pg_create_database/user and pg_grant/revoke built superuser SQL from
raw names and passwords, unlike the MySQL helpers beside them. A quote
in a password broke CREATE USER, and the create routes ignored that
and returned credentials for a user that did not exist. Validate
identifiers and privilege lists, escape the password, and surface a
failed user as user_error instead of fake credentials.
PROTECTED_ROOTS only matched the path the user typed, so copying /opt
copied /opt/serverkit/.env (JWT key, DB creds) somewhere readable,
and deleting or moving /opt took the running panel with it. Refuse
copy, move, rename and delete when a protected root lies inside the
source, and keep symlinks as links when copying a tree.
find_or_create_user attached a new SSO identity to any user with the
same email, but Google and generic OIDC profiles never carried
email_verified. An IdP account showing an unverified copy of the
admin's address signed in as the admin. Carry the claim through and
refuse to link without it; GitHub and SAML already vouch.
Auto-provision defaulted on with role developer and no domain filter,
so enabling GitHub login for yourself let any GitHub user sign up and
open remote terminals, while password registration stayed closed.
Default to off and viewer; turning it on stays an explicit choice.
Only three routes checked can_access_server; the rest loaded the server
by id, so a developer outside a workspace could run cron, write files,
install packages or widen agent permissions on its servers, and the
list/overview/docker picker showed every server. Every <server_id>
route now resolves through the workspace check, lists filter in SQL,
and PUT /servers/<id> validates allowed_ips like PUT /allowed-ips.
A sweep test walks the URL map so a new unguarded route fails CI.
main received dev's work through squash merges, so the two branches had
diverged and VERSION conflicted on the promotion PR. The tree is dev's
unchanged; this only records main as an ancestor.
The guard only ran inside a backend pytest shard, so a citation in
SCSS or JSX surfaced minutes after the push. The pre-commit hook now
runs the same test file in --staged mode on every staged app file,
reusing its patterns and PENDING allowlist so the two cannot drift.
Agents opened PRs with --body-file on a file that began with the
title heading, so every PR description repeated its title. The title
now goes to its own .title.txt and the body file starts at the summary.
The vertical stepper rail floated between steps instead of joining the
markers, and the current step borrowed the focus ring. Radio cards
showed a radio dot beside the icon; the card already marks selection,
so the radio becomes a check badge in the corner.
FormField now hands its control the id, aria-describedby, aria-invalid
and aria-required through context, so every settings form announces
its hint and validation without per-call wiring. IconButton gets a real
tooltip instead of title=, ProgressBar is a labelled progressbar with
tones and an indeterminate state, and Button takes `loading` without
changing width.
New controls the panel lacked: NumberField, Combobox (single, multiple,
creatable), TagInput, Calendar with DatePicker and DateRangePicker,
PinInput, Slider, RadioGroup, Stepper, TreeView, and FileDropzone with
FileUploadList. Rounding, date and file-type rules live in lib/ with
unit tests. All of them render on /style-guide/controls.
* fix(security): honour the failed-login time window (#180)
check_failed_logins computed a cutoff from since_hours and never used
it, so the Security -> Events "Failed login attempts (24h)" card and
its alert counted every failure still in /var/log/auth.log or
/var/log/secure: up to a week of SSH attempts under the usual weekly
log rotation.
Each matching line is now dated from its stamp, either RFC 3339
(rsyslog's high-precision format) or the traditional BSD syslog stamp
(no year, so a December line read in January is placed in the previous
year), and lines older than the cutoff are skipped. A line whose stamp
is not recognised is still counted rather than hidden. The log paths
move to SecurityService.AUTH_LOGS so the tests can point at a temp
file.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: separate backend startup phases and guard ordering
* refactor: route file operations through capability-checked adapters
* chore: bump version to 1.11.25 [skip ci]
* refactor: split File Manager state and views with regression guards
* test: enforce core boundaries and document extension rules
* test: cover File Manager tree races and listing failures
* fix: preserve File Manager deep links on initial mount
* refactor: keep File Manager download operations in the action hook
* fix: start agent maintenance only in the guarded runtime phase
* test: capture nginx rendering contract before extraction
* refactor: separate nginx configuration rendering from host operations
* test: enforce pure nginx configuration boundaries
* fix: require provisioned runtime before advertising previews
* feat: expose value-free effective environment provenance through app access boundary
* feat: add effective environment inspector with browser regression checks
* feat: provision isolated generic previews with retryable resource cleanup
* feat: queue preview automation and preserve cleanup ownership through app deletion
* feat: add pinned preview deployment controls and queued lifecycle feedback
* fix: preserve container port semantics for previews of slot deployments
* fix: preserve search focus and ignore stale list responses
* feat: run approved assistant deployments through persistent recipe operations
* test: run search and assistant deployment regressions in CI
* fix: refresh preview API and controller boundary inventories
* docs: refresh controller migration count after preview extraction
* fix: bind file editor previews to their storage target
* chore: bump version to 1.11.26 [skip ci]
---------
Co-authored-by: Max Freedom Pollard <272618364+MaxFreedomPollard@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
check_failed_logins computed a cutoff from since_hours and never used
it, so the Security -> Events "Failed login attempts (24h)" card and
its alert counted every failure still in /var/log/auth.log or
/var/log/secure: up to a week of SSH attempts under the usual weekly
log rotation.
Each matching line is now dated from its stamp, either RFC 3339
(rsyslog's high-precision format) or the traditional BSD syslog stamp
(no year, so a December line read in January is placed in the previous
year), and lines older than the cutoff are skipped. A line whose stamp
is not recognised is still counted rather than hidden. The log paths
move to SecurityService.AUTH_LOGS so the tests can point at a temp
file.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Juan Denis