Anso 4596a90474 fix(settings): serialize GET /api/settings from an allowlist (#1299) ...

The settings read returned the entire global_settings map minus a small
denylist of auth keys. Other subsystems persist their config in the same
table, so cloud backup values (endpoint, bucket, access key) were returned
to any authenticated user, including read-only roles, bypassing the
redaction the dedicated cloud-backup endpoint applies.

Project the response from the operational allowlist instead, so only the
keys the settings UI reads are returned and any key written to
global_settings by another subsystem is excluded by default. Remove the
now-unused denylist constant.

2026-06-04 01:49:03 -04:00

..

helpers

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

agents-routes.test.ts

refactor(backend): add route tests then extract settings, scheduled-tasks, agents (phase 4b) (#737)

2026-04-23 21:22:39 -04:00

alerts-api.test.ts

fix(notification-routing): harden with security fixes, validation, and test coverage (#573)

2026-04-13 22:17:03 -04:00

api-token-format.test.ts

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

api-token-hardening.test.ts

fix(api-tokens): harden rate limiting and surface list-load errors (#1292)

2026-06-03 08:18:16 -04:00

api-token-ws-scope.test.ts

fix(api-tokens): harden rate limiting and surface list-load errors (#1292)

2026-06-03 08:18:16 -04:00

api-tokens.test.ts

feat(api-tokens): make API tokens available on every tier (#1136)

2026-05-21 11:45:37 -04:00

atomic-deploy-hardening.test.ts

fix(atomic-deploy): harden rollback locking, restore fidelity, and tier gating (#1247)

2026-05-29 00:12:39 -04:00

audit-anomaly-service.test.ts

fix(audit-log): neutralize CSV export injection, clamp pagination, bound anomaly history (#1259)

2026-05-31 16:36:07 -04:00

audit-log.test.ts

fix(rbac): enforce admin seat cap on promotion and harden last-admin and audit paths (#1266)

2026-06-01 13:01:22 -04:00

auth.test.ts

fix(licensing): rename variant values to skipper/admiral and store resolved type (#379)

2026-04-05 18:45:57 -04:00

auto-heal-routes.test.ts

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

AutoHealService.evaluate.test.ts

feat(auto-heal): restart crashed containers and harden the heal loop (#1258)

2026-05-31 16:00:38 -04:00

AutoHealService.test.ts

feat(auto-heal): restart crashed containers and harden the heal loop (#1258)

2026-05-31 16:00:38 -04:00

binary-detection.test.ts

feat(files): per-stack file explorer (#780)

2026-04-26 13:05:19 -04:00

blueprint-analyzer.test.ts

feat(blueprints): backend foundation for fleet-wide compose templates (#860)

2026-05-01 18:57:44 -04:00

blueprints-authz.test.ts

fix(blueprints): gate Federation pin control on admin role (#1252)

2026-05-29 15:12:48 -04:00

blueprints-edge-cases.test.ts

fix(blueprints): gate Federation pin control on admin role (#1252)

2026-05-29 15:12:48 -04:00

blueprints-remote-deploy.test.ts

fix(blueprints): gate Federation pin control on admin role (#1252)

2026-05-29 15:12:48 -04:00

blueprints-route-validation.test.ts

fix: harden blueprint deployment guardrails (#1027)

2026-05-12 15:49:19 -04:00

blueprints-withdraw-route.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

blueprints.test.ts

fix: harden blueprint deployment guardrails (#1027)

2026-05-12 15:49:19 -04:00

cache-endpoints.test.ts

fix(metrics): host memory usage excludes reclaimable page cache (#1297)

2026-06-03 16:11:00 -04:00

cache-service.test.ts

perf: unify caching behind a single CacheService and enable HTTP compression (#468)

2026-04-10 10:05:05 -04:00

capability-list-parity.test.ts

fix(nodes): close capability-gating gaps in node compatibility (#1261)

2026-05-31 20:28:18 -04:00

capability-registry-pilot.test.ts

fix(fleet): route remote update trigger through getProxyTarget (#1123)

