Anso 3a22f59057 feat(security): surface Compose internet-reachability exposure in posture (#1442) ...

* feat(security): surface Compose internet-reachability exposure in posture

Builds a per-stack per-service exposure descriptor from the rendered
effective Compose model, cached at deploy/update time, and joins it into
the Security action posture. A service is publicly exposed when it
publishes a port on a non-loopback host IP or uses host networking.

The exposure cache lives in a new stack_exposure table, refreshed inside
ComposeService.deployStack and updateStack (covering all funneled paths:
manual, scheduler, mesh, templates, labels, App Store, Git, webhooks).
Cleanup runs on stack delete, blueprint withdrawal, and node delete.

The overview route intersects the exposed image set with the existing
per-image suppression-aware Critical/High tally, so a clean public
nginx does not escalate posture. The scan sheet shows a "Published
service" or "Internal only" evidence badge per image.

* fix(test): provide fresh auto-close proc for exposure spawn in stall tests

Two deployStack idle-stall tests used mockSpawn.mockReturnValue(proc)
which returned the same already-closed process for the new config spawn
added by the exposure refresh. The renderConfig promise hung waiting for
a close event that had already fired.

The fix uses mockImplementation to return the controlled proc for the
first spawn (up) and a fresh auto-closing proc for the second spawn
(config via refreshExposureCache).

* fix(security): tighten loopback detection, clarify exposure semantics, drop internal-only badge

- Expand isLoopback to cover full 127.0.0.0/8 range (127.0.0.2 etc)
- Clarify that exposure is configured (Compose model), not live topology
- Remove "Internal only" badge: false is not proof of non-exposure when
  other stacks using the same image may lack a cached descriptor

2026-06-24 23:22:13 -04:00

..

helpers

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

agents-routes.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

alerts-api.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

api-token-format.test.ts

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

api-token-hardening.test.ts

fix(rate-limit): key authenticated requests by verified JWT, not unverified decode (#1412)

2026-06-22 16:54:30 -04:00

api-token-ws-scope.test.ts

fix(api-tokens): harden rate limiting and surface list-load errors (#1292)

2026-06-03 08:18:16 -04:00

api-tokens.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

atomic-deploy-hardening.test.ts

feat: detect stalled stack updates and add in-app recovery actions (#1347)

2026-06-10 10:12:24 -04:00

audit-anomaly-service.test.ts

fix(audit-log): neutralize CSV export injection, clamp pagination, bound anomaly history (#1259)

2026-05-31 16:36:07 -04:00

audit-log.test.ts

test(audit-log): assert PAID_REQUIRED code on Community-blocked stats and export (#1417)

2026-06-22 20:55:32 -04:00

auth.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

authored-compose-args.test.ts

fix: base Git multi-file Compose deploy env and dossier on the effective config (#1391)

2026-06-18 18:25:58 -04:00

auto-heal-routes.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

AutoHealService.evaluate.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

AutoHealService.test.ts

feat(auto-heal): restart crashed containers and harden the heal loop (#1258)

2026-05-31 16:00:38 -04:00

binary-detection.test.ts

feat(files): per-stack file explorer (#780)

2026-04-26 13:05:19 -04:00

blueprint-analyzer.test.ts

feat(blueprints): backend foundation for fleet-wide compose templates (#860)

2026-05-01 18:57:44 -04:00

blueprints-authz.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

blueprints-edge-cases.test.ts

fix(blueprints): allow deleting blueprints stuck on awaiting-confirmation deployments (#1313)

2026-06-05 14:29:09 -04:00

blueprints-remote-deploy.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

blueprints-route-validation.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

blueprints-withdraw-route.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

blueprints.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

bulk-paths.test.ts

feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)

2026-06-22 19:33:06 -04:00

cache-endpoints.test.ts

fix(metrics): host memory usage excludes reclaimable page cache (#1297)

2026-06-03 16:11:00 -04:00

cache-service.test.ts

perf: unify caching behind a single CacheService and enable HTTP compression (#468)

