeezy checkout (card-required, no charge before day 14), and pastes the issued key into Settings -> License -> License key. - Adds a new "The Plan section" anatomy block describing the masthead SCOPE / PLAN / DURATION (or RENEWS, TRIAL, STATUS) stat pills and the Plan card fields (Customer, Product, masked License key, status helper). - Adds a new "License states" reference table covering Community / Trial / Active subscription / Active lifetime / Expired / Disabled, what each surface renders, and which of the Plan / Activate / Pricing sections is visible in each state. - Corrects every UI label that drifted: section heading is Activate, field label is License key (not "Have a license key?"), buttons are Manage subscription (lowercase s) and Deactivate (not "Deactivate License"), and the action-row hint reads "Lemon Squeezy manages billing". - Documents the redesigned profile dropdown: identity header with initials chip, role badge, and tier badge, then Settings, conditional Billing, Documentation, Feedback, an Appearance segmented control, and Log Out. Billing only appears when the license is an active non-lifetime subscription. - Replaces all four screenshots under docs/images/licensing/: license-admiral-active.png (production Admiral lifetime view), profile-menu.png (redesigned popover), and two new captures for the Community-tier surfaces (license-activate-section.png, license-community.png). Removes the stale license-active.png (legacy "Sencho Pro" card) and profile-billing.png (legacy dropdown). * docs(settings-reference): refresh page for v1 UI with new sections and masthead Rewrites docs/reference/settings.mdx against the current Settings Hub so a reader encounters an accurate map of every section. Adds the previously missing **Cloud Backup** and **Security** sections, restructures **System Limits** into Host thresholds and Docker hygiene subsections (GiB units, "Global crash capture" toggle), fixes the Account password minimum to 8 chars and documents the two-factor subsection, refreshes License/Routing/Webhooks/App Store with the field labels actually rendered today, and documents the masthead pills (SCOPE/NODE, EDITED, plus the per-section stats like 2FA, PLAN, CHANNELS, ROUTES, WEBHOOKS, LABELS, TRIVY, POLICIES, PROVIDER, USED, SNAPSHOTS, DEV MODE). Replaces five existing screenshots that predated the v1 redesign and adds five new captures: Account with the 2FA card, License panel, System Limits with both subsections, Security with the Trivy installer, and Cloud Backup with Sencho Cloud Backup provisioned. All shots taken against the production node. * docs(licensing): drop billing-provider name from operator-facing copy The previous draft named the third-party billing provider in nine places (checkout, receipt email, error toast verbatim, Customer / Product field descriptions, the action-row hint, the billing portal, and the validation API). Operator docs don't need to advertise which vendor sits behind the checkout, billing portal, and validation calls. Rewrite each instance to describe what the operator sees and does without naming the upstream service. * docs(node-compatibility): refresh page for v1 UI with lock card visuals and current capability list - Replaces the legacy "dim + blur + pill overlay" description with the current CapabilityGate behavior: a centered lock card with an Unplug icon, title "<feature> is not available on this node", and a body line that names the node and its running version. - Corrects the tier-interaction section: on the wrong tier the entry point is hidden entirely, so the lock card only appears for users who already cleared the license gate. - Documents the public /api/meta endpoint, the 5-minute success cache, the 30-second failure cache, and the lazy-fetch behavior visible in the switcher (the version pill appears once a node has been visited). - Refreshes the capability table against the current CapabilityRegistry list, adding container-exec and vulnerability-scanning, with a note that vulnerability-scanning is only advertised when Trivy is installed. - Adds three production screenshots captured on the live fleet: switcher popover with mixed-version pills (one node on v0.76.9, rest on v0.81.11), a real lock card on an older pilot agent, and the Connection Details panel from Settings · Nodes. * docs(security): refresh security architecture page for v1 UI Add Fleet Secrets and Webhook signatures cards plus tier-matrix rows for shipped-but-undocumented features. Rename SSO presets from "one-click" to "preset providers" (presets still require OAuth-app provisioning on the upstream IdP). Update settings paths to the v1 middle-dot convention: Settings · Users, Settings · Account, Settings · Developer · Data retention. Extend the encryption-at-rest list with registry credentials and Fleet Secrets bundle payloads (both sealed with the same AES-256-GCM data key) and clarify the password section with bcrypt cost factor 10. Add a Webhook signature authentication subsection covering the per-webhook HMAC-SHA256 secret, one-shot display, masked preview thereafter, and constant-time comparison on inbound triggers. Replace the API Tokens screenshot with a fresh capture against the v1 Settings · Identity · API Tokens panel. * docs(security-advisories): retire reference page The reference/security-advisories page does not survive the v1 docs refresh: - Misuses the term "Security Advisories", which industry-wide refers to published notices for confirmed product CVEs (ID, severity, affected versions, fix version, remediation). The retired page was a narrative changelog of internal hardening work between v0.19 and v0.25.2. - The narrative is also frozen at v0.25.2 (April 2026) while current release is v0.81.11. Refreshing it would require backfilling ~56 release entries' worth of hardening copy. - The framing is uniformly "improved from prior behavior" (minimum 8 characters up from 6, 1-year token expiry previously without expiry, CORS previously allowed all origins, users should upgrade promptly). Sencho has not shipped publicly; there are no users to address as upgraders. All operationally relevant content already lives elsewhere: the security architecture page covers the current posture, verifying-images covers the supply-chain attestations, cve-suppressions covers operator acknowledgment, vulnerability-scanning covers the in-app scanner, and contact + the security architecture page both surface the disclosure path. Published Sencho-product advisories, when any exist, will appear on the GitHub Security tab, which is already linked from those pages. Inbound-link audit returned a single hit on the nav entry itself; no other doc, README, or operator artifact deep-links the slug. * docs: rewrite Pilot Agent page with deep architecture and operations reference Reframes docs/features/pilot-agent.mdx as the architecture-and-operations companion to the operator walkthrough in Multi-Node Management. Adds a mental model section, an explicit security and trust model, a full agent env-var reference, an honest limitations list, and a 5-item FAQ. Verifies every constant and label against the current backend source. Refreshes four production screenshots (admin login, scrubbed) and resolves the previously-broken /images/pilot-agent/enrollment-dialog.png reference. Adjacent edits keep the cross-linking coherent: - multi-node.mdx adds a one-line forward link to the rewritten page - security.mdx adds a Pilot Agent tunnel credentials subsection * docs(fleet-federation): deep rewrite with production screenshots Rewrites the Fleet Federation page against the v1 docs refresh template following the recent fleet-view, pilot-agent, and multi-node refreshes. Doubles the page length (92 to 204 lines) while keeping the cut-line v1 MVP scope: operator-driven placement controls (cordon + pin) for Blueprints, no expansion into mesh/sync/pilot territory. What changed: - Adds four production-captured screenshots under docs/images/fleet-federation/: the Federation tab with a cordoned node populated, the node-card kebab menu showing the Cordon node entry, the cordon confirmation dialog with a reason filled in, and a node card displaying the Cordoned pill. - Expands the page to eleven sections: opening summary, philosophy (kept), key capabilities, prerequisites, step-by-step usage with embedded screenshots, behaviour and lifecycle table, security and audit, limitations and non-goals (expanded), practical workflows (new: OS patching, host-to-host migration, gateway pinning), troubleshooting (eight accordions, up from five), and a Where Federation fits cross-link table. - Documents the exact production UI strings observed: the cordon dialog description, the uncordon confirmation copy, the reason field cap (256 chars), and the audit log action names (node.cordon, node.uncordon, blueprint.pin). - Documents the audit visibility surface so operators know how to filter the Audit view for cordon and pin history. - Adds eight cross-links to sibling pages (Fleet View, Multi-Node, Pilot Agent, Mesh, Fleet Actions, Fleet Sync, Blueprints, Licensing) with one-line scope contrasts so newcomers can place Federation in the broader fleet picture. - Tightens lifecycle table to operator-relevant terms (no DB column names) and audit section to operator-facing wording (no middleware names), keeping the page operator-focused rather than implementation-focused. Validation: - Captured screenshots against the production node logged in as admin, using Playwright MCP. Cordoned and pinned actions reverted; audit log confirmed the matched cordon/uncordon pair. - Verified every cross-link target exists in the v1-refresh worktree (/features/fleet-view, /features/multi-node, /features/pilot-agent, /features/sencho-mesh, /features/fleet-actions, /features/fleet-sync, /features/blueprint-model, /features/licensing). - Compliance: no em dashes, no PII, no "previously"/"used to" framing, no fence-spec language, tier rule stated once in plain language. * docs(fleet-federation): drop fence-spec phrasing in the open-core context Sencho is open-core: anyone can clone the repo and read the tier gate. Operator docs that name exactly where the UI gate sits ("hidden at the Community and Skipper tiers", "lower-tier users do not see the toggle", "only the Federation tab is gated") work as a dig-target for a tech-savvy reader and undercut the open-core posture. Directive 27 already bans enforcement-chain spelling; the open-core threat model makes the same phrasings risky even when they describe UI surfaces