FormField now hands its control the id, aria-describedby, aria-invalid
and aria-required through context, so every settings form announces
its hint and validation without per-call wiring. IconButton gets a real
tooltip instead of title=, ProgressBar is a labelled progressbar with
tones and an indeterminate state, and Button takes `loading` without
changing width.
New controls the panel lacked: NumberField, Combobox (single, multiple,
creatable), TagInput, Calendar with DatePicker and DateRangePicker,
PinInput, Slider, RadioGroup, Stepper, TreeView, and FileDropzone with
FileUploadList. Rounding, date and file-type rules live in lib/ with
unit tests. All of them render on /style-guide/controls.
Six Radix primitives (accordion, avatar, progress, scroll-area,
separator, tooltip) and class-variance-authority are imported by no
file in the panel or any extension repo. boneyard-js stays: the
skeleton capture script keeps it on purpose as its upstream source.
Expose MFA and passkey enrollment, use shared confirmations and locale formatting, and guard pending user and invitation actions. Add Chromium regressions for both themes and failure states to frontend CI.
Plan 79 D3. Plan 76 rule 1: every row gets a ratchet before its migration
starts, or it regrows.
Counts user-visible string literals not addressed by a translation key, in
the four shapes copy actually escapes through: JSX text nodes, JSX copy
attributes, toast/confirm arguments, and copy keys in data objects. The
fourth shape is the one an extraction pass usually misses -- a label in a
data file is still copy, and if it resolves at module load it also never
re-renders on a locale switch.
Seeded at 8225 across 347 files. The plan estimated ~4088 from greps; the
AST census finds twice that, because greps miss multi-line JSX text,
template-literal segments, and data-object labels (77 in routeManifest.js
alone). Plan corrected to the measured number.
Uses espree (eslint's own parser) for JSX -- added explicitly rather than
leaned on transitively.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
js-yaml was pinned to 4.3.0 in the overrides block, so `npm audit fix`
could never reach it -- the advisory (GHSA-5p4m-2wfm-xmqj, quadratic CPU
in !!omap) sat permanently HIGH and masked anything landing behind it.
Bumping the pin to 4.3.1 keeps the deliberate supply-chain pin and clears
it. The other five were stale-lockfile problems: every fixed version
already satisfied its parent's declared range, so re-resolution was enough
and no dependency range changed.
js-yaml 4.3.0 -> 4.3.1 GHSA-5p4m-2wfm-xmqj
socket.io-parser 4.2.6 -> 4.2.7 GHSA-2m8v-j782-fhvr
react-router 7.18.1 -> 7.18.2 GHSA-qwww-vcr4-c8h2
nanoid 3.3.16 -> 3.3.18 GHSA-2v37-7h3g-55p8
brace-expansion 1.1.16 -> 1.1.18 GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
Only one of the six is reachable in a shipped panel at all: socket.io-parser
runs in the browser, though an attacker must already control or MITM the
panel's own websocket and the payoff is a hung operator tab. The react-router
CSRF bypass is RSC-mode only and this is a declarative BrowserRouter SPA with
no data router; js-yaml and brace-expansion are eslint-only; nanoid is
build-time via postcss. Hygiene, not incident response.
package.json and package-lock.json move together -- `npm ci` runs in
frontend-ci.yml and release-smoke.yml and hard-fails if they disagree.
Verified: npm audit reports 0 vulnerabilities, npm run lint passes with
0 errors, npm run build succeeds.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The exact `overrides.postcss: "8.5.16"` pin was the sole constraint
holding postcss at a vulnerable version -- vite@8.1.4 (the only
dependent) already declares `postcss: ^8.5.16`, so the override was
redundant. It also made Dependabot fail with
`security_update_not_possible`, reporting the pin back as though vite
required it.
Removing it resolves postcss to 8.5.23, above the 8.5.18 patched
floor for GHSA-r28c-9q8g-f849 (path traversal in previous-source-map
auto-loading).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add an accuracy path for skeletons: a dev-only `npm run capture:skeletons` tool
(scripts/capture-skeletons.mjs) drives a headless, logged-in dev session, measures
designated page regions into boneyard-format bones ({x,y,w,h,r}; x/w %, y/h px),
and bakes them to frontend/src/skeletons/*.json as static assets. Nothing browser-
or capture-related ships in the product.