2026-05-20 03:35:39 -04:00

cloud-backup-routes.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

cloud-backup-service.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

compose-images.test.ts

fix: harden deploy enforcement paths (#1030)

2026-05-12 19:30:49 -04:00

compose-service.test.ts

fix(deploy-progress): decouple deploys from the live progress stream (#1246)

2026-05-28 20:51:45 -04:00

composePreview.test.ts

feat(stacks): guided first stack import flow (#1285)

2026-06-02 16:10:05 -04:00

container-lifecycle-classifier.test.ts

fix(docker-events): harden crash detection against edge cases (#591)

2026-04-14 14:37:28 -04:00

convert.test.ts

feat: docker run to compose converter (#623)

2026-04-15 20:23:12 -04:00

csv.test.ts

fix(audit-log): neutralize CSV export injection, clamp pagination, bound anomaly history (#1259)

2026-05-31 16:36:07 -04:00

dashboard-routes.test.ts

refactor(auto-update): retire per-stack gate, drive auto-update from schedules only (#1233)

2026-05-26 11:08:33 -04:00

database-cascade.test.ts

fix(scheduler): harden auto-update policies with cascade deletes, error reporting, and UI fixes (#545)

2026-04-13 09:49:11 -04:00

database-fleet-sync-cascade.test.ts

fix(fleet-sync): hygiene pass on receiver behavior and cleanup (#972)

2026-05-07 13:41:10 -04:00

database-fleet-sync-sticky.test.ts

fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

2026-05-19 19:49:16 -04:00

database-matching-policy.test.ts

fix(fleet-sync): version the wire protocol and serialize per-node pushes (#967)

2026-05-07 12:53:13 -04:00

database-metrics.test.ts

fix(stack-activity): per-stack history integrity, attribution, sanitization (#1228)

2026-05-25 21:09:00 -04:00

database-policies-for-ui.test.ts

feat(fleet-sync): hide other replicas' identity-scoped policies on a replica (#973)

2026-05-07 13:48:11 -04:00

database-policy-delete.test.ts

fix(security): clear cached policy evaluations when a scan policy is deleted (#758)

2026-04-24 22:28:25 -04:00

database-replicated-policies.test.ts

fix(fleet-sync): clear stale policy_evaluation on replica sync swap (#971)

2026-05-07 13:26:00 -04:00

database-scan-cache.test.ts

feat(security): secret and misconfiguration scanning (#651)

2026-04-17 07:57:08 -04:00

database-scan-list.test.ts

feat(security): per-image scroll + retention cap in scan history (#1231)

2026-05-25 23:44:31 -04:00

database-service-pilot-mesh-stacks.test.ts

chore(mesh): drop mesh_stacks table on pilot-mode DBs (#1085)

2026-05-17 05:25:00 -04:00

DatabaseService.autoHeal.test.ts

fix: harden auto-heal policies (#1042)

2026-05-14 10:20:57 -04:00

diagnostics-route.test.ts

feat(onboarding): add first-run environment checker (#1290)

2026-06-02 21:40:38 -04:00

diagnostics-service.test.ts

feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

2026-06-02 16:11:24 -04:00

distributed-license.test.ts

fix(licensing): rename variant values to skipper/admiral and store resolved type (#379)

2026-04-05 18:45:57 -04:00

docker-controller.test.ts

fix(resources): subtract shared layers when accounting managed prune bytes (#1155)

2026-05-22 02:40:22 -04:00

docker-event-manager.test.ts

fix(notifications): replace polling with Docker event stream for container lifecycle detection (#588)

2026-04-14 13:47:48 -04:00

docker-event-service.test.ts

feat(auto-heal): restart crashed containers and harden the heal loop (#1258)

2026-05-31 16:00:38 -04:00

environment-check-service.test.ts

feat(onboarding): add first-run environment checker (#1290)

2026-06-02 21:40:38 -04:00

exec.test.ts

fix(container-exec): harden with security fixes, validation, and test coverage (#577)