2026-04-10 10:05:05 -04:00

capability-list-parity.test.ts

fix(nodes): close capability-gating gaps in node compatibility (#1261)

2026-05-31 20:28:18 -04:00

capability-registry-pilot.test.ts

fix(fleet): route remote update trigger through getProxyTarget (#1123)

2026-05-20 03:35:39 -04:00

cloud-backup-routes.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

cloud-backup-service.test.ts

feat(snapshots): preserve stack dossiers with fleet snapshots (#1339)

2026-06-08 08:44:59 -04:00

compose-dependency-parse.test.ts

fix(networking): treat host-network services as host-exposed in summaries (#1430)

2026-06-24 19:50:45 -04:00

compose-doctor-service.test.ts

fix(preflight): suppress node-state checks when the Docker snapshot is unavailable (#1423)

2026-06-24 19:48:34 -04:00

compose-images.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

compose-network-inspector.test.ts

fix(drift): stop flagging declared external networks as drift (#1402)

2026-06-21 17:58:00 -04:00

compose-service.test.ts

feat(security): surface Compose internet-reachability exposure in posture (#1442)

2026-06-24 23:22:13 -04:00

composePreview.test.ts

feat(stacks): guided first stack import flow (#1285)

2026-06-02 16:10:05 -04:00

container-lifecycle-classifier.test.ts

fix(docker-events): harden crash detection against edge cases (#591)

2026-04-14 14:37:28 -04:00

containers-route-authz.test.ts

fix(containers): guard container and port reads with stack:read (#1416)

2026-06-22 20:54:04 -04:00

convert.test.ts

feat: docker run to compose converter (#623)

2026-04-15 20:23:12 -04:00

csv.test.ts

fix(audit-log): neutralize CSV export injection, clamp pagination, bound anomaly history (#1259)

2026-05-31 16:36:07 -04:00

cve-intel-service.test.ts

feat(security): action-posture Security dashboard with exploit intel and triage (#1424)

2026-06-23 17:42:11 -04:00

dashboard-routes.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

database-cascade.test.ts

fix(scheduler): harden auto-update policies with cascade deletes, error reporting, and UI fixes (#545)

2026-04-13 09:49:11 -04:00

database-fleet-sync-cascade.test.ts

fix(fleet-sync): hygiene pass on receiver behavior and cleanup (#972)

2026-05-07 13:41:10 -04:00

database-fleet-sync-sticky.test.ts

fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

2026-05-19 19:49:16 -04:00

database-latest-vuln-scan-by-digest.test.ts

feat: pre-deploy scan visibility and pinned scanner version (#1378)

2026-06-16 00:42:33 -04:00

database-matching-policy.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-metrics.test.ts

fix(stack-activity): per-stack history integrity, attribution, sanitization (#1228)

2026-05-25 21:09:00 -04:00

database-policies-for-ui.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-policy-delete.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-replicated-policies.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-scan-cache.test.ts

feat(security): secret and misconfiguration scanning (#651)

2026-04-17 07:57:08 -04:00

database-scan-list.test.ts

feat(security): action-posture Security dashboard with exploit intel and triage (#1424)

2026-06-23 17:42:11 -04:00

database-scan-policy-risk.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-security-overview-helpers.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

database-service-pilot-mesh-stacks.test.ts

chore(mesh): drop mesh_stacks table on pilot-mode DBs (#1085)

2026-05-17 05:25:00 -04:00

DatabaseService.autoHeal.test.ts

fix: harden auto-heal policies (#1042)

2026-05-14 10:20:57 -04:00

dependency-graph-builder.test.ts

feat(fleet): add read-only dependency map tab (#1324)

2026-06-06 11:18:36 -04:00

dependency-map-aggregation.test.ts

feat(fleet): add read-only dependency map tab (#1324)

2026-06-06 11:18:36 -04:00

diagnostics-route.test.ts

feat(onboarding): add first-run environment checker (#1290)

2026-06-02 21:40:38 -04:00

diagnostics-service.test.ts

feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

2026-06-02 16:11:24 -04:00

distributed-license.test.ts

feat: give Community a 14-day in-app audit log (#1337)