rather than route guards. Removes three instances of the pattern on this page: - Top Note callout: drops "The tab is hidden at the Community and Skipper tiers." Keeps the one-line requirement: "Federation is an Admiral feature. Cordon and pin actions require an admin user role." - Security and audit section: drops the sentence enumerating which UI affordances are hidden from which tiers. Keeps the customer-visible behavior (the Cordoned pill stays visible at every tier as a read-only signal). - Troubleshooting "Federation tab is not visible" accordion: rewrites to lead with the requirement and the role check, drops the "Federation is hidden by design" and "only the toggle and the Federation tab are gated" phrasings. Other claims on the page unchanged; rule is still stated once in plain language at the top of the page. * docs(fleet-sync): deep rewrite with production screenshots Replace fleet-sync.mdx with a verified end-to-end reference. The previous page named two replicated resources but the code syncs three, described a sync-status panel and a fleet-vs-node scope picker that do not exist in the shipped UI, and was missing prerequisites and several edge cases. Highlights of the rewrite: - Names all three replicated resources (scan policies, CVE suppressions, misconfig acknowledgements) and treats them uniformly. - Drops the sync-status-panel and node-scope-picker UI claims; both move to the Limitations section as honest caveats. - Adds prerequisites covering the paid-tier requirement on the control, admin-role requirement, proxy-mode remotes, and reachability. - Expands lifecycle coverage: per-node serialised pushes, add-node backfill, monotonic pushedAt, per-resource watermarks, identity-drift notifications, the 5000-row truncation cap, stale-target warnings, audit-log entries on the replica. - New "Where Fleet Sync fits" closing table cross-linking to Fleet View, Multi-Node Management, Pilot Agent, Vulnerability Scanning, CVE Suppressions, Fleet Federation, Fleet Actions, and Licensing. - Two fresh production screenshots: control Security panel and the "Scanner is per-node" callout shown when proxying to a remote. * docs(fleet-actions): deep rewrite with production screenshots Three cards are documented end to end: Stop fleet by label, Bulk label assign, and Prune Docker resources fleet-wide. Adds the execution-path distinction (control-orchestrated fan-out vs single-node proxy), per-card behaviour and partial-failure semantics, prerequisites, limitations, practical workflows, an Accordion troubleshooting section, and a Where Fleet Actions fits comparison table linking the surrounding Fleet view features. Corrects the prior page's tab-neighborhood claim, confirm-dialog wording, autocomplete-vs-request scope, and missing batch ceiling. Replaces the ten-day-old single screenshot with five fresh production captures under docs/images/fleet-actions/. * docs(fleet-secrets): deep rewrite with production screenshots Full rewrite of /features/fleet-secrets matching the fleet-actions structure. Replaces the sparse v1 page (no Frames, inline Q&A) with a gold-standard layout: opening Frame, single Note for the tier gate, 'What it covers' table, mental model, prerequisites, create + edit + versions + push (Target / Preview / Results) sections each with a production Frame, Import from stack section, behaviour and lifecycle table, audit-trail mapping with the six exact audit strings, limitations and non-goals, practical workflows, AccordionGroup troubleshooting, and a Where-it-fits cross-link table. Adds six fresh production screenshots under docs/images/fleet-secrets/ : overview, create, versions, target, preview, and results. Documents the Import-from-stack flow (depends on the bundle editor's new Import action) and uses the post-rename 'Send' wording on the bundle-row action (depends on the aria-label fix). Corrects three factual drifts vs the code: env-key regex described as 'letter or underscore, then letters/digits/underscores; case- sensitive' to match ^[A-Za-z_][A-Za-z0-9_]*$ ; documents only the 'ok' and 'failed' status pills (the 'skipped' enum value is unused); replaces the bogus 'stack not found' troubleshooting entry with the real 'env file not declared' cause. Drops the fence-spec phrasing 'The tab is hidden on Community.' per Directive 31; the tier requirement is now stated once in plain language. * docs(sencho-mesh): deep rewrite with mental model, lifecycle, security, screenshots Replace the feature-reference page with a deep product + technical guide. Adds: - Opening hook framing audience and problem (cross-node service-to-service without a separate VPN or service-mesh sidecar). - Mental model: three moving parts (sencho_mesh bridge, alias registry, cross-node transport) with direction-of-flow described in prose. - Key capabilities, prerequisites, step-by-step usage with inline screenshots. - Full lifecycle section covering opt-in, opt-out, sticky stack-stopped state, peer reconnect, and the proxy-mode bridge with its real default (persistent, env-override for idle). - Security and trust boundaries split into authentication, inbound exposure, encryption, audit, and app-layer caveats. - Limitations and non-goals: one-alias-per-port, port 1852 reserved, central-relay for remote-to-remote, shared 1024-stream pool with the Pilot tunnel, no L7, host-network unsupported, in-memory activity log. - Three concrete workflow examples and a complete troubleshooting accordion (every data-plane reason, every probe stage, every unreachable cause) plus a Common questions FAQ. - Where Mesh fits CardGroup linking Pilot Agent, Multi-Node, Federation, Licensing. Corrections vs prior text: - Tab is labelled Traffic in the UI (not Routing); all navigation references updated. - Proxy-mode bridge default is no idle close (env-overridable to opt into idle teardown); prior 5-minute-teardown claim removed. - Audit trail scope tightened: only opt-in / opt-out write durable rows; tunnel-state and probe events live in the in-memory activity log. Adds seven production screenshots under docs/images/sencho-mesh covering Table view, opt-in sheet, graph (Tunnels and Aliases edge modes), Diagnostics, activity log, and per-stack topology. * docs(blueprints): add missing detail-state-review screenshot Captures the Blueprint detail sheet with a deployment row in the "Awaiting confirmation" status (stateful first-deploy gate), to fix the broken image referenced at blueprint-model.mdx:132. mint broken-links now reports zero broken references. * docs(blueprints): deep rewrite with mental model, lifecycle, security, prerequisites Restructures the Blueprints page against the v1-refresh template used by the recently-refreshed mesh, secrets, and atomic-deployments pages. Adds a mental model, prerequisites table, lifecycle and status-transition map, security and trust boundaries section, practical workflows, common questions accordion, and a Where Blueprints fits CardGroup. Removes the internal-style rollout and watch-plan section. Replaces all nine production screenshots with fresh captures against the production node signed in as admin, and adds two new captures (federation pin policy table, stateless eviction dialog). Rewrites the tier-gate Note to drop the fence-spec phrasing that violated Directive 31. Every retained claim is anchored to current backend or frontend code. * docs(pilot-agent): recapture enrollment dialog with compose payload Replaces the pre-0.84 docker-run capture with the current dialog (Compose file, two-step instructions, "Copy compose file" button) and refines the alt text to describe the captured content. URL and token redacted to placeholder values during capture.	2026-05-20 08:43:18 -04:00
Anso	0be479100c	docs: v1 docs refresh (#966) ... * docs(introduction): rewrite intro page and refresh screenshots Rewrite the Getting Started introduction to reflect the current product: adds the Mesh, Blueprints, Pilot, Fleet, Resources concepts up front; restructures capability sections around Stacks, Fleet (now including Fleet Actions), Mesh, Blueprints, Monitoring, Resources, Security, Automation, and Pilot/Remote ops; cross-links every claim to the matching feature page. Replaces the dashboard hero shot with a fresh capture against the redesigned cockpit chrome and adds three inline shots (running stack with anatomy and logs, fleet command deck, resources hub with reclaim header). All screenshots taken at 1920x900, dark theme, with node names, usernames, IPs, and home paths neutralized. Drops outdated claims: stale "190+ templates" count, the "viewer accounts" RBAC summary, and the "atomic" deployment label that did not match the actual rollback mechanism. * docs(introduction): add Federation and Fleet Secrets Federation has shipped (Admiral) with cordon and pin policy as operator overrides on the blueprint reconciler. Fleet Secrets is landing as a Skipper+ tab for versioned env-var bundles encrypted at rest, with diff preview and target push. Mirror those in the Run-one-machine-or-many bullet list and in the Tiers paragraph so the introduction matches the current product. * docs(introduction): re-shoot screenshots against v0.72.0 production Re-capture all four introduction screenshots from the upgraded production node so the fleet view shows the current full tab strip (Overview / Snapshots / Status / Deployments / Traffic / Federation / Fleet Actions / Secrets) instead of the older Overview / Snapshots / Status only. Same 1920x900 dark-theme capture and the same PII scrub applied (node names, usernames, IPs, home paths neutralized). * docs(quickstart): rewrite around v0.72.0 cockpit and add screenshots Replaces the bare install snippet with a five-minute walkthrough that matches the redesigned UI. Leads with a docker-compose.yml block (the bare docker run command is collapsed in an Accordion), keeps the 1:1 path rule, and adds two new sections that show the user what happens on first boot. Adds two screenshots at 1920x900 dark theme: - setup-cold-start.png: the Cold start card with Username, Password, Confirm password fields, and the Initialize console button. - dashboard.png: the post-sign-in dashboard captured against v0.72.0 with the full top nav (Home, Fleet, Resources, App Store, Logs, Auto-Update, Console, Audit, Schedules) and the populated Stack health table sorted by load. Where-to-next now uses CardGroup cols=2 to match the introduction page's pattern. * docs(configuration): align env var reference with current backend Bring docs/getting-started/configuration.mdx up to