2026-04-14 08:23:05 -04:00

file-explorer-metrics-route.test.ts

feat(stack-files): in-process metrics and structured mutation logs (#1216)

2026-05-25 01:46:08 -04:00

file-explorer-metrics-service.test.ts

feat(stack-files): in-process metrics and structured mutation logs (#1216)

2026-05-25 01:46:08 -04:00

file-system-service-create-stack.test.ts

fix(stacks): default Empty template ships ports block commented out (#1189)

2026-05-24 01:06:22 -04:00

filesystem-backup.test.ts

fix(atomic-deploy): harden rollback locking, restore fidelity, and tier gating (#1247)

2026-05-29 00:12:39 -04:00

filesystem-stack-paths.test.ts

fix(stack-files): symlink-aware delete and chmod (#1214)

2026-05-25 01:30:00 -04:00

filesystem.test.ts

fix(spawn): attribute ENOMEM and ENOENT-under-memory-pressure spawn failures to host OOM (#1111)

2026-05-19 07:27:12 -04:00

fleet-action-card-endpoints.test.ts

fix(fleet-actions): stop-by-label works on Community remote nodes (#1270)

2026-06-01 14:18:44 -04:00

fleet-actions.test.ts

fix(fleet-actions): stop-by-label works on Community remote nodes (#1270)

2026-06-01 14:18:44 -04:00

fleet-pilot-agent-parity.test.ts

fix(fleet): show capabilities, version, metrics, and stacks for pilot-agent nodes (#1044)

2026-05-14 10:21:08 -04:00

fleet-pilot-dispatch-parity.test.ts

fix(fleet): route remaining fleet dispatches through getProxyTarget for pilot-agent nodes (#1152)

2026-05-22 00:30:51 -04:00

fleet-pilot-update.test.ts

fix(nodes): close capability-gating gaps in node compatibility (#1261)

2026-05-31 20:28:18 -04:00

fleet-prune-df-timeout.test.ts

fix(monitor): decouple janitor disk-usage check from 30s cycle (F-6) (#1164)

2026-05-23 00:04:05 -04:00

fleet-prune.test.ts

feat(fleet): open Fleet Actions tab to Community (admin-only) (#1153)

2026-05-22 01:27:27 -04:00

fleet-snapshot-routes.test.ts

feat(fleet-snapshots): add restore-all, per-file download, and scrollable preview (#1276)

2026-06-02 08:58:54 -04:00

fleet-sync-apply-flow.test.ts

feat(fleet-sync): gate sync-status polling on admin role (#1271)

2026-06-01 17:26:11 -04:00

fleet-sync-retry-service.test.ts

feat(fleet-sync): retry failed pushes and backfill on add-node (#970)

2026-05-07 13:16:24 -04:00

fleet-sync-routes.test.ts

Audit-hardening pass for fleet-replicated CVE suppressions (#976)

2026-05-07 16:18:19 -04:00

fleet-sync-service.test.ts

fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

2026-05-19 19:49:16 -04:00

fleet-update-hardening.test.ts

fix(fleet): gate node update actions to admins and harden update tracking (#1272)

2026-06-01 17:27:25 -04:00

fleet-update-tracker-service.test.ts

fix(fleet): gate node update actions to admins and harden update tracking (#1272)

2026-06-01 17:27:25 -04:00

fleet.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

generic-ws-terminal.test.ts

fix(deploy-progress): decouple deploys from the live progress stream (#1246)

2026-05-28 20:51:45 -04:00

git-source-http.test.ts

fix(git-sources): harden webhook delivery, transport errors, and clone limits (#1249)

2026-05-29 09:43:37 -04:00

git-source-routes.test.ts

fix(git-sources): return 200 for stacks without a Git source (#1294)

2026-06-02 22:02:49 -04:00

git-source-service.test.ts

fix(git-sources): harden webhook delivery, transport errors, and clone limits (#1249)