2026-06-08 08:58:49 -04:00

docker-controller.test.ts

feat(sidebar): surface partial status for multi-container stacks (#1426)

2026-06-24 19:57:49 -04:00

docker-event-manager.test.ts

fix(notifications): replace polling with Docker event stream for container lifecycle detection (#588)

2026-04-14 13:47:48 -04:00

docker-event-service.test.ts

feat(auto-heal): restart crashed containers and harden the heal loop (#1258)

2026-05-31 16:00:38 -04:00

drift-detection.test.ts

fix(drift): stop flagging declared external networks as drift (#1402)

2026-06-21 17:58:00 -04:00

drift-ledger.test.ts

fix(drift): reconcile the drift ledger on deploy and timestamp its history (#1405)

2026-06-21 18:20:57 -04:00

drift-route.test.ts

feat(stacks): add compose-vs-runtime drift detection (#1329)

2026-06-07 15:48:04 -04:00

effective-anatomy-route.test.ts

fix: base Git multi-file Compose deploy env and dossier on the effective config (#1391)

2026-06-18 18:25:58 -04:00

effective-anatomy.test.ts

fix: base Git multi-file Compose deploy env and dossier on the effective config (#1391)

2026-06-18 18:25:58 -04:00

env-deploy-guard.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

env-file-resolution.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

env-inventory.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

env-var-parse.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

environment-check-service.test.ts

feat(onboarding): add first-run environment checker (#1290)

2026-06-02 21:40:38 -04:00

exec.test.ts

fix(container-exec): harden with security fixes, validation, and test coverage (#577)

2026-04-14 08:23:05 -04:00

exposure-route.test.ts

feat: Compose Network Inspector and exposure intent guard (#1360)

2026-06-12 02:15:11 -04:00

exposure.test.ts

feat(security): surface Compose internet-reachability exposure in posture (#1442)

2026-06-24 23:22:13 -04:00

failure-classifier.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00

file-explorer-metrics-route.test.ts

feat(stack-files): in-process metrics and structured mutation logs (#1216)

2026-05-25 01:46:08 -04:00

file-explorer-metrics-service.test.ts

feat(stack-files): in-process metrics and structured mutation logs (#1216)

2026-05-25 01:46:08 -04:00

file-root-gateway.test.ts

feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)

2026-06-22 19:33:06 -04:00

file-system-service-create-stack.test.ts

fix(stacks): default Empty template ships ports block commented out (#1189)

2026-05-24 01:06:22 -04:00

filesystem-backup.test.ts

feat(scheduler): consistent action targeting in Scheduled Operations (#1431)

2026-06-24 21:02:15 -04:00

filesystem-stack-paths.test.ts

feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)

2026-06-22 19:33:06 -04:00

filesystem-symlink-escape.test.ts

fix(deploy): preserve compose.override.yml when Mesh is enabled (#1420)

2026-06-23 10:44:49 -04:00

filesystem.test.ts

fix(deploy): preserve compose.override.yml when Mesh is enabled (#1420)

2026-06-23 10:44:49 -04:00

fleet-action-card-endpoints.test.ts

fix: gate fleet stop-by-label on a resolved preview and validate remote stop responses (#1392)

2026-06-18 23:29:20 -04:00

fleet-actions.test.ts

feat(fleet): cross-node bulk label assign with authoritative label discovery (#1389)

2026-06-20 11:52:28 -04:00

fleet-pilot-agent-parity.test.ts

fix(fleet): show capabilities, version, metrics, and stacks for pilot-agent nodes (#1044)

2026-05-14 10:21:08 -04:00

fleet-pilot-dispatch-parity.test.ts

fix(fleet): resolve Stop-by-label stack labels across all nodes (#1382)

2026-06-17 13:25:12 -04:00

fleet-pilot-update.test.ts

fix(nodes): close capability-gating gaps in node compatibility (#1261)

2026-05-31 20:28:18 -04:00

fleet-prune-df-timeout.test.ts

fix(monitor): decouple janitor disk-usage check from 30s cycle (F-6) (#1164)