date with the v0.72.0 backend: - Remove PORT from the optional env vars table. The listen port is hardcoded to 1852 in backend/src/helpers/constants.ts and is never read from the environment. Replace it with a Listen port section that explains the fixed port and host-port remapping. - Document API_RATE_LIMIT (default 200) and API_POLLING_RATE_LIMIT (default 300), both applied in production only. - Note the /app/compose fallback default for COMPOSE_DIR while still pointing readers at the 1:1 path rule. - Point the SSO env var section at the new SSO Quickstart page and keep the SSO feature reference as the deeper dive. - Tighten First boot and cross-link to Quickstart so the screenshot is not duplicated. - Add a Where to next CardGroup matching the refreshed Introduction and Quickstart pages. Drop stale PORT=1852 and JWT_SECRET=your-secure-jwt-secret-here lines from .env.example so the example no longer contradicts the docs (PORT is hardcoded, JWT_SECRET is auto-generated and persisted to the database during initial setup). * docs(configuration): replace em-dash-substitute hyphens in prose Three sentences used ` - ` (space-hyphen-space) as an em-dash substitute. Replaced with the punctuation that fits each case: - "How Sencho organizes your compose directory": semicolon between the two related clauses. - Data directory Warning: parentheses around the parenthetical insertion. - 1:1 path rule explanation: comma before the contrastive clause. Heading slugs and YAML code-block comments are unchanged. * docs(sso): refresh setup guide and drop misleading "one-click" wording Brings the SSO Setup Guide in line with how SSO actually works in the current build, and corrects misleading copy across both SSO docs pages. - Setup Guide: explains the env-var-seeds-once / DB-is-authoritative config model up front, replacing per-section "Restart Sencho" wording that implied a restart was always required. - Setup Guide: promotes the per-provider Test Connection button out of the LDAP-only paragraph into a generic intro callout, and adds a self-signed LDAPS tip. - Setup Guide: notes that all OIDC providers accept a *_DISPLAY_NAME override for the login button label, and adds a commented LDAP TLS toggle to the full compose example. - Setup Guide: adds two screenshots of the redesigned Settings > SSO panel (overview + LDAP card expanded with form). - Both pages: replaces "one-click presets" / "one-click configuration" with "preset providers". The Skipper-tier presets still require an OAuth app provisioned in the provider's console; what they actually buy is provider-aware defaults and a branded login button. The old wording overpromised. * docs(features-overview): regroup catalog and add 17 missing features Restructure the Features Overview into the same six groups the docs sidebar uses (Stacks & Deployments, Observability, Fleet & Multi-Node, Security & Identity, Automation, Platform) plus a short Reference tail. Add catalog entries for 17 shipped features that the previous overview never mentioned: Stack Activity, Stack File Explorer, Deploy Progress, Deploy Enforcement, Blueprints, Git Sources, Global Search, Pilot Agent, Sencho Mesh, Fleet Federation, Fleet Actions, Fleet Sync, Fleet Secrets, Two-Factor Authentication, CVE Suppressions, Auto-Heal Policies, Stack Sidebar. Fix two factual inaccuracies: - Fleet View blurb wrongly gated search, sort, filter, and stack drill-down behind Skipper. The deep-dive is explicit that those are available on every tier; only the bulk Update All action inside the Node Updates modal is paid. - Auto-update entry was titled and described as a scheduling system. The deep-dive page is the Auto-Update Readiness board (risk tags, changelog previews, rollback targets); the scheduler lives under Scheduled Operations. Add three hero screenshots captured from production at 1920x900, illustrating the redesigned cockpit visual language: Home dashboard, stack anatomy, and fleet topology. * docs(stack-management): refresh page around v0.72.0 cockpit and add screenshots Updates the Stack Management page to match the current UI: sidebar with filter chips and label groups, bulk mode, restructured kebab menu, two-tab anatomy panel, and three-source New stack dialog (Empty, From Git, From Docker Run). Adds sections for Filter chips, Pinned and label groups, and Bulk mode. Restructures the Stack context menu around the inspect, organize, lifecycle, and destructive groups with their keyboard shortcuts. Documents the From Git tab and cross-links Git Sources for the full sync flow. Replaces every existing screenshot with fresh captures from the current UI and adds eight new captures for the new sections. Cross-links Stack Activity, Stack Labels, Stack File Explorer, Compose Editor, Atomic Deployments, Scheduled Operations, Auto-Heal Policies, Auto-Update Policies, and Alerts and Notifications for features documented on their own pages. * docs(stack-activity): refresh page around v1 cockpit and recapture screenshots Realign the page with the current Anatomy panel tab strip and the StackActivityTimeline component: - Frame the Activity tab as a sibling of Anatomy under the right-hand panel, with files/edit actions belonging to the strip. - Expand the category guidance: list the five iconized categories and call out that other stack-scoped notifications (deploy failure, available image updates, auto-heal triggers, monitor alerts, scan findings) flow into the timeline with a generic icon. - Tighten the actor-attribution rule to match the component: omitted for events without an actor and for system-driven events. - Add the day-format example to the relative-time row. - Recapture both screenshots from a populated stack (Today + Yesterday + Earlier with three distinct icons) and an empty stack. - Convert troubleshooting blurbs to H3 for anchor links and consistency with the v1-refresh sibling pages. * docs(stack-activity): wrap troubleshooting entries in Accordion blocks Match the foldable troubleshooting pattern established by docs/features/deploy-progress.mdx so the page stays compact and readers can scan to their issue. This is the canonical formatting for the /features section's troubleshooting blurbs going forward. * docs(editor): refresh page around v1 cockpit and recapture screenshots Rewrites the page around the dual-mode right panel (Anatomy by default, Monaco when the user clicks edit), the redesigned Command Center action bar, the new container row layout with status badges and live stats, the Structured / Raw terminal logs toggle, the Git Source toolbar button, and the opt-in diff preview. Drops the obsolete persistent embedded terminal section. Preserves the #diff-preview-before-save and #log-viewer anchors referenced from settings.mdx and global-observability.mdx. Replaces editor-overview.png and container-exec-modal.png with fresh captures against v0.72.0 production at 1920x900 dark theme; renames container -actions.png to containers-list.png; adds command-center.png and editor-edit-mode.png. PII scrubbed (host paths normalized) and the compose-diff-preview/diff-modal.png shared asset is left untouched after visual diff against the live UI showed no chrome change. * docs(features): wrap troubleshooting accordions in AccordionGroup Wraps the loose <Accordion> blocks in editor.mdx and stack-activity.mdx in a single <AccordionGroup> to match the troubleshooting design used by fleet-federation.mdx. Structural only; no content changes. * docs(stack-file-explorer): refresh page around v1 explorer and add screenshots Full rewrite to match the live two-pane Files tab. Replaces the false 'Edit' toolbar flow with the read-only chip + always-on Save model, fixes the protected-files list (5 names) and dedicated-tab redirect list (3 names), drops the fabricated 100 MB download cap, and corrects the upload claim to single file at a time. Adds sections for New File, Rename, Permissions, the type-to-confirm protected-file delete flow, the non-empty folder delete confirmation, the 500-entry tree display cap, and the symlink rendering. Restructures troubleshooting around <AccordionGroup> + <Accordion> to match fleet-federation.mdx, and adds two new entries (display cap, 403 on Community admin write). Ships nine screenshots captured against v0.72.0 production at 1920x900 in dark theme: overview, two-pane layout, protected-tree-marker, viewer-edit-mode, new-file-dialog, context-menu-folder, context-menu-file, permissions-dialog, delete-protected-confirm. * docs(deploy-progress): rewrite around current modal + capture v1 screenshots Aligns the page with the v0.72.0 implementation and standardizes the troubleshooting layout with the rest of the docs refresh. Setting and gating - Renames the Settings field to "Deploy progress modal" and quotes the current helper text verbatim. Documents that the toggle is off by default, lives under Settings > Appearance > Display, is stored in localStorage, and syncs across tabs in the same browser. Modal anatomy - Names every visible UI string: header verbs, status indicator (with the "closes in <n>s" countdown that was previously undocumented), empty-body strings, footer toggle that flips between "Raw output" and "Hide raw", and the destructive border on ERR rows vs the softer warn tint on WARN rows. - Replaces the vague "after a few seconds" with the actual 4-second auto-close timer; documents hover-to-pause and the leave-hover-restarts-the-countdown behavior. - Documents the truncated error message in the failed-state header and the manual close-only requirement. - Notes that the pill is portal-mounted and survives navigation. Stage badges - Keeps the 9-badge table but adds an honest note that most lines render as LOG because the badges are gated on Compose's "[+]" progress prefix, which Compose only emits in TTY mode and Sencho spawns it without one. Entry points - Splits the supported actions into the four that produce a populated structured-log body (Deploy, Update, Install, Git Apply) and the two that bypass compose and finish with 0 lines (Restart, Stop). Drops the "Down" claim from the user-facing list since no UI control currently triggers it; mentions the down route as an automation surface only. Troubleshooting - Wraps the existing accordions in an <AccordionGroup> matching the pattern used by the editor and stack-activity refreshes. Adds two new entries: one explaining the Restart/Stop "0 lines" outcome, one explaining the LOG-everywhere case for non-TTY compose output. Screenshots (six PNGs in docs/images/deploy-progress/, 