2026-05-29 09:43:37 -04:00

global-logs-metrics.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

health.test.ts

fix(mesh): surface data-plane failures in health, meta, and Routing tab (#1088)

2026-05-17 17:31:57 -04:00

host-console-ws.test.ts

fix(host-console): audit session lifecycle and harden path, resize, and route gating (#1263)

2026-05-31 20:29:30 -04:00

host-console.test.ts

fix(host-console): audit session lifecycle and harden path, resize, and route gating (#1263)

2026-05-31 20:29:30 -04:00

hub-only-guard.test.ts

fix(fleet-secrets): restrict bundle management to admin hub sessions (#1274)

2026-06-01 19:47:06 -04:00

image-ref.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

image-update-service.test.ts

fix(auto-update): paid-gate execute route and harden image-check watchdog (#1257)

2026-05-31 16:00:00 -04:00

image-updates-routes.test.ts

fix(auto-update): paid-gate execute route and harden image-check watchdog (#1257)

2026-05-31 16:00:00 -04:00

import-scan.test.ts

feat(stacks): guided first stack import flow (#1285)

2026-06-02 16:10:05 -04:00

json-parser-bypass.test.ts

fix(backend): restore remote proxy mount order before local routers (#747)

2026-04-24 10:20:08 -04:00

labels-bulk-actions.test.ts

feat(labels): harden Stack Labels (gate parity, abort, dry-run, cap) (#1232)

2026-05-25 23:48:12 -04:00

labels-community-tier.test.ts

feat(labels): harden Stack Labels (gate parity, abort, dry-run, cap) (#1232)

2026-05-25 23:48:12 -04:00

labels.test.ts

fix(labels): harden stack labels with nodeId filtering, concurrency guard, and test coverage (#552)

2026-04-13 12:49:03 -04:00

license-service-id-validation.test.ts

fix(license): reject activation when LS response is missing instance.id (#867)

2026-05-02 00:39:41 -04:00

license-service.test.ts

feat(license): replace local auto-trial with Lemon Squeezy hosted trial flow (#755)

2026-04-24 16:26:36 -04:00

log-parsing.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

managed-containers.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

mesh-compose-override.test.ts

feat(mesh): replace host-mode with shared sencho_mesh Docker network (#1009)

2026-05-09 00:11:09 -04:00

mesh-data-plane-revalidate.test.ts

fix(mesh): re-evaluate data plane every 10s and add opt-in auto-recreate (#1184)

2026-05-23 18:09:39 -04:00

mesh-diagnostic-freshness.test.ts

fix(mesh): probe upstream synchronously in route diagnostic (F-11) (#1100)

2026-05-18 16:48:09 -04:00

mesh-diagnostic-local.test.ts

fix(mesh): probe upstream synchronously in route diagnostic (F-11) (#1100)

2026-05-18 16:48:09 -04:00

mesh-forwarder.test.ts

feat(mesh): collapse sidecar into Sencho process via in-process forwarder (#1000)

2026-05-08 15:51:39 -04:00

mesh-inspect-remote.test.ts

fix(mesh): address audit follow-ups (early-data, recompose, admiral gate, error codes, docs) (#1126)

2026-05-20 12:53:29 -04:00

mesh-list-stacks-remote.test.ts

refactor(mesh): retarget proxyFetch null-target throw to no_target (#1083)

2026-05-17 05:06:58 -04:00

mesh-observability.test.ts

feat(mesh): add developer-mode diagnostics to the mesh data plane (#1287)

2026-06-02 16:12:13 -04:00

mesh-proxy-tunnel-dial.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

mesh-proxy-tunnel-dialer-no-idle-close.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-proxy-tunnel-dialer-reasons.test.ts

feat(mesh): symmetric WS dial for proxy-mode mesh peers (#1066)

2026-05-16 14:58:19 -04:00

mesh-proxy-tunnel-handler.test.ts

fix(mesh): persist proxy-tunnel self-id across bridge teardown (#1060)