2026-05-23 00:04:05 -04:00

fleet-prune.test.ts

feat(fleet): open Fleet Actions tab to Community (admin-only) (#1153)

2026-05-22 01:27:27 -04:00

fleet-snapshot-routes.test.ts

feat(snapshots): preserve stack dossiers with fleet snapshots (#1339)

2026-06-08 08:44:59 -04:00

fleet-sync-apply-flow.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

fleet-sync-retry-service.test.ts

feat(fleet-sync): retry failed pushes and backfill on add-node (#970)

2026-05-07 13:16:24 -04:00

fleet-sync-routes.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

fleet-sync-service.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

fleet-update-hardening.test.ts

fix(fleet): gate node update actions to admins and harden update tracking (#1272)

2026-06-01 17:27:25 -04:00

fleet-update-tracker-service.test.ts

fix(fleet): gate node update actions to admins and harden update tracking (#1272)

2026-06-01 17:27:25 -04:00

fleet.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

generic-ws-terminal.test.ts

fix(deploy-progress): decouple deploys from the live progress stream (#1246)

2026-05-28 20:51:45 -04:00

git-compose-files.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

git-source-http.test.ts

fix(git-sources): harden webhook delivery, transport errors, and clone limits (#1249)

2026-05-29 09:43:37 -04:00

git-source-routes.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

git-source-selection.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

git-source-service.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

global-logs-metrics.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

health-gate-service.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00

health.test.ts

fix(mesh): surface data-plane failures in health, meta, and Routing tab (#1088)

2026-05-17 17:31:57 -04:00

host-console-ws.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

host-console.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

hub-only-guard.test.ts

fix(fleet-secrets): restrict bundle management to admin hub sessions (#1274)

2026-06-01 19:47:06 -04:00

image-ref.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

image-update-service.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

image-updates-routes.test.ts

feat: make image-update check cadence configurable and visible (#1377)

2026-06-15 20:06:13 -04:00

import-move-route.test.ts

feat(stacks): one-click import for stray compose files (#1320)

2026-06-05 22:35:04 -04:00

import-move.test.ts

feat(stacks): one-click import for stray compose files (#1320)

2026-06-05 22:35:04 -04:00

import-scan.test.ts

feat(stacks): one-click import for stray compose files (#1320)

2026-06-05 22:35:04 -04:00

json-parser-bypass.test.ts

fix(backend): restore remote proxy mount order before local routers (#747)

2026-04-24 10:20:08 -04:00

labels-bulk-actions.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

labels-community-tier.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

labels.test.ts

fix(labels): harden stack labels with nodeId filtering, concurrency guard, and test coverage (#552)

2026-04-13 12:49:03 -04:00

license-service-id-validation.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

license-service.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

log-parsing.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

managed-containers.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

mesh-compose-override.test.ts

feat(mesh): replace host-mode with shared sencho_mesh Docker network (#1009)

2026-05-09 00:11:09 -04:00

mesh-data-plane-revalidate.test.ts

fix(mesh): re-evaluate data plane every 10s and add opt-in auto-recreate (#1184)

2026-05-23 18:09:39 -04:00

mesh-diagnostic-freshness.test.ts

fix(mesh): probe upstream synchronously in route diagnostic (F-11) (#1100)

2026-05-18 16:48:09 -04:00

mesh-diagnostic-local.test.ts

fix(mesh): probe upstream synchronously in route diagnostic (F-11) (#1100)

2026-05-18 16:48:09 -04:00

mesh-forwarder.test.ts

feat(mesh): collapse sidecar into Sencho process via in-process forwarder (#1000)

2026-05-08 15:51:39 -04:00

mesh-inspect-remote.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

mesh-list-stacks-remote.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

mesh-observability.test.ts

feat(mesh): add developer-mode diagnostics to the mesh data plane (#1287)

2026-06-02 16:12:13 -04:00

mesh-proxy-tunnel-dial.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

mesh-proxy-tunnel-dialer-no-idle-close.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-proxy-tunnel-dialer-reasons.test.ts

feat(mesh): symmetric WS dial for proxy-mode mesh peers (#1066)