1920x900, dark theme, captured against the upgraded production node) - setting-toggle.png: the Display section with the toggle enabled. - modal-streaming.png: a real update in flight at 19s, 554 lines. - modal-succeeded.png: succeeded state with the live closes-in countdown visible. - modal-raw-output.png: structured rows with the Raw output panel expanded beneath. - pill.png: minimized pill anchored bottom-center on a stack editor view. - modal-failed.png: failed state with the truncated error in the header and ERR rows highlighted. * docs(resources): refresh Resources Hub page for v1 redesign and feature additions Rewrite the page to match the shipping UI and replace stale screenshots with fresh captures of the redesigned chrome. - Document the admin-only Reclaim hero and clarify the per-tile Sencho-only vs. All Docker (includes external) split in Quick Clean. - Add coverage of the Scan history toolbar button and the per-row severity badge plus shield-icon scan dropdown in the Images tab; cross-link to the vulnerability scanning page. - Correct the Volumes column list (no Size column; size lives on the Largest 5 landing card) and call out admin gates on browse and delete. - Spell out the List/Topology view-mode toggle and that Create Network is admin-only and List-mode only. - Rewrite the Unmanaged tab section around the project-grouped layout, the Select all + Purge Selected (N) admin-only multi-select, and the empty state copy. - Replace screenshots: resources-reclaim, networks-list, create-network, network-inspect, network-topology, network-topology-toggle. Add fresh resources-volumes-tab and resources-unmanaged-tab captures. * docs(app-store): refresh page around v1 deploy sheet, scan integration, and registry settings Rewrites the App Store reference to match the current cockpit: - Documents the weekly-rotated featured banner picked from the top-5 by GitHub stars and the star-descending grid sort. - Adds the deploy-sheet structure (breadcrumb, meta line, About panel with Read more) and splits the Advanced tab into Ports, Volumes, Environment variables, Custom variables, and Security subsections. - Documents the Trivy-gated Security checkbox, atomic vs non-atomic deploys by tier, and the rollback semantics driven by error class. - Adds a Watching the deploy section linking to the deploy-progress modal. - Rewrites the Custom registry section against the new two-panel settings layout (Default + Custom) with the URL validation rule and the using default / using custom hint. - Adds a four-entry Accordion troubleshooting block in the house style. - Replaces three screenshots and adds two (Advanced tab, Settings registry panel) captured against the production node. Permissions wording aligns with current backend (admin only); the broader stack:create gate will land in a follow-up fix branch. * docs(app-store): describe inline port-conflict messaging on deploy sheet Update the deploy-sheet section to match the visible port-conflict behavior: the Essentials tab surfaces a Port-conflict warning that replaces the defaults hint when any default port is already bound, and the Advanced tab shows an inline "in use by {stack}" message next to the container port instead of a hover-only tooltip. Refresh the screenshot alt-text and the troubleshooting Accordion to match. * docs(app-store): align permissions note with stack:create gate Pairs with the backend gate swap in fix/templates-deploy-rbac (#986) which moves POST /api/templates/deploy from requireAdmin to requirePermission('stack:create'). Updates the Note block under 'Watching the deploy' so the docs match the new behavior: admin and node-admin can deploy templates from the App Store; viewer, deployer, and auditor cannot.	2026-05-07 23:44:13 -04:00
Anso	fe3bc3e9c3	docs: refresh GitHub README for 1.0 launch (#978) ... New hero with light and dark logo via <picture>, fresh production screenshots (dashboard hero plus four-image gallery covering stacks, editor, fleet, and logs), tighter capability list grouped by surface, compose-first quick start with TLS reverse-proxy callout, dedicated remote-nodes section, and a combined documentation/community/license footer. Also adds .github/FUNDING.yml pointing at the Buy Me a Coffee page so the Sponsor button surfaces on the repo page.	2026-05-07 20:06:19 -04:00
Anso	a85af40cb5	fix(frontend): tighten bell notification panel toolbar (#929) ... * fix(frontend): tighten bell notification panel toolbar Restructure the popover so the segmented filter (All / Unread / Alerts) and the action icons (filter toggle, mark all read, clear all) share a single row inside the 360px panel. The previous layout wrapped the segmented control onto a second row once the type filter was added. Move the unread badge to the right of the title, collapse the node and type dropdowns behind a filter-toggle icon (accent dot signals an active filter), equalize both Select widths, and extract the duplicated className strings into local constants. * docs: refresh bell notification popover screenshot Reflects the reworked toolbar (segmented filter + filter toggle + mark-all-read + clear-all on a single row).	2026-05-05 09:36:49 -04:00
sencho-quartermaster[bot]	577acc056b	docs: refresh screenshots (#882) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 13:56:08 -04:00
sencho-quartermaster[bot]	9ba6b604e3	docs: refresh screenshots (#869) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 01:15:46 -04:00
sencho-quartermaster[bot]	7cde9917a5	docs: refresh screenshots (#866) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-05-02 00:43:40 -04:00
Anso	e5391e66cb	feat(blueprints): add Fleet > Deployments tab UI, node labels, and docs (#861) ... Implements the frontend layer for the Blueprint Model feature (backend landed in PR #860). Fleet > Deployments tab is now live for Skipper+ users; Community users see the existing locked badge. Key additions: - blueprintsApi.ts: typed apiFetch wrappers (localOnly: true on all calls) - BlueprintCatalog: featured hero, filter pills, classification-chipped tile grid - BlueprintEditor: Monaco YAML editor with debounced live classification, label/node selector, three-mode drift radio cards, create/edit modes - BlueprintDeploymentTable: per-node status rows with action buttons (Confirm deploy, Retry, Withdraw/Evict, DATA PINNED HERE for stateful) - EvictionDialog: dual-affordance (Snapshot then evict / Evict and destroy) - StateReviewDialog: fresh-deploy acceptance gate for stateful blueprints - BlueprintClassificationBanner: real-time stateless/stateful/unknown banner - DeploymentsTab: wires catalog, empty state, and create dialog - BlueprintDetail: Sheet with Apply/Edit/overflow, themed delete dialog - NodeLabelPicker + NodeLabelPill: label CRUD per node in NodeManager - FleetView: gates Deployments tab behind isPaid; mounts DeploymentsTab - NodeManager: Labels column with NodeLabelPicker (Skipper+ users) - docs/features/blueprint-model.mdx + docs.json entry + 6 screenshots	2026-05-01 19:47:05 -04:00
Anso	a25acbec7c	feat(editor): opt-in diff preview before save (#855) ... * feat(editor): add useComposeDiffPreviewEnabled hook * feat(editor): add ComposeDiffPreviewDialog component * fix(editor): replace HTML entity with Unicode arrow in ComposeDiffPreviewDialog * feat(editor): add diff preview toggle to Appearance settings Added a new 'Diff preview before save' toggle in the Display section of the Appearance settings panel. Users can now enable or disable the side-by-side diff view before compose and env file edits are saved to disk. * feat(editor): wire diff preview dialog into compose save flow * fix(editor): snapshot diff content at open time and fix event name - Fix useComposeDiffPreviewEnabled and useDeployFeedbackEnabled to use the canonical SENCHO_SETTINGS_CHANGED constant from @/lib/events instead of the hardcoded string literal (wrong value) - Snapshot language, original, modified, and fileName into diffPreview state at click time to prevent tab-switching from corrupting dialog content mid-review - Remove React.MouseEvent from diffPreview state; pass a no-op stub to deployStack in the confirm path (preventDefault/stopPropagation are no-ops on an already-settled event anyway) - Add diff-modal screenshot and document the feature in editor.mdx and settings.mdx * docs(editor): add settings-toggle screenshot for diff preview feature	2026-04-30 22:01:17 -04:00
Anso	3e01daf76f	feat(stack): per-stack activity timeline with actor attribution (#852) ... * feat(stack): per-stack activity timeline with actor attribution Adds an Activity tab to the Stack Anatomy panel showing a timestamped event log for each stack: deploys, restarts, starts, stops, and image updates, attributed to the user who triggered them or 'system' for automated actions. Backend: - Extends notification_history with actor_username column (idempotent migration) and a partial composite index on (node_id, stack_name, timestamp DESC) for efficient per-stack lookups. - NotificationService.dispatchAlert() accepts an optional actor that is written to the new column. - Success-side dispatchAlert calls added after deploy, bulkContainerOp (start/stop/restart), and update handlers in routes/stacks.ts so user-initiated operations are recorded, not just failures. - New GET /api/stacks/:stackName/activity?limit&before endpoint with stack:read permission gate and cursor-based pagination. Frontend: - StackAnatomyPanel grows an Anatomy / Activity tab pair using the existing Tabs primitive. - StackActivityTimeline fetches the initial 50 events, paginates on demand, and prepends live events arriving over the existing WS notifications stream without duplicates. - NotificationPanel bell dropdown suppresses user-initiated success events (start/stop/restart/deploy/update triggered by a real user), keeping the tray focused on alerts and system events. * docs(stack): add stack activity timeline feature page and internal arch docs * fix(test): add actor_username to notification-routing history assertions dispatchAlert now passes actor_username to addNotificationHistory after the activity timeline PR added the column. Update the two exact-match assertions that were failing because the expected object shape was missing this field.	2026-04-30 19:53:23 -04:00
sencho-quartermaster[bot]	a2d06a2ef6	docs: refresh screenshots (#843) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-29 05:54:52 +00:00
Anso	f318ec5523	docs: updates to the README and screenshots (#834)	2026-04-28 12:57:45 -04:00