2026-05-15 14:33:57 -04:00

mesh-proxy-tunnel-live.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

mesh-remove-override-remote.test.ts

fix(mesh): address audit follow-ups (early-data, recompose, admiral gate, error codes, docs) (#1126)

2026-05-20 12:53:29 -04:00

mesh-route-gating.test.ts

fix(mesh): hide node and stack management controls from non-admins (#1284)

2026-06-02 16:09:25 -04:00

mesh-service-proxy-tunnel-reconcile.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-service.test.ts

fix(mesh): auto-fallback through candidate subnets when default overlaps (#1156)

2026-05-22 13:20:27 -04:00

mesh-setup-error-classification.test.ts

fix(mesh): bias Sencho static IP via IPAM IPRange (F-13) (#1162)

2026-05-22 21:08:56 -04:00

mesh-status-resolvability.test.ts

fix(mesh): surface stopped-stack opt-ins on routing node cards (#1098)

2026-05-18 01:52:18 -04:00

mesh-status-reverse-callback.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

mesh-tcp-stream-switchboard.test.ts

fix(mesh): close data-plane race that dropped early TcpData frames (#1086)

2026-05-17 14:01:39 -04:00

metrics-routes.test.ts

fix(observability): gate global logs to admins, scope to managed containers, harden SSE (#1254)

2026-05-29 21:09:20 -04:00

mfa.test.ts

fix(rbac): enforce admin seat cap on promotion and harden last-admin and audit paths (#1266)

2026-06-01 13:01:22 -04:00

misconfig-ack-filter.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

misconfig-ack-routes.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

monitor-service.test.ts

fix(metrics): host memory usage excludes reclaimable page cache (#1297)

2026-06-03 16:11:00 -04:00

network-topology.test.ts

fix(network-topology): harden with edge-case fixes, logging, and test coverage (#583)

2026-04-14 10:59:11 -04:00

node-labels.test.ts

feat(blueprints): backend foundation for fleet-wide compose templates (#860)

2026-05-01 18:57:44 -04:00

node-management-hardening.test.ts

fix(nodes): gate node-management actions by role and release pilot tunnels on delete (#1280)

2026-06-02 09:51:42 -04:00

node-registry-fetch-meta.test.ts

fix(fleet): show capabilities, version, metrics, and stacks for pilot-agent nodes (#1044)

2026-05-14 10:21:08 -04:00

nodes-cordon-authz.test.ts

fix(federation): gate node cordon control on node:manage to match backend (#1277)

2026-06-02 09:48:19 -04:00

nodes-fleet-sync-reset-anchor.test.ts

fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

2026-05-19 19:49:16 -04:00

nodes.test.ts

fix(nodes): never send stored node tokens to clients (#1281)

2026-06-02 10:26:31 -04:00

normalize-accept-encoding.test.ts

fix(http): strip zstd from Accept-Encoding so compression sets Content-Encoding (#1092)

2026-05-17 20:11:44 -04:00

notification-channels.test.ts

fix(notifications): harden alert dispatch crash-safety and redact webhook secrets in logs (#1255)

2026-05-29 21:09:57 -04:00

notification-routes-api.test.ts

fix(notifications): harden alert dispatch crash-safety and redact webhook secrets in logs (#1255)

2026-05-29 21:09:57 -04:00

notification-routing.test.ts

fix(notifications): harden alert dispatch crash-safety and redact webhook secrets in logs (#1255)

2026-05-29 21:09:57 -04:00

pilot-agent-bootstrap-secret.test.ts

fix(pilot): generate auth_jwt_secret on pilot-agent boot (#997)

2026-05-08 11:59:02 -04:00

pilot-agent-fs-errors.test.ts

fix(pilot): stop silently swallowing fs errors in agent token helpers (#985)

2026-05-08 03:48:35 -04:00

pilot-agent-loopback-auth.test.ts

fix(pilot): inject loopback auth on agent-side HTTP/WS forwarding (#990)

2026-05-08 10:00:15 -04:00

pilot-agent-mesh-resolve.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

pilot-agent-proxy.test.ts

fix(proxy): route pilot-agent HTTP via PilotTunnelBridge loopback (#989)