2026-05-16 14:58:19 -04:00

mesh-proxy-tunnel-handler.test.ts

fix(mesh): persist proxy-tunnel self-id across bridge teardown (#1060)

2026-05-15 14:33:57 -04:00

mesh-proxy-tunnel-live.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

mesh-remove-override-remote.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

mesh-route-gating.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

mesh-service-proxy-tunnel-reconcile.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-service.test.ts

fix(mesh): auto-fallback through candidate subnets when default overlaps (#1156)

2026-05-22 13:20:27 -04:00

mesh-setup-error-classification.test.ts

fix(mesh): bias Sencho static IP via IPAM IPRange (F-13) (#1162)

2026-05-22 21:08:56 -04:00

mesh-status-resolvability.test.ts

fix(mesh): surface stopped-stack opt-ins on routing node cards (#1098)

2026-05-18 01:52:18 -04:00

mesh-status-reverse-callback.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-tcp-stream-switchboard.test.ts

fix(mesh): close data-plane race that dropped early TcpData frames (#1086)

2026-05-17 14:01:39 -04:00

metrics-routes.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

mfa.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

misconfig-ack-filter.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

misconfig-ack-routes.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

monitor-service.test.ts

fix(metrics): host memory usage excludes reclaimable page cache (#1297)

2026-06-03 16:11:00 -04:00

network-topology.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

networking-route.test.ts

feat: Compose Network Inspector and exposure intent guard (#1360)

2026-06-12 02:15:11 -04:00

networking-summary.test.ts

fix(networking): treat host-network services as host-exposed in summaries (#1430)

2026-06-24 19:50:45 -04:00

node-labels-community-tier.test.ts

feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

2026-06-08 08:58:14 -04:00

node-labels.test.ts

feat(blueprints): backend foundation for fleet-wide compose templates (#860)

2026-05-01 18:57:44 -04:00

node-management-hardening.test.ts

fix(nodes): gate node-management actions by role and release pilot tunnels on delete (#1280)

2026-06-02 09:51:42 -04:00

node-registry-fetch-meta.test.ts

fix(fleet): show capabilities, version, metrics, and stacks for pilot-agent nodes (#1044)

2026-05-14 10:21:08 -04:00

nodes-cordon-authz.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

nodes-fleet-sync-reset-anchor.test.ts

fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

2026-05-19 19:49:16 -04:00

nodes.test.ts

fix(nodes): never send stored node tokens to clients (#1281)

2026-06-02 10:26:31 -04:00

normalize-accept-encoding.test.ts

fix(http): strip zstd from Accept-Encoding so compression sets Content-Encoding (#1092)

2026-05-17 20:11:44 -04:00

notification-channels.test.ts

fix(notifications): harden alert dispatch crash-safety and redact webhook secrets in logs (#1255)

2026-05-29 21:09:57 -04:00

notification-routes-api.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

notification-routing.test.ts

fix(notifications): harden alert dispatch crash-safety and redact webhook secrets in logs (#1255)

2026-05-29 21:09:57 -04:00

pilot-agent-bootstrap-secret.test.ts

fix(pilot): generate auth_jwt_secret on pilot-agent boot (#997)

2026-05-08 11:59:02 -04:00

pilot-agent-fs-errors.test.ts

fix(pilot): stop silently swallowing fs errors in agent token helpers (#985)

2026-05-08 03:48:35 -04:00

pilot-agent-loopback-auth.test.ts

fix(pilot): inject loopback auth on agent-side HTTP/WS forwarding (#990)

2026-05-08 10:00:15 -04:00

pilot-agent-mesh-resolve.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

pilot-agent-proxy.test.ts

fix(proxy): route pilot-agent HTTP via PilotTunnelBridge loopback (#989)

2026-05-08 09:03:22 -04:00

pilot-agent-reverse-stream.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

pilot-bridge-limits.test.ts

fix(pilot): harden outbound reverse-tunnel against resource exhaustion (#979)