sencho-quartermaster[bot]	8d3fc1bc77	docs: refresh screenshots (#832) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-28 14:33:18 +00:00
sencho-quartermaster[bot]	5d376590f8	docs: refresh screenshots (#809) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 15:06:14 +00:00
sencho-quartermaster[bot]	3f4f7c6135	docs: refresh screenshots (#805) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 13:14:15 +00:00
sencho-quartermaster[bot]	fb88ea41ed	docs: refresh screenshots (#800) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-27 04:56:43 +00:00
Anso	d7d8f9bfe8	feat(dashboard): replace 24h charts with Configuration Status and Recent Activity (#785) ... * feat(dashboard): replace 24h charts with Configuration Status and Recent Activity The 24-hour CPU/Memory area charts summed per-container metrics normalized to each container's CPU quota, producing numbers that bore no honest relationship to host load. The live ResourceGauges strip already shows accurate host-level stats, making the historical charts both inaccurate and redundant. This commit replaces that row with two side-by-side cards: - **Configuration Status**: aggregates every toggleable feature on the active node (notification agents, alert rules, routing rules, auto-heal, auto-update, webhooks, scheduled tasks, MFA, SSO, vulnerability scanning, cloud backup, and alert thresholds) into a single at-a-glance card. Tier-locked rows display an upgrade indicator instead of a value. Each row is clickable and navigates to the relevant settings section. Data refreshes every 60 s and immediately on state-invalidate events. - **Recent Activity**: lists the ten most recent notification-history events for the active node (deployments, image updates, auto-heal actions, scan findings, cloud backup events, system notices) with category icons and relative timestamps. Refreshes every 30 s. New backend endpoints: - GET /api/dashboard/configuration - per-node feature status with locked/ requiredTier markers so the frontend renders upgrade chips without extra calls. The endpoint sits after authGate and before the remote proxy so remote-node requests are transparently forwarded. - GET /api/dashboard/recent-activity?limit=N - thin wrapper over DatabaseService.getNotificationHistory. - GET /api/fleet/configuration - fleet-wide fan-out using the same Promise.allSettled dead-node-tolerant pattern as /fleet/overview. Exposed as the new "Status" tab on the Fleet page (after Snapshots). Shared utilities: - visibilityInterval and formatCount extracted to frontend/src/lib/utils.ts so the three polling hooks and two components share a single copy. * docs(dashboard): fix stale alt text referencing removed historical charts	2026-04-26 18:42:28 -04:00
Anso	03f91cd5bb	feat(cloud-backup): mirror fleet snapshots to S3-compatible storage (#782) ... * feat(cloud-backup): mirror fleet snapshots to S3-compatible storage Add an Admiral-tier Cloud Backup feature that replicates every fleet snapshot to off-site storage, with two provider modes that share the same `@aws-sdk/client-s3` code path: - Sencho Cloud Backup: zero-config, 500 MB allowance backed by Cloudflare R2, provisioned via the sencho.io worker against the user's Lemon Squeezy license. - Custom S3 (BYOB): any S3-compatible bucket (AWS, MinIO, Backblaze B2, Wasabi, R2 with own keys), with credentials encrypted via `CryptoService` before storage. API-triggered snapshots upload fire-and-forget so the UI returns immediately; scheduled snapshots block on the upload so the task's success/failure reflects cloud durability. Object keys include the instance_id segment to prevent collisions when the same Admiral license is activated on multiple Sencho instances. * fix(cloud-backup): drop ES2022-only Error cause arg breaking ES2020 build The backend tsconfig pins lib to ES2020. The two-argument `Error(message, { cause })` form requires ES2022, so tsc rejected it with TS2554. Revert to single-argument throw to match the convention used elsewhere in the backend services.	2026-04-26 15:42:21 -04:00
Anso	dd9d33813b	feat(deploy-logs): opt-in deploy progress modal with structured log rows (#779) ... * feat(notifications): dispatch deploy_failure alert on stack action errors * feat(terminal): add onReady and onMessage callback props * feat(deploy-logs): add DeployLogContext with runWithLog API * feat(deploy-logs): add DeployLogPanel bottom drawer with resize and minimize * feat(deploy-logs): wire DeployLogContext to App and EditorLayout action runners * test(deploy-logs): add E2E test for deploy log panel open, failure, and minimize * docs(deploy-logs): add user-facing and internal architecture docs * feat(deploy-logs): redesign as opt-in modal with structured log rows Replace the full-width bottom drawer (DeployLogPanel) with a centered modal that streams structured log output for deploy, stop, restart, update, install, and Git apply operations. The modal is disabled by default; users opt in from Settings -> Appearance. Core changes: - New DeployFeedbackContext with runWithLog() API: if opt-in is off, silently bypasses the UI so all call sites degrade to the existing toast behavior without code changes. - composeLogParser.ts: pure parser that strips ANSI escapes and classifies compose output into stage badges (PULL, BUILD, CREATE, START, STOP, DOWN, WARN, ERR, LOG). 15 unit tests. - StructuredLogRow.tsx: memoized row with timestamp, stage badge, and message. Error rows get a rose left rail; warn rows get a tinted bg. - DeployFeedbackModal: Dialog-based, max-w-640px/max-h-70vh, elapsed timer, auto-close 4s on success (hover cancels), persistent on failure. Raw xterm output collapsible in footer. - DeployFeedbackPill: minimized state anchored top-right, survives navigation, click restores modal. - Wires App Store install (action: install), Git apply (action: deploy), and Git pull (action: update) in addition to the existing EditorLayout actions. - Fixes Terminal.tsx WS URL in generic mode (was connecting to root path not proxied by Vite; now uses /ws). - Settings: adds "Show deploy progress modal" checkbox to Appearance. - Docs: renames deploy-logs.mdx to deploy-progress.mdx; updates internal architecture doc. * fix(deploy-logs): connect Terminal in generic mode and move pill to bottom-center Terminal was passed stackName which routes it to the stack logs WS (container stdout). In that mode onReady is never called, so the deployStarted gate never resolves and the compose command never runs. Remove stackName so Terminal uses generic WS mode, which calls onReady on open and streams compose output. Also reposition the minimized pill from top-right to bottom-center (fixed bottom-6 left-1/2 -translate-x-1/2) per UX feedback. * docs(deploy-logs): update pill position to bottom center * test(deploy-logs): rewrite E2E spec for deploy feedback modal The old spec targeted the removed bottom-drawer DeployLogPanel and used the wrong field name when calling POST /api/stacks (sent 'name' but the endpoint reads 'stackName'), causing every test to fail with a 400 before any UI assertions ran. Fixes: - POST /api/stacks body now uses 'stackName' matching the API contract - All locators updated to target the new DeployFeedbackModal and DeployFeedbackPill components (data-testid attributes added) - Added enableDeployFeedback helper to opt-in via localStorage before each test that expects the modal (feature is off by default) - Added opt-in OFF test to confirm the modal is suppressed when disabled - Minimize/expand test now asserts the pill appears and contains the stack name before clicking to restore the modal * test(deploy-logs): fix compose file write endpoint in E2E helper createStackViaApi was calling PUT /api/stacks/:name/files/docker-compose.yml which does not exist. The correct endpoint is PUT /api/stacks/:name with { content } in the body. * test(deploy-logs): use addInitScript to persist opt-in across reloads The opt-in flag was set via page.evaluate before setupDeployStack, which calls page.reload() and loginAs (a second navigation). Although localStorage should persist across same-origin reloads, the React tree was reading 'false' on remount in CI. Switching to addInitScript guarantees the localStorage value is set before any page script on every navigation, so useDeployFeedbackEnabled's useState initializer always sees the right value when React mounts. * test(deploy-logs): verify localStorage and re-dispatch event before deploy Adds syncDeployFeedbackState() called right before each deploy click in the ON tests. It both verifies localStorage is set (failing the test loudly with a clear message if not) and re-dispatches the SENCHO_SETTINGS_CHANGED event to defeat any stale React state after navigation. If the modal still does not appear with the assertion green, the issue is downstream of localStorage and we have a clear signal. * test(deploy-logs): wait for React re-render after dispatching opt-in event After syncDeployFeedbackState dispatches SENCHO_SETTINGS_CHANGED, React schedules the state update but does not flush it synchronously. The click that follows can fire against the stale closure where isEnabled is still false, so runWithLog takes its early-return path and the modal never opens. A 200ms wait is enough to let React commit the new state before the next interaction. * test(deploy-logs): wait for stack file fetch before clicking deploy deployStack() in EditorLayout returns early at 'if (!selectedFile)' without calling runWithLog. selectedFile is set inside loadFile() after GET /api/stacks/:name resolves. The previous setup clicked the stack in the sidebar and immediately asked the test to click Deploy, racing the fetch. CI backend logs confirmed no deploy POST ever fired for the ON tests, while the OFF test passed only because it asserts non-existence. Now setup awaits both the stack click and the file response together, then verifies the action bar's deploy button is visible before returning. * test(deploy-logs): wait for network idle and capture browser logs Adds a networkidle wait plus a 500ms settle after the stack click so React commits selectedFile and any follow-up env/container/backup fetches drain before the deploy click. Also mirrors browser console errors and pageerrors into the Playwright output so the next failure ships with the React stack trace instead of just a 'modal not visible' message. * test(deploy-logs): temporary debug logging in runWithLog Adds a console.log at the entry of runWithLog so we can see in CI logs whether it is being called and what isEnabled value the closure has. Also widens the test's console