Mirror the Mapanare release pattern for the ServerKit panel:
- Trigger release on push to main (PR merge), v* tags, and workflow_dispatch
- Add workflow_call to backend-ci.yml so release can use it as a CI gate
- Read VERSION file, create/push v{VERSION} tag when releasing from main
- Build and push multi-arch Docker image jhd3197/serverkit:{VERSION} + latest
- Create GitHub Release with Docker install instructions
The Go agent has moved to its own repository:
https://github.com/jhd3197/serverkit-agent
Changes:
- Delete agent/ directory and all source, build, and packaging files
- Delete .github/workflows/agent-ci.yml and agent-release.yml
- Delete scripts/test/agent-test.ps1 (agent now builds in separate repo)
- Remove committed dist/serverkit-agent-windows-amd64.exe build artifact
- Update docs/INSTALLATION.md and docs/README.md links to point to the new repo
- Add migration notes to docs/AGENT_AUDIT.md, docs/REMOTE_ACCESS_ROADMAP.md,
SECURITY_AUDIT.md, and docs/plans/AGENT_FLEET_PHASES_3-4.md
Panel agent API endpoints under /api/v1/servers/agent/ and /api/v1/agent/
are retained — they are the control-plane contract with the standalone agent.
Verified:
- backend: pytest (371 passed, 12 skipped)
- frontend: npm run lint (0 errors)
Sidebar — leaner default + setup wiring:
- Add a "Recommended" preset (Full minus Marketplace, Queue Bus, and
Secrets & Webhooks) and make it the default for unconfigured users, so
fresh installs aren't maximalist. The three demoted items stay fully
routable and one click away via the "Full" view or Customize Sidebar.
- Factor the three into a shared ADVANCED_ITEM_IDS list so every curated
preset hides them consistently.
- Wire the Setup wizard's use-case answer to an initial preset
(presetForUseCases): a single WordPress intent -> Web Hosting, a single
DevOps intent -> Docker/DevOps, anything mixed/general -> Recommended.
Settings — split the 17-item rail:
- Add a two-way "My Account" / "Admin" segmented switch (admin-only) so
personal preferences aren't interleaved with server-wide system
controls. The active group is derived from the tab, so deep links
(e.g. /settings/users) open the right group. About moves into My
Account; the dev/local-dev tools consolidate under Admin.
Verified: eslint (0 errors) and vite build both pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Expose Remote Access as a per-server tab and adapt the fleet page for server-scoped views. RemoteAccess now accepts serverId, filters/labels tunnels involving that server, renders inline action button when embedded, disables private-server select for scoped views, and links nodes to per-server Remote Access pages from fleet view. Added tab to ServerDetail when wireguard is supported and updated styles for responsive intro, node links, and a “this server” tag. Small refactors: useMemo/useCallback optimizations and cleaner topbar action handling.
- TargetPicker now renders a static label when only one target option is available,
removing the pointless/disabled dropdown on single-server setups.
- Change Terminal tab route from /terminal/terminal to /terminal/shell and add
a redirect for the old URL.
- Terminal shell tab only lists agents advertising terminal capability, preventing
'Agent not connected' errors on local/WSL dev installs.
- Add per-server creation guard in RemoteTerminal to avoid duplicate session
attempts on remounts or rapid server switches.
Drop the stray /docs/screenshots ignore that overrode the existing negation (.gitignore:117-118), so the 23 mock-data README screenshots are committed assets again, and add the freshly regenerated set (ServiceDetail header selector updated in the local capture skill).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add app/utils/formatting.py with format_bytes() and delegate 9 duplicated
human-readable byte formatters across services.
- Import admin_required from app.middleware.rbac in 15 API modules instead of
redefining it locally.
- Extend app/utils/slug.py with validate_app_name() and use it for template
install/validation and apps slug normalization.
Add a POST /security/clamav/start endpoint and SecurityService.start_clamav() to enable+start the ClamAV daemon (tries clamav-daemon and clamd). Add unit tests that mock ServiceControl to verify success/failure and auth. Wire a startClamAV API call into the frontend and extend the Security Overview: richer posture UI, one-click fixes (install, start service, init integrity, update defs), KPIs, icons, and accessibility improvements. Update related styles and file-manager minor styles. This improves operator workflows by allowing a one-click "Start service" posture fix and provides immediate UI feedback when fixes run.