2026-05-07 21:28:35 -04:00

pilot-bridge-reverse.test.ts

fix(mesh): address audit follow-ups (early-data, recompose, admiral gate, error codes, docs) (#1126)

2026-05-20 12:53:29 -04:00

pilot-close-tunnel.test.ts

fix(pilot): post-merge audit followups (WS via getProxyTarget, closeTunnel lifecycle, mesh source buffer, docs) (#1128)

2026-05-21 01:00:47 -04:00

pilot-enrollment-replay.test.ts

refactor(pilot): narrow Mesh handle, prune dead code, add replay-route test (#982)

2026-05-07 23:45:16 -04:00

pilot-enrollment.test.ts

fix(pilot): let SENCHO_PUBLIC_URL override the request Host in enrollment (#1122)

2026-05-20 03:35:25 -04:00

pilot-manager-cap.test.ts

fix(pilot): harden outbound reverse-tunnel against resource exhaustion (#979)

2026-05-07 21:28:35 -04:00

pilot-metrics.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

pilot-protocol-tcp.test.ts

feat(mesh): bidirectional routing via tcp_open_reverse and central relay (#1003)

2026-05-08 16:21:34 -04:00

pilot-protocol.test.ts

feat: pilot agent outbound-mode for remote nodes (#667)

2026-04-17 20:31:43 -04:00

pilot-tunnel-bridge-reverse-route-events.test.ts

feat(mesh): symmetric WS dial for proxy-mode mesh peers (#1066)

2026-05-16 14:58:19 -04:00

pilot-tunnel-disconnect.test.ts

test(pilot): in-process simulation of mid-tunnel disconnects (#987)

2026-05-08 09:02:59 -04:00

pilot-tunnel-integration.test.ts

test(pilot): in-process integration test and Playwright E2E (#983)

2026-05-07 23:51:52 -04:00

pilot-tunnel-manager-ensure.test.ts

fix(mesh): name actual bridge kind in proxy-bridge rejection (#1075)

2026-05-17 01:16:21 -04:00

policy-enforcement.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

policy-gate-describe.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

policy-risk.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

preflight-effective-model.test.ts

feat: per-stack storage inventory and portability guardrails (#1399)

2026-06-20 15:06:26 -04:00

preflight-route.test.ts

feat: add Compose Doctor preflight checks for stacks (#1348)

2026-06-10 11:35:39 -04:00

preflight-rules.test.ts

fix(preflight): suppress node-state checks when the Docker snapshot is unavailable (#1423)

2026-06-24 19:48:34 -04:00

proxy-mount-order.test.ts

fix(sidebar): require admin role for Schedule task and debounce search input (#1243)

2026-05-28 14:16:46 -04:00

rate-limiting.test.ts

fix(api): add tiered rate limiting to prevent polling lockouts (#460)

2026-04-09 17:56:58 -04:00

recovery-cli.test.ts

feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

2026-06-02 16:11:24 -04:00

registries-tier.test.ts

feat: allow local Docker Hub, GHCR, and custom registry credentials on Community (#1338)

2026-06-08 08:59:27 -04:00

registry-service.test.ts

feat(registries): harden Private Registry Credentials feature (#597)

2026-04-14 17:58:57 -04:00

remote-console-session.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

safe-log.test.ts

fix(webhooks): address Codex review of PR #1177 (#1181)

2026-05-23 16:03:48 -04:00

sarif-exporter.test.ts

fix: harden vulnerability scan scheduling (#1035)

2026-05-13 09:40:45 -04:00

scan-compare.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

scan-policies-route.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

scheduled-action-registry.test.ts

feat(scheduler): consistent action targeting in Scheduled Operations (#1431)

2026-06-24 21:02:15 -04:00

scheduled-tasks-routes.test.ts

fix(scheduler): reject 6-field cron in Scheduled Operations (#1435)

2026-06-24 23:00:56 -04:00

scheduler-policy.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

scheduler-service.test.ts

fix(scheduler): reject 6-field cron in Scheduled Operations (#1435)