2026-05-08 09:03:22 -04:00

pilot-agent-reverse-stream.test.ts

feat(mesh): route mesh traffic over Distributed API remotes (#1048)

2026-05-14 20:51:42 -04:00

pilot-bridge-limits.test.ts

fix(pilot): harden outbound reverse-tunnel against resource exhaustion (#979)

2026-05-07 21:28:35 -04:00

pilot-bridge-reverse.test.ts

fix(mesh): address audit follow-ups (early-data, recompose, admiral gate, error codes, docs) (#1126)

2026-05-20 12:53:29 -04:00

pilot-close-tunnel.test.ts

fix(pilot): post-merge audit followups (WS via getProxyTarget, closeTunnel lifecycle, mesh source buffer, docs) (#1128)

2026-05-21 01:00:47 -04:00

pilot-enrollment-replay.test.ts

refactor(pilot): narrow Mesh handle, prune dead code, add replay-route test (#982)

2026-05-07 23:45:16 -04:00

pilot-enrollment.test.ts

fix(pilot): let SENCHO_PUBLIC_URL override the request Host in enrollment (#1122)

2026-05-20 03:35:25 -04:00

pilot-manager-cap.test.ts

fix(pilot): harden outbound reverse-tunnel against resource exhaustion (#979)

2026-05-07 21:28:35 -04:00

pilot-metrics.test.ts

fix(mesh): route peer→central traffic over the existing forward WS (#1094)

2026-05-17 22:00:31 -04:00

pilot-protocol-tcp.test.ts

feat(mesh): bidirectional routing via tcp_open_reverse and central relay (#1003)

2026-05-08 16:21:34 -04:00

pilot-protocol.test.ts

feat: pilot agent outbound-mode for remote nodes (#667)

2026-04-17 20:31:43 -04:00

pilot-tunnel-bridge-reverse-route-events.test.ts

feat(mesh): symmetric WS dial for proxy-mode mesh peers (#1066)

2026-05-16 14:58:19 -04:00

pilot-tunnel-disconnect.test.ts

test(pilot): in-process simulation of mid-tunnel disconnects (#987)

2026-05-08 09:02:59 -04:00

pilot-tunnel-integration.test.ts

test(pilot): in-process integration test and Playwright E2E (#983)

2026-05-07 23:51:52 -04:00

pilot-tunnel-manager-ensure.test.ts

fix(mesh): name actual bridge kind in proxy-bridge rejection (#1075)

2026-05-17 01:16:21 -04:00

policy-enforcement.test.ts

feat(security): make CVE suppressions optionally honored by deploy-block policies (#1269)

2026-06-01 13:39:46 -04:00

proxy-mount-order.test.ts

fix(sidebar): require admin role for Schedule task and debounce search input (#1243)

2026-05-28 14:16:46 -04:00

rate-limiting.test.ts

fix(api): add tiered rate limiting to prevent polling lockouts (#460)

2026-04-09 17:56:58 -04:00

recovery-cli.test.ts

feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

2026-06-02 16:11:24 -04:00

registry-service.test.ts

feat(registries): harden Private Registry Credentials feature (#597)

2026-04-14 17:58:57 -04:00

remote-console-session.test.ts

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

safe-log.test.ts

fix(webhooks): address Codex review of PR #1177 (#1181)

2026-05-23 16:03:48 -04:00

sarif-exporter.test.ts

fix: harden vulnerability scan scheduling (#1035)

2026-05-13 09:40:45 -04:00

scan-compare.test.ts

feat: open security basics, manual fleet ops, and basic fleet management to Community (#930)

2026-05-05 12:54:26 -04:00

scheduled-tasks-routes.test.ts

refactor(auto-update): retire per-stack gate, drive auto-update from schedules only (#1233)

2026-05-26 11:08:33 -04:00

scheduler-policy.test.ts

feat(notifications): add structured category enum to dispatcher and history (#774)