- Standardize toast usage in AgentFleet and FleetMonitor (toast.success/error/info)
- Replace inline full-page spinners with PageLoader in CloudProvision, DNSZones, DynamicDns, Marketplace, ServerTemplates, StatusPages
- Migrate Servers and Domains tables to DataTable
- Migrate DynamicDns create form to FormField
- Adopt SearchFilterBar in Applications
- Adopt CopyButton in DynamicDns token callout
- Replace raw buttons with Button in Servers, Terminal, Docker
- Move Domains error-banner close button inline styles to SCSS class
- New ErrorState, SearchFilterBar, CopyButton utility components
- Add ESLint rules warning on inline styles, raw <button>, and legacy .card divs
- New useOverflowItems hook for tab overflow menus
- Refactor ui/tabs and ds/PageTopbar to share overflow logic
- New PageLoader component for full-page loading states
- New DataTable component with sorting, empty/loading states, custom rows
- New ResourceCard / ResourceList for servers/apps/domains/containers
- New FormField / FormRow wrappers for consistent forms
- New IconButton wrapper for accessible icon-only actions
- Add supporting styles in _design-system.scss and _forms.scss
Bring the Service detail page to parity with the WordPress detail page:
- Routes: add services/:id/:tab and services/:id/:tab/:section so the active
tab and the Settings sub-section live in the URL (shareable, survive refresh).
ServiceDetail drives its tab via useTabParam; SettingsTab reads/writes the
section via useParams + navigate.
- Repository: the Settings -> Repository section now renders the shared
RepoConnectForm (the same component the WordPress Git settings use) instead
of the bespoke GitConnectModal — provider picker (GitHub/GitLab/Bitbucket/
Gitea) with URL fallback and a connected summary + Disconnect. Existing
deploy scripts are preserved on connect. The top 'connect a repository' pill
now navigates to .../settings/repository, and GitConnectModal is removed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A flex <button> keeps its shrink-to-fit intrinsic width, so each settings
nav item's box was sized to its label (e.g. the active 'Git' box only as wide
as the word) instead of the 200px column. Add width:100% (box-sizing is
border-box) so every item's box is the same full width, text still left-aligned.
Applies to both the WordPress (.wp-settings__navitem) and Service
(.svc-settings__navitem) detail settings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds source-connection support for browsing repositories on GitLab, Gitea, and
Bitbucket (new *RepoPicker components) plus a PathSelector, wired through
RepoConnectForm / GitProviders / ConnectionsHub / providerCatalog and the
sourceConnections + files APIs, backed by additions to the source_connections
API and service.
Bundled from in-progress work in a concurrent session at the user's request.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Restructure the service Settings tab from a flat stack into a grouped left
sub-nav + content pane (.svc-settings grid), mirroring the WordPress detail
page: General -> Environment, Connections -> Repository, Advanced -> Danger
Zone, each with an icon. Section is local state; the existing panels are
unchanged, only reorganized.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The empty-state used text-align:center, but svgs are display:block (Tailwind
preflight) so the clock glyph left-aligned while the text centered. Flex-center
the container so the icon and text share the same axis.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Give each Service detail tab a lucide glyph (TAB_ICONS) and pin the Settings
tab to the right of the strip via app-detail-tab--end, matching the WordPress
detail tab bar. The strip wraps (flex-wrap + overflow-x:visible) so the
right-pinned Settings tab can never get pushed off-screen.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reuse the WordPress detail page's shell so /services/:id matches /wordpress/🆔
a full-bleed PageTopbar (.sk-topbar) with the breadcrumb in the title slot and
the Deploy/Restart/more actions on the right, above a centered .app-detail-body
holding a flat .app-detail-header (ServiceTile + name + status Pill + type
badge + mono subtitle), the repo-connection pill, the versions panel, the
shared .app-detail-tabs underline strip, and .app-detail-content.
Drops the bespoke .svc-detail__{breadcrumb,header,title-row,tabs,content}
chrome in favour of the shared app-detail-* base classes, and runs the page
full-bleed via .main-content:has(.svc-detail).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace per-page Tabs with a shared PageTopbar tab group that supports overflow and a "More" popover. Adds BACKUP_TABS and SECURITY_TABS components and updates Backups, Security and Git pages to render sections via the topbar tabs (useTabParam routing). Implements responsive/overflow measurement logic in PageTopbar (TopbarTabs) and related styles; removes old page-local tab styles and shadcn Tabs usage. Improves header UX so active tab stays visible when space is limited.