2026-06-24 23:00:56 -04:00

secret-classification.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

secrets.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

security-deploy-block-honor-suppressions-route.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

security-overview-route.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

security-pre-deploy-scan-advisory-route.test.ts

feat: pre-deploy scan visibility and pinned scanner version (#1378)

2026-06-16 00:42:33 -04:00

security-pre-deploy-summary-route.test.ts

feat: pre-deploy scan visibility and pinned scanner version (#1378)

2026-06-16 00:42:33 -04:00

security-sbom-sarif-tier.test.ts

feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

2026-06-08 08:58:14 -04:00

security-scan-node-route.test.ts

feat: add an on-demand node-wide security scan with live progress (#1367)

2026-06-12 19:07:45 -04:00

security-trivy-auto-update-route.test.ts

feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

2026-06-08 08:58:14 -04:00

securityPosture.test.ts

feat(security): action-posture Security dashboard with exploit intel and triage (#1424)

2026-06-23 17:42:11 -04:00

self-identity-service.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

self-update-data-mount.test.ts

refactor(self-update): isolate helper run-args builder and lock argv path safety (#1419)

2026-06-23 10:01:09 -04:00

settings-routes.test.ts

feat(stacks): per-stack environment inventory and secret-safe guardrails (#1397)

2026-06-20 11:58:42 -04:00

severity.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

snapshot-capture.test.ts

feat(snapshots): preserve stack dossiers with fleet snapshots (#1339)

2026-06-08 08:44:59 -04:00

spawn-error-mapping.test.ts

fix(spawn): attribute ENOMEM and ENOENT-under-memory-pressure spawn failures to host OOM (#1111)

2026-05-19 07:27:12 -04:00

sso.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

stack-actions-missing-stack.test.ts

fix(stacks): return 404 for nonexistent stacks on deploy/down/update (F-7) (#1108)

2026-05-19 00:13:57 -04:00

stack-activity-metrics.test.ts

feat(stack-activity): in-process metrics, structured diagnostic logs, docs (#1229)

2026-05-25 21:25:59 -04:00

stack-activity.test.ts

fix(notifications): prevent self-container stack routing (#1242)

2026-05-28 12:45:10 -04:00

stack-backup-route.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

stack-bulk-routes.test.ts

feat(security): gate deploys on exploitation risk, not just severity (#1432)

2026-06-24 20:05:17 -04:00

stack-compose-mtime.test.ts

fix(stacks): return a handled response when saving env to a stack with no env file (#1393)

2026-06-19 00:44:36 -04:00

stack-delete-cascades-mesh-opt-out.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

stack-docker-disconnect.test.ts

feat(stacks): structured 503 docker_unavailable envelope + disconnect tests (#1191)

2026-05-24 15:43:36 -04:00

stack-dossier-api.test.ts

feat(stacks): add Stack Dossier tab with operator notes and Markdown export (#1326)

2026-06-06 22:21:30 -04:00

stack-exposure-intent.test.ts

feat: Compose Network Inspector and exposure intent guard (#1360)

2026-06-12 02:15:11 -04:00

stack-file-roots-service.test.ts

feat(stacks): browse and edit mounted volume files in the explorer (#1403)

2026-06-21 18:16:20 -04:00

stack-files-remote-upload.test.ts

test(stack-files): pin multipart-body forwarding through the remote-node proxy (#1217)

2026-05-25 01:29:47 -04:00

stack-files-routes.test.ts

feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)

2026-06-22 19:33:06 -04:00

stack-management.test.ts

fix(stacks): harden stack management with security, validation, and logging (#520)

2026-04-12 05:43:15 -04:00

stack-metrics-route.test.ts

feat(stacks): in-process per-(nodeId, action) metrics + admin endpoint (#1196)

2026-05-24 16:07:54 -04:00

stack-op-lock-routes.test.ts

fix(stacks): serialize concurrent lifecycle operations per stack (#1182)

2026-05-24 01:12:07 -04:00

stack-op-lock-service.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

stack-op-metrics-service.test.ts

feat(stacks): in-process per-(nodeId, action) metrics + admin endpoint (#1196)