SkeletonBoundary gains an optional `bones` prop that replays a captured layout via
a new `renderBones` mapper — SCSS-classed absolutely-positioned placeholders reusing
the shared .skeleton look (shimmer + reduced-motion). boneyard-js is added as a
devDependency for parity/format reference (never imported by shipped code). Ships a
README runbook and an example.json documenting the format.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Applies dependabot #68 (resolves the high-severity dev-server vite
advisories) and fixes the release-build break it caused.
Vite 8 bundles with rolldown, which only accepts the FUNCTION form of
`build.rollupOptions.output.manualChunks`. The existing object form
threw "manualChunks is not a function" and failed the Build release
tarball CI job. Convert the vendor grouping to the equivalent
node_modules path-matching function; unmatched modules fall through to
default chunking so shared deps (e.g. d3) still de-duplicate.
Verified: `npm run build` green, `npm audit` 0 vulnerabilities, lint 0
errors, dev server boots on vite 8.1.4, runtime-extension importmap +
vendor shims still injected into dist/index.html.
Note: the lazy TramoEditor chunk grows because rolldown groups the
non-tree-shakeable `import * as simpleIcons from 'simple-icons'` set
(via @tramo/editor) into it. Same bytes as before, still lazy-loaded on
/automations — a chunk-grouping change, not new bloat.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Clears the frontend Dependabot security alerts, minus the vite chain:
- react-router-dom ^6.22.3 -> ^7.18.1 (direct; fixes the // open-redirect,
alert #17). v7 keeps the react-router-dom API surface — lint + build green.
- overrides pin the transitive fixes: lodash 4.18.1 (prototype pollution +
_.template code injection), js-yaml 4.3.0 (merge-key DoS), postcss 8.5.16
(stringify XSS), @babel/core 7.29.7 (sourceMappingURL file read), ws 8.21.0
(memory-exhaustion DoS + uninitialized memory), engine.io-client 6.6.6.
- npm audit fix cleared the remaining non-breaking transitive alerts
(flatted, minimatch, brace-expansion, ajv).
Down from 8 to 2 npm-audit findings; the remaining two (esbuild + rollup via
vite, both dev-server-only) need the vite 5->8 major upgrade, tracked
separately as #68.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Per docs/plans/FRONTEND_UX_TAILWIND_CLEANUP_PLAN.md Phase 2. Removes the Tailwind
CSS v4 dependency entirely; the internal SCSS design system is now the single
styling source (aligns with AGENTS.md / project policy).
Build wiring:
- Remove @tailwindcss/vite plugin from vite.config.js.
- Drop tailwindcss, @tailwindcss/vite, tailwind-merge, tailwindcss-animate from
package.json (+ lockfile).
- Delete src/globals.css and its import in main.jsx. --radius was already
redefined in _theme-variables.scss (loaded after globals), so nothing breaks;
repointed the 3 var(--color-primary) refs in _wordpress-pipeline.scss to
var(--accent-primary). Font stack now resolves to IBM Plex (SCSS) — the
Inter/JetBrains globals.css vars were unused.
- lib/utils.js: cn() now uses clsx only (no tailwind-merge).
Primitives (components/ui/*) converted to SCSS-only classes (.ui-*):
- dropdown-menu.jsx, command.jsx → new .ui-dropdown-* / .ui-command-* classes.
- skeleton.jsx → .ui-skeleton; popover.jsx → .ui-popover-panel.
- dialog/alert-dialog/select/sheet → dropped the tailwindcss-animate veneer;
enter/exit animation now handled by SCSS [data-state] keyframes in _ui.scss.
- alert-dialog AlertDialogAction gained a `variant` prop so non-danger confirms
keep their primary (not destructive) button.
- Modal.jsx → .sk-modal*; ConfirmDialog.jsx → .sk-confirm* (icon containers,
colors via theme tokens, layout) — the two heaviest raw-Tailwind components.
SCSS:
- _utilities.scss: extended the existing shim with a "Tailwind-removal
compatibility" layer covering every remaining utility class still referenced
in pages/components (positioning, sizing, spacing, semantic colors mapped to
theme tokens, sr-only, the handful of sm:/lg:/hover: variants actually used).
- _ui.scss: .ui-dropdown-*, .ui-command-*, .ui-skeleton, .ui-popover-panel,
.sk-modal*, .sk-confirm*, and [data-state] enter/exit animations.