- Redesign QueueOperations to match the Servers page layout:
left overview/status rail, main workbar + command bar + queue table
- Replace tabbed UI with a single queues table filtered by group/status/search
- Add per-queue Send and Messages actions; send is now a clear modal
pre-filled with the destination group and queue
- Fix confusing send flow that made it look like messages couldn't be sent
- Message detail and create group/queue modals preserved
- Frontend production build passes; backend tests pass
- Extend app.utils.slug with unique_slug(default=...) and validate_slug helpers
- Migrate workspace, secret-vault, webhook-gateway, site-domain, upload,
environment-domain, environment-pipeline, marketplace, and status-page
services to use the shared helpers
- Removes ~8 duplicate _slugify/_unique_slug implementations
- Marketplace create_extension now resolves duplicate slugs instead of raising
- Backend tests and frontend production build pass
The repo-connect provider strip was a static "explainer" — clicking GitLab/
Bitbucket/Gitea did nothing, and the GitHub picker showed regardless, which
read as confusing. Now (when a host form passes onSelect) the chips are radio
buttons that drive the connect method: GitHub shows the one-click picker;
every other provider shows the paste-a-URL field with that host's placeholder
(gitlab.com / bitbucket.org / gitea / scp-style ssh). A recognized URL still
auto-selects its provider. GIT_PROVIDERS gained `oauth` + `placeholder`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Overview: group cards are fully clickable and navigate to Messages
- Overview: add 'system' badge for system-owned groups
- Groups: add per-row 'Create Queue' action and clearer 'View Queues' label
- Messages: remove out-of-place 'Create Queue' button; keep Send Message only
- Create Queue modal: include group selector
- Add pluggable queue bus with SQLAlchemy backend (Redis-ready interface)
- Models: QueueGroup, Queue, QueueMessage with retries, visibility timeout,
delayed delivery, priority ordering, and dead-letter handling
- REST API at /api/v1/queue for groups, queues, messages, and stats
- Plugin SDK: from app.plugins_sdk import queue
- Operations UI page with group/queue/message management and send-message form
- Migrate webhook deliveries from raw threading.Thread to the queue bus
- Add webhook consumer with retry/dead-letter support
- Migration 022_queue_bus and backend tests
Add a shared GithubRepoPicker that lists the user's repositories from the
GitHub source-connection OAuth that already powers /services/new (no new
backend), and render it above the paste-a-URL fields in RepoConnectForm.
Picking a repo fills the clone URL + default branch, so linking a repo to a
WordPress site — and any future RepoConnectForm surface — becomes "authorize
once, pick a repo" instead of pasting a URL. Falls back gracefully to the URL
form when GitHub isn't configured/connected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update .gitignore to allow committed screenshot assets under docs/screenshots/ (these are generated mock-data README images and should be tracked). Fix a bug in frontend/src/pages/ServiceDetail.jsx: avoid referencing isUpload from outer scope (temporal dead zone) by deriving it inside the useEffect, and replace the effect dependency with service?.source so the effect runs correctly when the service source changes. This prevents a render-time crash and ensures versions are loaded for uploaded services.
- Extract the repo-connect form into components/git/RepoConnectForm.jsx
(provider strip + URL/branch/auto-deploy + optional tracked paths +
connected state) — the canonical reusable surface. components/wordpress/
GitConnectForm.jsx is now a thin WordPress-flavored wrapper over it, so
WordPress renders identically and other pages can drop the shared form in.
- Make the WordPress commit log clickable: each SHA links to the commit on
the remote (GitHub/GitLab /commit, Bitbucket /commits; https + scp-ssh).
- Fix off-center icon tiles on /services/new (grid + place-items + block svg
instead of inline-flex).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rework /wordpress/:id to match the new prototype and stay consistent with
the rest of the app:
- Top bar is the canonical PageTopbar (.sk-topbar) — same chrome as the
WordPress list page; breadcrumb in the title slot, trimmed actions
(Open Files, Open Database, View Logs, Dashboard, Auto Login).
- Identity row: no card background + empty-circle icon (per the prototype),
in a CENTERED max-width body while the top bar stays full-bleed
(.main-content:has(.wp-detail-page){padding:0}, normal scroll kept).
- Overview leads with a non-redundant KPI row (uptime / visitors / error
rate / disk), consolidated Site information, a Traffic chart, and a
Recent-activity feed; redundant panels dropped (killed the version-3x).
- Settings: grouped, URL-routed left nav (/wordpress/:id/settings/:section,
shareable + refresh-safe) — General (Add Domain / Change URL / Clone),
Configuration (PHP, Updates), Connections (Git), Security (Security,
Vulnerabilities), Reports; those tabs left the top strip.
- Fix a wasted right column: .app-overview-grid collapses to one column
when it has no .app-overview-right.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remote Access was a standalone Infrastructure sidebar item, but it's
fundamentally agent-to-agent WireGuard pairing, so move it into the
Servers tab group (mirrors the Dynamic-DNS-into-Domains consolidation).
The /remote-access route now lives under the Servers TabGroupLayout and
the Servers sidebar item stays lit via matchPrefixes; the URL is
unchanged so existing links still work.