2026-05-24 16:07:54 -04:00

stack-scan-status.test.ts

feat(stacks): surface post-deploy scan attempt status (#1198)

2026-05-24 15:44:12 -04:00

stack-service-actions.test.ts

feat(stacks): per-service start/stop/restart lifecycle actions (#778)

2026-04-25 17:26:04 -04:00

stacks-create-validation.test.ts

fix(stacks): name the body field in the stack-create required error (#1289)

2026-06-02 19:53:45 -04:00

stacks-edit-hardening.test.ts

fix(editor): harden save-deploy, node-switch, delete, and stats reactivity (#1188)

2026-05-24 15:18:47 -04:00

stacks-failure-notifications.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00

stacks-from-git-skip-scan.test.ts

fix: harden vulnerability scan scheduling (#1035)

2026-05-13 09:40:45 -04:00

storage-inventory.test.ts

feat: per-stack storage inventory and portability guardrails (#1399)

2026-06-20 15:06:26 -04:00

storage-probe-host-path.test.ts

feat: per-stack storage inventory and portability guardrails (#1399)

2026-06-20 15:06:26 -04:00

storage-route.test.ts

feat: per-stack storage inventory and portability guardrails (#1399)

2026-06-20 15:06:26 -04:00

suppression-filter.test.ts

feat(security): action-posture Security dashboard with exploit intel and triage (#1424)

2026-06-23 17:42:11 -04:00

suppression-routes.test.ts

Audit-hardening pass for fleet-replicated CVE suppressions (#976)

2026-05-07 16:18:19 -04:00

system-maintenance-prune.test.ts

fix(monitor): decouple janitor disk-usage check from 30s cycle (F-6) (#1164)

2026-05-23 00:04:05 -04:00

system-maintenance-self-protect.test.ts

feat(resources): protect Sencho's own image, network, volumes from deletion (#1149)

2026-05-21 23:10:13 -04:00

template-service-registry.test.ts

fix(app-store): harden template deploy, registry fetch, and catalogue refresh (#1250)

2026-05-29 11:46:51 -04:00

template-service.test.ts

fix(app-store): harden template deploy, registry fetch, and catalogue refresh (#1250)

2026-05-29 11:46:51 -04:00

templates-deploy-rbac.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

topology-community-tier.test.ts

feat: drop stack labels and network topology to Community tier (#995)

2026-05-08 15:24:25 -04:00

trivy-installer-version.test.ts

feat: pre-deploy scan visibility and pinned scanner version (#1378)

2026-06-16 00:42:33 -04:00

trivy-scan-compose-stack.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

trivy-scan-node.test.ts

feat: add an on-demand node-wide security scan with live progress (#1367)

2026-06-12 19:07:45 -04:00

trivy-secret-misconfig.test.ts

feat(security): secret and misconfiguration scanning (#651)

2026-04-17 07:57:08 -04:00

trivy-service.test.ts

feat(security): action-posture Security dashboard with exploit intel and triage (#1424)

2026-06-23 17:42:11 -04:00

trivy-tmp-cleanup.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

update-guard-readiness.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00

update-guard-rollback.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

update-guard-routes.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00

update-guard-service.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

update-preview-service.test.ts

fix: harden deploy/update concurrency and node-targeting safety (#1390)

2026-06-18 13:38:19 -04:00

upgrade-order.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

users-rbac.test.ts

feat(pricing): collapse to two tiers (#1309)

2026-06-04 17:45:53 -04:00

validation.test.ts

feat: change default listen port from 3000 to 1852 (#756)

2026-04-24 22:23:31 -04:00

volume-browser-service.test.ts

feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)

2026-06-22 19:33:06 -04:00

vulnerability-db.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

webhooks-git-source.test.ts

feat: ordered multi-file Compose for Git sources (#1380)

2026-06-17 13:24:55 -04:00

webhooks-trigger.test.ts

feat: health-gated updates and rollback readiness (#1354)

2026-06-11 00:26:26 -04:00