capture to include these debug lines. This is diagnostic only and will be removed once the root cause of the modal-not-opening-in-CI failure is identified. * test(deploy-logs): debug log at deployStack entry to trace click path Adds console.log at the first line of deployStack handler so we can confirm in CI whether the click is reaching it at all and what selectedFile/isStackBusy resolve to. Combined with the existing runWithLog debug logs, this isolates whether the modal failure is in deployStack guarding out, runWithLog early-returning, or something else entirely. * test(deploy-logs): drop filter, log every browser console msg The previous filter only emitted error/warning plus the deploy-feedback substring. The deploy-feedback debug logs never appeared, so we don't yet know whether the log itself is firing. Remove the filter so the full console stream shows up in CI. * test(deploy-logs): app-level console log to verify capture pipeline If even an unconditional log at App component render time does not appear in CI browser logs, then the console capture listener is broken or the dispatched logs are being filtered upstream of Playwright. This isolates whether the issue is in the production code or the test harness. * test(deploy-logs): use testid locator for stack action button Replaces the regex-based getByRole locator (/Deploy|Start/i) with getByTestId('stack-deploy-button'). The regex matched something other than the actual deploy button: backend logs proved no deploy POST ever fired, and instrumentation confirmed neither deployStack nor runWithLog ran on click despite the test claiming success. Adds data-testid='stack-deploy-button' to both the Restart and Start button branches in EditorLayout's action bar so the same locator works whether the stack is running or not. Also drops the temporary debug console.log entries in deployStack, runWithLog, and App, and restores the test's console listener filter to only emit error and warning messages. * test(deploy-logs): park cursor in corner so auto-close countdown fires After clicking the deploy button, the cursor lands inside the centered modal. The modal pauses its 4s auto-close countdown on hover, so the HAPPY test was waiting for a close that never happened. page.mouse.move to (0,0) parks the cursor outside the modal before the success banner appears, letting the countdown complete. * test(deploy-logs): drop redundant loginAs after page.reload page.reload preserves auth cookies, so the page lands back on the dashboard without needing a fresh login. The loginAs call after reload was racing on isLoginPage(): a transient login-page state during page load made loginAs commit to filling #username, then the dashboard committed and #username never came back. Playwright's auto-wait then hung the fill until the test's 120s timeout, which also dragged later stacks.spec tests down with collateral timeouts. waitForStacksLoaded is enough to confirm we're on the dashboard with the sidebar populated before clicking the new stack. * test(e2e): make loginAs race-safe when login page is a false positive isLoginPage() reports the page as a login screen if the Login button locator reports visible at the moment of the check. Under CI load (more real container deploys from the deploy-log-panel suite), the auth context can render the login form for one paint, then redirect to the dashboard. The original code committed to filling #username and hung until the test timeout when the field was no longer there. Now the login branch waits up to 2s for #username to actually appear before filling. If it never appears, we fall through to the dashboard check instead of hanging.	2026-04-26 00:43:54 -04:00
Anso	6986b927e3	feat(stacks): per-service start/stop/restart lifecycle actions (#778) ... * feat(stacks): add per-service start/stop/restart lifecycle routes Adds POST /:stackName/services/:serviceName/{start,stop,restart} routes that operate on containers belonging to a single Compose service, using the same Engine API pattern as the existing stack-level lifecycle routes. Includes isValidServiceName validator and audit-summary entries for the three new paths. * test(stacks): add per-service action route tests * test(stacks): fix test quality issues in service action tests * feat(stacks): add per-service lifecycle menu to container cards * fix(stacks): handle paused container state in service action menu * docs(stacks): add per-service lifecycle actions documentation * docs(stacks): add validation screenshots for per-service lifecycle actions	2026-04-25 17:26:04 -04:00
Anso	abee078741	feat(scheduler): add auto_backup, auto_stop, auto_down, auto_start and delete_after_run one-shot mode (#777) ... * feat(scheduler): add auto_backup, auto_stop, auto_down, auto_start actions and delete_after_run one-shot mode Extends the scheduler with four new stack-targeted actions: - auto_backup: backs up stack compose files and .env using the existing FileSystemService.backupStackFiles primitive - auto_stop: runs compose stop (containers preserved) - auto_down: runs compose down (containers removed) - auto_start: runs compose up -d via deployStack (universal start for both stopped and down stacks) Adds delete_after_run boolean column to scheduled_tasks. When enabled, the task self-deletes after its first successful execution; failures keep the task so the user can debug and retry. All four new actions gate at Admiral tier, consistent with restart/snapshot/prune. Migration is idempotent (maybeAddCol). * docs(scheduler): update scheduled-operations doc with new lifecycle actions and delete-after-run Adds the four new actions (Backup Stack Files, Stop Stack, Take Stack Down, Start Stack) to the action table. Documents the delete-after-run one-shot mode with its success-only deletion semantics. Adds the Stack Lifecycle Scheduling section explaining stop-vs-down semantics and the local-execution boundary. Adds three troubleshooting entries: auto-start on a missing compose folder, auto-backup single-slot overwrite by design, and one-shot task disappearing after successful run. Updates the timeline description from four to five lanes. Refreshes screenshots to show the new dialog layout with the Lifecycle lane visible.	2026-04-25 16:11:13 -04:00
Anso	58df1a50b3	feat(auto-update): show pending image updates fleet-wide on the Auto-Updates page (#770) ... Group readiness cards by node so updates pending on every reachable node are visible without having to switch the active node. Apply now targets the owning node directly, and Recheck fans out to every reachable node in parallel; per-node cooldowns are surfaced in the toast. Adds POST /image-updates/fleet/refresh and invalidates the fleet aggregation cache after auto-update execute so the next read reflects the new state immediately. A small banner appears under the hero when some online nodes did not respond within the request timeout.	2026-04-25 08:21:50 -04:00
sencho-quartermaster[bot]	866732f9ba	docs: refresh screenshots (#722) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-21 12:54:34 +00:00
Anso	12c2b37510	feat(security): polish scan sheets, fix CVE links, surface policy violations (#721) ... * feat(security): polish scan sheets, fix CVE links, surface policy violations Adds cveUrl helper that rewrites Trivy's 404-ing avd.aquasec.com links to cve.org for CVE-prefixed IDs (GHSA and misconfig URLs pass through unchanged). Redesigns both scan sheets with shadow-card-bevel chips, tracked-mono kickers, severity row tinting with a left accent rail, and tabular-nums timestamps. Surfaces a destructive policy-violation banner on scans whose policy_evaluation row flags a block, and fixes the compare sheet's delta ribbon so CRITICAL net-positive deltas render in destructive (not warning) tone. Backend parses the JSON policy_evaluation column at the API boundary so the UI receives a structured object. * chore(security): suppress CVE-2026-32281 and CVE-2026-32283 in Trivy scan Both CVEs affect Go stdlib crypto/x509 and TLS in Docker CLI 29.4.0 (Go 1.26.1) and Compose v5.1.2 (Go 1.25.8). No upstream static binary has been released with the patched Go 1.26.2 or 1.25.9 runtimes yet. Exposure analysis: the Docker CLI and compose plugin connect to the local Docker socket (Unix socket, no TLS) and to public registries with well-known CAs. Neither CVE is exploitable in this configuration. Added alongside sibling entries already in .trivyignore for the same binary versions. Revisit on next Docker CLI and Compose upstream release.	2026-04-21 08:51:35 -04:00
Anso	e4fdb1cd6c	fix(security): convert scan history from full page to sheet overlay (#720) ... Scan history is now a right-side sheet that layers over the current view (typically Resources Hub) instead of a full-page activeView branch. The sheet opens via the existing navigation event, fetches only when open, dismisses on Escape or overlay click, and preserves the nested scan-details and scan-compare sheets intact via Radix portal stacking. The fetch effect now resets selection and page state on active-node change exactly once, avoiding a double-fetch on node switches.	2026-04-21 08:01:31 -04:00
Anso	d95e154aeb	feat(fleet): interactive topology with ReactFlow hub-and-spoke layout (#713) ... Replace the static SVG fleet topology with a ReactFlow canvas laid out via dagre. Each node renders as a rack card with status pill, type badge, CPU/MEM/DISK bars, and stack/running counts. Pan, zoom, drag, and minimap are enabled; user-dragged positions persist across the 30-second poll so live metric updates no longer reset layout.	2026-04-20 16:16:02 -04:00
Anso	856de35a52	feat(search): add global Ctrl+K command palette (#711) ... * feat(search): add global command palette with cross-node stacks Press Ctrl+K from anywhere to open a search palette that jumps to pages, switches nodes, or opens stacks on any online node in the fleet. Trigger lives as an icon in the top bar. Replaces the former sidebar-scoped Ctrl+K handler. The cross-node stack search fan-out is extracted into a shared hook so the sidebar and palette stay in sync on the same debounce + abort shape. * fix(search): drop render-time ref write and effect-based query reset Replace `nodesRef.current = nodes` during render with direct use of `nodes` in the stack select callback, and fold the query-reset logic into a single `onOpenChange` handler so it no longer runs via an effect. Both changes resolve react-hooks rule violations that broke frontend lint in CI.	2026-04-20 13:57:40 -04:00