Rebuild the page body: the "Expose a Local Service" action rides the
shared PageTopbar via useTopbarActions, and the shadcn Card/Badge markup
is replaced with page-local .ra-* SCSS (styles/pages/_remote-access.scss)
plus the ds Pill and shared EmptyState. The old page rendered with no top
padding because the unlayered .ui-card-content rule beats the layered
Tailwind p-5 utility; a purpose-built SCSS element sidesteps that.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Render the sections (Terminal / Log Files / System Journal / Processes / Services) as inline PageTopbar tabs routed via /terminal/<tab>, like the Servers group — dropping the separate shadcn TabsList and the 'shells / logs / processes / services' tagline. Title is now just 'Logs'. The active pane swaps on the URL and keeps filling the full-bleed region.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The api module called this.get/post/patch/delete, which the ApiService doesn't expose (only request(path, {method, body})) — so every load threw 'this.get is not a function'. Rewrote it to use request() like the other api modules. Also dropped an erroneous className='tabs' on the <Tabs> root: that class (display:flex, meant for the TabsList strip) made the root a row, so the panel rendered beside the tabs instead of below them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dynamic DNS becomes a tab in the Domains group (Domains / DNS Zones / SSL / Dynamic DNS) and is removed from the main nav, so DNS lives in one place. GPU Monitor is hidden from the sidebar when the host reports no GPU (getGpuInfo().available), reusing the wpInstalled-style condition gate for top-level items.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Terminal/Logs now fills the viewport like the Servers ops view (full-bleed flex layout through the Radix tab panel). LogContent sticks to the newest line on new content/selection (respecting manual scroll-up) and shows a floating LIVE badge while a log auto-follows its tail.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Vaults and webhook endpoints now carry a nullable workspace_id FK and are filtered by the active workspace context (X-Workspace-Id header or ?workspace_id), mirroring the servers/apps scoping (#33). New rows are stamped with the resolved workspace; with no context the view stays unscoped. Migration 021 adds the columns + indexes and backfills existing rows to the Default workspace.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Introduce a TabGroupLayout and useTopbarActions hook to render shared PageTopbar + sub-nav for tabbed page groups (Servers, Domains, Services, Files, Monitoring, Marketplace, WordPress). Pages now publish top-bar actions to the enclosing layout instead of rendering their own PageTopbar, reducing remounts and keeping sidebar highlighting consistent. Sidebar items gain matchPrefixes to stay active across grouped routes. Updated many pages to use the hook and new layout, adjusted classes for full-bleed/tab-group shells, and added supporting SCSS. This makes tab groups behave like real tabs and centralizes header behavior.
The localized READMEs are older, slimmer variants missing several sections the
English README has, so each picked up the feature entries that map to existing
sections (Manual & Zip deploys, Container Lifecycle, SSL/TLS hardening, S3/B2
browsing, Passkeys/WebAuthn, WAF, GPU monitoring) plus the full set of new
completed roadmap items, the Tech Stack security row, and a NEW_FEATURES link.
Features whose parent section doesn't exist in a given translation (Remote
Service Tunnels, Connections, WordPress Publishing, Dynamic DNS, Secrets &
Webhook Gateway, CVE/SBOM, Encrypted Secrets at Rest) are represented in that
file's roadmap rather than fabricating new sections. No Layout Switcher
(UI-only) line added, consistent with the English README.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Audit extended past the unpushed window into already-pushed work (~June 11-18)
that never reached the README. Add the substantive, user-facing features only —
not UI restyles.
- Remote Service Tunnels — expose a private/NAT'd service through an edge server
over an agent-managed WireGuard tunnel (the agent network-tunnel feature).
- Connections — single front door for external accounts (source, cloud, DNS,
registrars with expiry tracking, SMTP relays, S3/B2), credentials encrypted.
- WordPress Publishing — real subdomains, previewable URL-swap, custom domains
with auto-DNS and wildcard HTTPS.
- Manual & Zip Deploys; S3/B2 browsing in the File Manager.
- Roadmap entries for the above.
Also drop the Layout Switcher line (a UI change, not a feature) from the README
and CHANGELOG, per the "meaningful features only" guidance.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The dev branch is 23 commits ahead of origin with many user-facing features that
were never reflected in the docs. Bring them current.
- README: add WAF, container CVE/SBOM (grype/syft), passkeys/WebAuthn, dynamic
DNS, GPU monitoring, container lifecycle (image updates / auto-sleep /
auto-scale), secrets + inbound webhook gateway, backup encryption, optional
hardened TLS, encrypted secrets at rest, and the layout switcher to the
Features list, Roadmap, and Tech Stack; link NEW_FEATURES.md.
- CHANGELOG: add the above to [Unreleased] and a new Security subsection
(CVE/SBOM, optional/hardened TLS + auto-CAA + HSTS gating, encryption at rest).
- NEW_FEATURES.md: add §6 documenting the SSL/TLS hardening follow-up
(02afdec..a09bf0f) and renumber Known follow-ups to §7.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Juan Denis