* feat(stacks): persist a drift ledger with temporal source-change detection
Build on the read-only compose-vs-runtime drift check so a stack's drift is
remembered over time, not just shown at a glance.
- Record a deploy baseline: on a successful deploy, update, or rollback, store
the deployed compose file's source and rendered-model hashes on the stack so
the Drift tab can tell whether the file has changed since the last deploy.
- Surface temporal drift in the Drift tab: "matches last deploy", "source
changed since last deploy" (distinguishing a model change from a
formatting-only edit), or "no deploy baseline yet".
- Persist findings into a drift ledger: a re-check reconciles the current
findings, recording newly detected ones and resolving cleared ones, and shows
a short drift history under the findings. The drift report read stays
side-effect-free; only an explicit re-check (and a deploy) writes the ledger.
- Write drift detected/resolved events to the stack Activity timeline so the
provenance sits alongside deploys and restarts.
Node-local and available on the Community tier. Reconciliation is skipped when
a check is not authoritative (Docker unreachable or a compose parse error) so an
open finding is never falsely cleared.
* fix(stacks): record the drift baseline for every deploy path and harden the ledger
Address review feedback on the drift ledger:
- Record the deploy baseline in ComposeService.deployStack/updateStack instead of
only the manual route, so bulk, Git-source, App Store, scheduler, and webhook
deploys all capture source/rendered hashes. Reconciliation stays on the explicit
re-check.
- Store no rendered baseline when the local parser cannot model the compose (for
example a file over the parse cap) rather than a sentinel that would make a later
real change read as unchanged.
- Let temporal-overlay failures surface as a 500 instead of being hidden behind a
neutral "no baseline"; only the compose read stays best-effort.
- Omit the temporal card entirely when a report (for example from an older remote
node) carries no temporal data, instead of showing a misleading "no baseline".
- Keep drift_detected / drift_resolved history-only by excluding them from the
routable-category whitelist, so they are never offered as a channel route that
would never fire.
- Use a JSON separator for the finding identity key so the source file is plain
text (no embedded control byte).
* fix(stacks): sanitize logged errors in the drift report handlers
The drift report and re-check handlers logged the caught error object
raw alongside the stack name, which a code scan flagged as a
log-injection vector: a crafted stack name surfacing inside an error
message or stack could forge log lines. Route the error through the log
sanitizer so control characters are stripped before writing. Render it
with util.inspect first so the stack trace, cause chain, and underlying
error codes are preserved for debugging.
* feat(stacks): add compose-vs-runtime drift engine
Add a read-only engine that compares a stack's on-disk compose model
against the live Docker runtime and reports where the two diverge.
GET /api/stacks/:stackName/drift returns a per-stack report with a
status (in-sync, drifted, missing-runtime, unreachable) and typed,
service-scoped findings: a declared service with no running container,
a running container not declared in compose, an image mismatch, and a
published-port mismatch. The report is computed at request time with no
persistence and is available on every tier.
The check reuses the existing compose parser and Docker dependency
snapshot; the compose parser now also captures each service's declared
image. Boundaries fail closed: an unreadable compose file reports
drifted and an unreachable Docker daemon reports unreachable, never a
false in-sync.
* fix(stacks): keep drift hasContainers accurate on compose parse error
assembleStackDrift hardcoded hasContainers: false on the parse-error
path, contradicting the field's contract when the runtime actually has
running containers. Compute it once from the container set and reuse it
across all return paths.
Also add a route test that exercises the successful 200 path for an
existing stack on the Community tier (stubbing only the Docker boundary),
so a tier gate or handler regression after the existence check is caught.
* feat(stacks): add a drift detection tab to the stack view
Surface the compose-vs-runtime drift report on the per-stack Anatomy
panel as a read-only Drift tab. It shows the stack's status (in sync,
drifted, not running, unreachable) and, when drifted, the specific
service-scoped reasons with the declared and running values side by
side. A re-check action reruns the comparison.
The tab lives in the shared anatomy panel, so it appears on both the
desktop stack view and the mobile stack detail. Available on every tier.
* fix(stacks): sanitize the logged error in the drift report builder
The compose-read and Docker-snapshot catch blocks logged the raw error
object, whose message can embed the user-controlled stack path (e.g. an
ENOENT path). Log the error through the existing sanitizer so a crafted
stack name cannot forge log lines, matching the pattern used elsewhere
in the stacks router.
Anso