Anso	370b67d7ec	feat(sidebar): cockpit redesign with grouped stacks and activity footer (#702) ... * chore: ignore .superpowers/ brainstorm scratch dir * feat(sidebar): add useStackMenuItems hook with grouped menu model Pure transform hook that converts StackMenuCtx into four ordered MenuGroup arrays (inspect, organize, lifecycle, destructive). Shared type contract in sidebar-types.ts gives both the ContextMenu and DropdownMenu a single source of truth so they cannot drift. Covered by 8 unit tests. * refactor(sidebar): stabilize useStackMenuItems memoization deps Destructure menuVisibility flags into primitive deps so inline object literals from callers do not defeat memoization. Add a test confirming isBusy disables all lifecycle items. * feat(sidebar): add usePinnedStacks hook with per-node localStorage * refactor(sidebar): stabilize usePinnedStacks eviction signal and isPinned dep Change evictedOldest shape to { file, seq } so consumer effects re-fire on repeated evictions. Narrow isPinned's useCallback dep to the current node's pinned list so it only rebinds on local changes. Add test for eviction side-effect and a second test for the seq counter. * feat(sidebar): add useSidebarGroupCollapse hook with per-node keys * refactor(sidebar): tighten useSidebarGroupCollapse effect ordering Collapse the two write/read effects into a single skip-next-write ref pattern so switching nodes no longer writes the previous node's map under the new key before hydration. Also skip the no-op mount write. Add test for setCollapsed. * feat(sidebar): add row + group-header style helpers * feat(sidebar): add SidebarBrand with mono kicker + serif hero * feat(sidebar): add SidebarActions wrapper for create + scan * feat(sidebar): extract SidebarSearch with kbd pill * feat(sidebar): add StackRow with cyan-rail active state * refactor(sidebar): dedupe tooltip markup in StackRow, widen test coverage Extract a local RowTooltip helper so the update and git-pending branches share the CursorProvider scaffolding. Add four behavioral tests covering click, keyboard activation, kebab stop-propagation, and the busy loader branch. * feat(sidebar): unify context + kebab menus via useStackMenuItems * feat(sidebar): add StackGroup with collapse and pinned variant * feat(sidebar): add StackList with pinned + label groups * feat(sidebar): add SidebarActivityTicker with idle fallback * feat(sidebar): add StackSidebar container composing the regions * feat(sidebar): replace sidebar block with StackSidebar composition * docs(sidebar): add stack sidebar feature page with screenshots * fix(sidebar): satisfy react-hooks purity and memoization rules * fix(sidebar): restore "Sencho Logo" alt text for E2E selector	2026-04-19 21:45:01 -04:00
Anso	490c89c049	feat(ui): redesign host console as cockpit surface (#701) ... * feat(ui): redesign host console as cockpit surface Rework the Console view into the cockpit language introduced in #699. The page is now a PageMasthead strip plus a terminal well plus a floating chip strip. The masthead shows connection state (`Connected`, `Reconnecting`, `Disconnected`) with a cyan rail, a pulsing status dot while the session is live, an italic state word, and a tracked-mono kicker of `HOST CONSOLE · {node}`. The right side surfaces three metadata tiles: shell, current viewport dimensions, and session uptime. When the console was opened from a stack, a small back link sits beside the state word so operators can return to the stack editor without leaving the cockpit. The vestigial Close Console button in the header is gone. The floating chip strip replaces it with four controls that are more useful in context: Copy (current selection), Clear (scrollback), Download (full scrollback via SerializeAddon), and Reconnect (close and reopen the WebSocket in place). * docs(host-console): refresh screenshots for cockpit redesign Adds masthead and chip-strip close-up screenshots to the Host Console doc and refreshes the overview screenshot to match the new cockpit surface.	2026-04-19 17:14:25 -04:00
Anso	b95442c8f7	feat(ui): redesign global logs as cockpit surface (#699) ... Rework the Logs view into the cockpit language: a PageMasthead strip with cyan rail, pulsing live dot, italic state word, and tracked-mono kicker; a SignalRail of EVENTS/MIN (with rolling 60s sparkline), ERRORS, WARNINGS, and CONTAINERS tiles; a segmented filter strip; a day-banded feed with severity dots and whole-row tint on ERROR/WARN; and a floating glass chip strip for pause/resume, clear, and download. Decouple the live log stream from the Developer Mode toggle so SSE runs by default for everyone, with polling as an invisible fallback when EventSource is unavailable. Drop the Standard Log Polling Rate setting and the global_logs_refresh key it persisted; Developer Mode still gates Real-Time Metrics and Debug Diagnostics and nothing else. Introduces the shared PageMasthead and SignalRail primitives for reuse across other cockpit pages.	2026-04-19 16:25:54 -04:00
sencho-quartermaster[bot]	9483a09cee	docs: refresh screenshots (#698) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-19 19:06:38 +00:00
Anso	9e41d5e6b8	feat(stack-view): anatomy panel replaces always-open yaml (#690) ... * feat(stack-view): anatomy panel replaces always-open yaml Introduce StackAnatomyPanel as the default right-column surface of the stack view, replacing the always-visible Monaco YAML editor. The panel parses compose.yaml client-side and surfaces services, ports, volumes, restart policy, env file with missing-variable detection, network, and git/local source in a compact, read-only format. An inline banner surfaces pending image updates with risk classification (patch/minor/major) and an apply button gated on edit permissions. Compose editing remains one click away: the anatomy header exposes an "edit compose.yaml" toggle that slides the Monaco editor into the same right-column slot with the full tabs, Git Source, Save, and Save & Deploy toolbar. Closing the editor discards unsaved changes and restores the anatomy view. The overall stack view is now a two-column grid: left column stacks the identity header, per-container health strip, and logs viewer; right column holds the anatomy panel or the Monaco editor. Missing-variable detection covers the full compose interpolation grammar, including defaulted (:- / -) and required (:? / ?) modifiers. * fix(stack-view): restore Git Source accessible name on anatomy source row The anatomy panel's source row is the primary Git Source control on the default stack view. Without an explicit accessible name, screen readers announced only the raw git ref or 'local', and role-based locators could not target it.	2026-04-19 01:13:33 -04:00
Anso	a65a1c0e86	feat(stack-view): per-container health strip and structured logs viewer (#689) ... * feat(stack-view): per-container health strip and structured logs viewer Replaces the flat container list with a per-container health strip showing healthcheck state, uptime, port mapping with an open-app link, and live cpu/memory/network sparklines fed by a 60-sample ring buffer on the stats WebSocket. Adds a structured logs viewer that parses docker timestamps (emitted by the -t flag on the logs stream) and classifies each line by level. Rows render as a DOM grid with filter pills (all / info / warn / err with count), following indicator, and plain-text download. A segmented toggle switches between the structured viewer and the original xterm view; the choice is persisted in localStorage. * fix(stack-view): disable no-control-regex for ANSI escape pattern ANSI escape sequences start with ESC (0x1B), which is a control character. The regex is intentional and cannot be rewritten without it.	2026-04-19 00:17:51 -04:00
Anso	82aabfe64c	feat(stack-view): identity header with health state and action hierarchy (#688) ... * feat(stack-view): identity header with health state and action hierarchy Redesign the stack view header around three questions: what is this, is it healthy, what does it do. Surface Docker healthcheck state, primary image tag, and image digest; group actions by frequency. - Backend: extend /api/stacks/:name/containers with healthStatus (healthy / unhealthy / starting / none), Image, and ImageID by inspecting each container in parallel. - Frontend: replace flat CardHeader with breadcrumb, italic serif title, colored state pill with pulse, and a mono image/digest line with a one-click copy button for the full digest. - Frontend: action hierarchy - primary cyan Restart/Start, outline Stop and Update, and an overflow menu for Rollback, Scan config, and Delete. - Docs: new Stack header section and updated controlling-a-running-stack tables showing primary/secondary/overflow grouping. * test(e2e): open overflow menu to reach stack Delete action Destructive actions now live under the stack toolbar overflow menu rather than as a flat top-level button, so the delete flow must click More actions before selecting the Delete menu item.	2026-04-18 23:38:56 -04:00
sencho-quartermaster[bot]	aa1f022a64	docs: refresh screenshots (#684) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-18 22:56:28 +00:00
Anso	ad90bd9404	feat(settings): add comfortable/compact density toggle (#683) ... Adds a per-device appearance preference that compresses row, cell, and tile padding across dashboard, settings, audit log, and every shared table without changing typography or layout structure. Density is stored in localStorage and applied to the document body as a class that swaps a set of CSS variables. Components opt in by consuming the tokens, so the global table primitive scales all seven consumers at once. A new Appearance section in the Identity group lets users pick between Comfortable and Compact via a Combobox, with a helper line that reflects the current choice.	2026-04-18 18:48:58 -04:00
Anso	591dc75d1e	feat(audit-log): signal rail, day-banded stream, anomaly detection (#682) ... Add a Stream view to the Audit Log that leads with a four-tile signal rail (events, actors, failure rate with inline sparkline, peak hour) and presents the feed grouped by day with severity dots, relative times, and inline anomaly callouts. The existing Table view is preserved behind a toggle for power users. Anomaly flags are computed at read time against strictly prior history and returned on demand via ?with_anomalies=1: - unusual_hour: hour outside the actor's central 7-day window - new_ip: IP unseen for this actor in the last 30 days - first_seen_actor: no prior history in the 30-day window New /audit-log/stats endpoint returns the signal-rail aggregates over 24h/7d/30d windows; stats are derived from a single 30-day scan.	2026-04-18 18:24:27 -04:00