2026-04-25 13:55:07 -04:00

scheduler-service.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

secrets.test.ts

fix(fleet-secrets): restrict bundle management to admin hub sessions (#1274)

2026-06-01 19:47:06 -04:00

security-deploy-block-honor-suppressions-route.test.ts

feat(security): make CVE suppressions optionally honored by deploy-block policies (#1269)

2026-06-01 13:39:46 -04:00

security-trivy-auto-update-route.test.ts

feat(security): move managed Trivy auto-update to Skipper tier (#1150)

2026-05-21 23:54:01 -04:00

self-identity-service.test.ts

fix(notifications): prevent self-container stack routing (#1242)

2026-05-28 12:45:10 -04:00

self-update-data-mount.test.ts

fix(self-update): resolve /app/data through bind or named volume (#1124)

2026-05-20 03:36:08 -04:00

settings-routes.test.ts

fix(settings): serialize GET /api/settings from an allowlist (#1299)

2026-06-04 01:49:03 -04:00

severity.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

snapshot-capture.test.ts

fix(fleet-snapshots): gate reads on admin role and encrypt content at rest (#1273)

2026-06-01 17:27:59 -04:00

spawn-error-mapping.test.ts

fix(spawn): attribute ENOMEM and ENOENT-under-memory-pressure spawn failures to host OOM (#1111)

2026-05-19 07:27:12 -04:00

sso.test.ts

feat(api-tokens): switch to sen_sk_ prefixed opaque keys (#1062)

2026-05-15 18:21:28 -04:00

stack-actions-missing-stack.test.ts

fix(stacks): return 404 for nonexistent stacks on deploy/down/update (F-7) (#1108)

2026-05-19 00:13:57 -04:00

stack-activity-metrics.test.ts

feat(stack-activity): in-process metrics, structured diagnostic logs, docs (#1229)

2026-05-25 21:25:59 -04:00

stack-activity.test.ts

fix(notifications): prevent self-container stack routing (#1242)

2026-05-28 12:45:10 -04:00

stack-backup-route.test.ts

fix(scheduled-ops): run stack lifecycle schedules on remote nodes and harden run visibility (#1260)

2026-05-31 17:47:34 -04:00

stack-bulk-routes.test.ts

feat(stacks): server-side POST /api/stacks/bulk endpoint (#1185)

2026-05-24 15:56:53 -04:00

stack-compose-mtime.test.ts

feat(stacks): optimistic concurrency on compose and env file writes (#1183)

2026-05-24 15:48:17 -04:00

stack-delete-cascades-mesh-opt-out.test.ts

fix(mesh): cascade opt-out when a stack is deleted (F-1 / F-14) (#1096)

2026-05-18 00:14:10 -04:00

stack-docker-disconnect.test.ts

feat(stacks): structured 503 docker_unavailable envelope + disconnect tests (#1191)

2026-05-24 15:43:36 -04:00

stack-files-remote-upload.test.ts

test(stack-files): pin multipart-body forwarding through the remote-node proxy (#1217)

2026-05-25 01:29:47 -04:00

stack-files-routes.test.ts

test(stacks): drain pending download-metric records between tests (#1293)

2026-06-02 21:54:01 -04:00

stack-management.test.ts

fix(stacks): harden stack management with security, validation, and logging (#520)

2026-04-12 05:43:15 -04:00

stack-metrics-route.test.ts

feat(stacks): in-process per-(nodeId, action) metrics + admin endpoint (#1196)

2026-05-24 16:07:54 -04:00

stack-op-lock-routes.test.ts

fix(stacks): serialize concurrent lifecycle operations per stack (#1182)

2026-05-24 01:12:07 -04:00

stack-op-lock-service.test.ts

fix(stacks): serialize concurrent lifecycle operations per stack (#1182)

2026-05-24 01:12:07 -04:00

stack-op-metrics-service.test.ts

feat(stacks): in-process per-(nodeId, action) metrics + admin endpoint (#1196)