Verified:
- npm run build passes; CSS shrank ~16kB (Tailwind utility layer gone).
- Completeness audit (scratchpad script): 0 un-styled Tailwind tokens remain
(only SCSS-nested BEM false positives).
- Visual smoke test (screenshots skill, mock data): dashboard / docker / servers
render correctly with full theming.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Expose and surface containerised databases and introduce managed app base port control. Backend: add endpoint to list databases across all Docker apps, robustly resolve compose container names, include docker DB user when querying, compute migration needs from live heads and self-heal orphaned alembic_version entries by stamping to head, and add the managed_app_base_port system setting. Template service now honours the managed_app_base_port and WordPress template default HTTP port updated to 8300. Frontend: add react-icons brand icons and DatabaseBrands component, show Docker-hosted DBs under their engine nodes with a docker badge, platform-aware console shortcut label, pass DB user to docker table/query API calls, add API client header merge fix, UI for managing base port in settings, enhanced migration history UI (backup/apply/resync flows, confirm dialog, toasts), and various style tweaks and color additions.
Introduce a local-loopback pairing wizard and related installer/packaging changes.
- Add a new CLI command `setup` (agent/cmd/agent/main.go) that launches a small HTTP server and opens a browser/native window to run a pairing wizard.
- Implement the setup UI server and wizard HTML (agent/internal/setupui/*). The wizard runs a local HTTP API to start pairing, poll status, save credentials, and on Windows attempts to open a native WebView2 window (github.com/jchv/go-webview2) falling back to the system browser. After successful pairing the agent service is switched to auto-start (best-effort on Windows).
- Add platform-specific helpers: WebView2 window on Windows and no-op stubs on other OSes, plus service-start helper for Windows.
- Update go.mod/go.sum to include WebView2/winloader deps.
- MSI changes: add Start Menu shortcuts (Setup/Status), do not auto-start the service on install (start remains demand), add an Icon entry, and adjust build.ps1 to resolve the output directory to an absolute path for stable output paths. Packaged MSI outputs were added under packaging/msi/output/.
- Frontend additions: add shadcn/ui configuration, jsconfig, new globals and UI components used by the wizard (frontend/src/... and assets).
These changes provide an easier desktop pairing flow while keeping CLI pairing available for headless servers, and tweak the installer so the service isn't started before credentials exist.
Add a reusable Modal component (handles Escape key, focus trap and consistent markup) and refactor many inline modal implementations across the frontend to use it (EnvironmentVariables, LinkAppModal, QueryRunner, security tabs, GitConnectModal, ApiKeyModal, etc.). Implement React.lazy + Suspense for large pages and replace loading placeholders with a shared LoadingState; add route normalizations/redirects and tab-aware routes. Add new UI primitives (EmptyState, StatusBadge), an About settings tab, sidebar presets/appearance links and related sidebar logic, plus new styles. Also add the @rollup/rollup-win32-x64-msvc dependency to package.json.
Broad refactor and hardening across backend and frontend:
- Standardize API error responses by removing legacy `success` flags and returning concise error payloads.
- Replace inline admin decorators with centralized middleware import (admin_required) in DB and Docker APIs.
- DatabaseService: add safer MySQL execution helpers and secure user-creation flow (hex-encoding, env-pwd usage) and improve pg drop to validate identifiers.
- Models: add eager-loading (subquery) for relationships and add indexes to frequently queried columns to reduce N+1 and improve performance.
- DockerService: add structured logging and error messages for better observability when Docker commands fail.
- Config: tighten ProductionConfig cookie settings (secure, httponly, samesite).
- Frontend: migrate many .less styles to .scss, add new security UI components and API client modules, update package metadata accordingly.
- Misc: add APP_IMPROVEMENTS.md to .gitignore.
These changes improve security, reliability, observability, and frontend styling consistency.
Add backend and frontend foundations for ServerKit, including Flask API structure, SQLAlchemy models, service layers, and React app with authentication context and service hooks. Implement core API endpoints for authentication, application management, Docker, databases, and system operations. Update README with project overview, tech stack, and setup instructions. Add development roadmap and example environment configuration.
Add initial project files for a modern React dashboard template using Vite. Includes documentation, configuration, and core frontend source files with sidebar layout, routing, and sample dashboard page.
Juan Denis