Anso	95278843cf	feat(schedules): next-24h timeline + merge auto-update into schedules (#681) ... * feat(backend): add stack update-preview endpoint for readiness board Adds GET /api/stacks/:stackName/update-preview that returns per-image semver diff, bump classification, and a stack-level summary powering the Auto-Update readiness board. - New UpdatePreviewService parses compose images, inspects local digests, fetches remote digests and tag lists, and finds the highest compatible semver tag. - Major bumps are flagged blocked until human review; unknown bumps rank below real semver so they cannot mask a major. - Rollback target is reconstructed through parseImageRef to preserve registry ports and drop the Docker Hub library/ prefix. - Registry helpers (httpGet, auth token, digest, tag list, ref parse) are extracted into registry-api.ts and shared with ImageUpdateService. - 28 Vitest cases cover parse, selection, bump math, digest rebuilds, blocked policy, and rollback target construction. * feat(schedules): next-24h timeline, merge auto-update crud, add readiness board Replace the flat task table with a Timeline view as the default, showing the next 24 hours of scheduled work across four lanes (Restart, Update, Scan, Prune) with a live now rail and per-firing pills. The All tasks tab preserves the existing CRUD surface. Merge Auto-update Stack into Schedules as a first-class action and replace the standalone Auto-Update Policies view with a per-stack Readiness board that surfaces version diffs, risk tags, changelog previews, and rollback targets sourced from the stack update-preview endpoint.	2026-04-18 17:48:02 -04:00
Anso	0bf061a745	feat(settings): group sections, add ⌘K search, scope breadcrumb (#680) ... * feat(settings): group sections, add ⌘K search, scope breadcrumb Restructures the Settings Hub sidebar into four labelled groups (Identity, System, Alerts, Advanced), adds a ⌘K command palette for section search, and surfaces the active scope (global vs node-scoped) in the content breadcrumb. - New `settings/registry.ts` centralises group/item metadata, tier gates, glyph assignments, visibility rules, and keyword hints consumed by both the sidebar and the command palette - Cyan 2px left rail + gradient on the active sidebar item; mono-uppercase group headers; tier chips inline for locked items - Scoped ⌘K handler via onKeyDownCapture on DialogContent so the hub no longer hijacks the global sidebar shortcut while open - ScrollArea gains an opt-in `block` prop so the Nodes management table can overflow horizontally without Radix's default `display: table` wrapper clipping action buttons - Docs reference updated with the grouped sidebar, scope breadcrumb, and ⌘K walkthrough plus refreshed screenshots * refactor(settings): drop duplicate section headers, redesign system limits, always-visible tier chips - Remove redundant section titles in every settings page; the dialog header now owns the title and description - Rework System Limits into a compact row panel with inline-edit chips (warn state, focus ring) and an ON/OFF toggle pill - Show tier chips on sidebar and command palette whether locked or unlocked, so Skipper/Admiral scope is always legible - Keep right-aligned action buttons on pages that had a title+button header (Users, Labels, Nodes, API Tokens, Registries) * fix(settings): seed NumberChip draft on edit instead of via effect ESLint rule react-hooks/set-state-in-effect flagged the sync effect that mirrored the external value into local draft state. Replace it with a startEdit handler that seeds draft from value at click time, so the button path always reads value directly and no cascading render is triggered on prop change. * fix(settings): restore heading role and clean sidebar accessible names - Wrap the settings dialog title in an h2 so screen readers and E2E locators see a heading again after the in-section headers were removed - Mark the sidebar glyph aria-hidden so the button's accessible name is just the item label (fixes anchored name matchers) - Align the MFA E2E helper with the renamed Account section heading	2026-04-18 16:17:24 -04:00
Anso	ec7620675e	feat(app-store): editorial hero, category rail, security scan signal per tile (#679) ... * feat(app-store): editorial hero, category rail, security scan signal per tile Rework the App Store view into an editorial layout with a 180px category rail, a featured-template hero, and compact tiles that surface star counts and vulnerability scan status at a glance. The deploy sheet splits into Essentials (one-click deploy) and Advanced (full port/volume/env control) tabs. Backend enriches /api/templates with scan_status, scan_cve_count, and a featured flag computed from the highest-star template with recorded stars. Scan lookups use a single batched SQL query to avoid N+1 round-trips. * fix(app-store): split firstSentence helper into its own module The firstSentence helper lived alongside the TemplateLogo component, which violates react-refresh/only-export-components — a file that exports a component must not also export non-component values, or Fast Refresh cannot establish an HMR boundary. Move the helper into appstore/util.ts and update the two import sites.	2026-04-18 12:55:50 -04:00
Anso	5f6fdfcba8	feat(resources): lead with reclaimable disk banner and per-tab landings (#678) ... Replaces the stacked bar + legend with a reclaim-first layout: an amber hero banner surfaces the total reclaimable bytes and breakdown (unused images, stopped containers, dangling volumes) with a one-click review & prune CTA; a three-tile treemap replaces the stacked bar with proportional areas for Sencho-managed, External, and Reclaimable; and the Volumes tab gets a two-card landing highlighting the largest volumes by size and recently changed ones.	2026-04-18 03:00:45 -04:00
Anso	c3b06f4b13	feat(fleet): add aggregate masthead and local-vs-remote topology (#677) ... Introduce a status masthead above the node grid summarising fleet-wide CPU, memory, container, and alert counts with a coloured rail that reflects overall health. Pin the local node at the top of the grid with a cyan accent rail and a Local badge so it is never confused with a remote. Add a Topology view toggle that plots the local node on the left with remotes radiating out, and colour-codes connector lines by link health.	2026-04-18 02:06:56 -04:00
Anso	748ba46669	feat(dashboard): status masthead, unified gauges, stack health sparklines (#676) ... * feat(dashboard): status masthead, unified gauges, stack health sparklines Rework the home dashboard around a single cyan-railed status masthead that carries the health state word, node meta, and reasons inline. The resource block collapses into one strip with a CPU hero sparkline, memory and disk gauge bars, and a network tile whose sparkline is built from per-container byte-counter deltas. Stack health becomes an 8-column mono table with row tinting, an uptime column sourced from the oldest running container's creation time, and a per-stack 10-minute CPU sparkline. Historical charts pick up a cyan gradient and an amber peak marker. A shared Sparkline primitive backs all of the above. * docs(dashboard): refresh screenshot for phase B layout * fix(dashboard): anchor sparkline bucketing to latest metric timestamp The cpuHistory, netHistory, and cpuPeakLabel memos called Date.now() inside useMemo, which violates react-hooks/purity: the rule fires because re-renders can produce different bucket boundaries from the same inputs. Derive a historyEndAt anchor from the newest metric sample in the polled series and thread it through to ResourceGauges.	2026-04-18 01:36:12 -04:00
sencho-quartermaster[bot]	1c5653a973	docs: refresh screenshots (#673) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-18 03:00:16 +00:00
sencho-quartermaster[bot]	1efa91a990	docs: refresh screenshots (#669) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-18 02:07:58 +00:00
Anso	8e7a567f69	feat: pilot agent outbound-mode for remote nodes (#667) ... * feat: pilot agent outbound-mode for remote nodes Adds a second mode for managing remote nodes: the agent dials an outbound WebSocket tunnel to the primary, so the remote host no longer needs an inbound port, a reachable URL, or its own TLS certificate. Works behind NAT, residential routers, and corporate firewalls. The primary multiplexes HTTP and WebSocket requests over a single tunnel via a hybrid JSON + binary frame protocol, bridged through a per-tunnel loopback server so existing proxy and upgrade handlers route pilot-mode nodes identically to proxy-mode ones. Enrollment uses a single-use 15-minute pilot_enroll JWT exchanged for a long-lived pilot_tunnel credential on first connect. Proxy mode continues to work unchanged and both modes are supported side-by-side. * test(e2e): switch to proxy mode before asserting api_url field Remote nodes default to Pilot Agent mode, which hides the api_url input. The SSRF-validation tests need proxy mode, so the helper now selects Distributed API Proxy after picking Remote type before asserting the field is visible. * fix(e2e): wire Combobox id prop so node-mode selector resolves The Combobox trigger button had no id, leaving its Label orphaned and making getByRole name-based lookups fail. Adding id to the primitive, passing id="node-mode" from NodeManager, and updating the E2E helper to use #node-mode fixes both the a11y regression and the CI timeout.	2026-04-17 20:31:43 -04:00
sencho-quartermaster[bot]	0a536ae653	docs: refresh screenshots (#666) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-17 18:44:56 +00:00
sencho-quartermaster[bot]	fe8abaac55	docs: refresh screenshots (#657) ... Co-authored-by: AnsoCode <18150933+AnsoCode@users.noreply.github.com>	2026-04-17 17:42:10 +00:00
Anso	29ed0524c1	feat(security): severity-aware scheduled scan notifications (#654) ... Enrich scheduled vulnerability scan completion notifications with per-severity CVE counts so recipients can triage from the message body alone. Expose the scan action in the schedule creation UI, require an explicit node_id, and harden fire-and-forget alert dispatches so a failing webhook cannot crash the scheduler. Notification body now reports scanned/skipped/failed counts plus critical/high/medium totals aggregated across fresh and cached scans, reflecting the current node posture rather than only what was newly scanned on this run.	2026-04-17 11:08:46 -04:00