2026-05-24 16:07:54 -04:00

stack-scan-status.test.ts

feat(stacks): surface post-deploy scan attempt status (#1198)

2026-05-24 15:44:12 -04:00

stack-service-actions.test.ts

feat(stacks): per-service start/stop/restart lifecycle actions (#778)

2026-04-25 17:26:04 -04:00

stacks-create-validation.test.ts

fix(stacks): name the body field in the stack-create required error (#1289)

2026-06-02 19:53:45 -04:00

stacks-edit-hardening.test.ts

fix(editor): harden save-deploy, node-switch, delete, and stats reactivity (#1188)

2026-05-24 15:18:47 -04:00

stacks-failure-notifications.test.ts

fix(stack-activity): per-stack history integrity, attribution, sanitization (#1228)

2026-05-25 21:09:00 -04:00

stacks-from-git-skip-scan.test.ts

fix: harden vulnerability scan scheduling (#1035)

2026-05-13 09:40:45 -04:00

suppression-filter.test.ts

Audit-hardening pass for fleet-replicated CVE suppressions (#976)

2026-05-07 16:18:19 -04:00

suppression-routes.test.ts

Audit-hardening pass for fleet-replicated CVE suppressions (#976)

2026-05-07 16:18:19 -04:00

system-maintenance-prune.test.ts

fix(monitor): decouple janitor disk-usage check from 30s cycle (F-6) (#1164)

2026-05-23 00:04:05 -04:00

system-maintenance-self-protect.test.ts

feat(resources): protect Sencho's own image, network, volumes from deletion (#1149)

2026-05-21 23:10:13 -04:00

template-service-registry.test.ts

fix(app-store): harden template deploy, registry fetch, and catalogue refresh (#1250)

2026-05-29 11:46:51 -04:00

template-service.test.ts

fix(app-store): harden template deploy, registry fetch, and catalogue refresh (#1250)

2026-05-29 11:46:51 -04:00

templates-deploy-rbac.test.ts

fix(templates): align App Store deploy gate with stack:create permission (#986)

2026-05-08 03:50:03 -04:00

topology-community-tier.test.ts

feat: drop stack labels and network topology to Community tier (#995)

2026-05-08 15:24:25 -04:00

trivy-scan-compose-stack.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

trivy-secret-misconfig.test.ts

feat(security): secret and misconfiguration scanning (#651)

2026-04-17 07:57:08 -04:00

trivy-service.test.ts

fix(nodes): close capability-gating gaps in node compatibility (#1261)

2026-05-31 20:28:18 -04:00

trivy-tmp-cleanup.test.ts

Audit-hardening pass for secret and misconfiguration scanning (#977)

2026-05-07 19:23:11 -04:00

update-preview-service.test.ts

fix(auto-update): label same-tag rebuilds as 'Rebuild available' instead of '10.11 -> 10.11' (#766)

2026-04-24 23:37:32 -04:00

upgrade-order.test.ts

fix(pilot): post-merge audit followups (WS via getProxyTarget, closeTunnel lifecycle, mesh source buffer, docs) (#1128)

2026-05-21 01:00:47 -04:00

users-rbac.test.ts

fix(rbac): enforce admin seat cap on promotion and harden last-admin and audit paths (#1266)

2026-06-01 13:01:22 -04:00

validation.test.ts

feat: change default listen port from 3000 to 1852 (#756)

2026-04-24 22:23:31 -04:00

volume-browser-service.test.ts

feat(volumes): add read-only volume browser (#926)

2026-05-05 00:09:40 -04:00

vulnerability-db.test.ts

fix(security): harden Trivy scan lifecycle, logging, and docs (#639)

2026-04-16 20:32:38 -04:00

webhooks-git-source.test.ts

fix(git-sources): harden webhook delivery, transport errors, and clone limits (#1249)

2026-05-29 09:43:37 -04:00

webhooks-trigger.test.ts

fix(webhooks): address Codex review of PR #1177 (#1181)

2026-05-23 16:03:48 -04:00