Juan Denis ad96423966 feat(themes): hardening — preview validation, registry caching, token wiring (plan 61) ...

- Validate preview swatches as colors server-side (closes url() smuggling
  via POST /import); import tolerates unknown metadata (license, image, modes)
- theme_registry_service: negative caching on fetch failure (TTL-stamped
  last-good + 60s failure backoff — no more 15s gallery stalls offline);
  drop dead base_url cache key; refresh stale comment
- .env.example: document SERVERKIT_THEMES_REGISTRY_URL/_TTL
- SCSS: route $success/$warning/$danger/$info through --green/--amber/
  --red/--cyan (raw twins for color-function call sites), $font-main/$font-mono
  through --sans/--mono, scrollbar track through --scrollbar-track
- Fix 5 undefined CSS var consumers (--radius-md/--card-bg/--danger/
  --accent-subtle/--accent-soft -> existing tokens)
- Nits: drop dead ThemeStudioTrigger export, dedupe lucide import,
  run check-theme-tokens in pre-commit hook
- docs/plans/61_THEMES_HARDENING_PLAN.md

23 backend theme tests pass; check-theme-tokens, lint (0 errors), build green

2026-07-23 09:25:01 -04:00

..

dns

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

site_importers

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

yara_rules

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

__init__.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

advanced_ssl_service.py

feat(sites): wildcard HTTPS for managed subdomains

2026-06-15 00:52:30 -04:00

agent_fleet_service.py

Add agent fleet management, discovery & updates

2026-03-23 01:46:41 -04:00

agent_plugin_service.py

fix(plugins): make plugin/template features fail honestly, not silently (audit H2)

2026-06-12 18:35:35 -04:00

agent_registry.py

feat(servers): store the agent's self-reported footprint dirs

2026-07-02 22:36:34 -04:00

ai_service.py

feat(services): Phase 0 AI/LLM catalog + Prompture Hub anchor

2026-06-23 16:56:13 -04:00

ai_tool_registry.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

ai_tools_builtin.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

anomaly_detection_service.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

api_analytics_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

api_key_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

app_port_service.py

feat(manifest): appliance-tier typed L4 ports + plan-time blockers rail (plan 35 ph1)

2026-07-09 02:57:23 -04:00

audit_service.py

feat(security): trust reverse-proxy client IP via one gated seam

2026-07-18 00:51:21 -04:00

auth_throttle_service.py

feat(auth): per-IP login brute-force throttle

2026-07-18 00:59:19 -04:00

backup_alert_service.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

backup_cost_service.py

feat(backups): backup protection backend — policy, scheduler, smart backups, API

2026-06-22 19:53:23 -04:00

backup_drill_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

backup_offsite_service.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

backup_policy_service.py

feat(manifest): multi-container units (plan 35 ph3)

2026-07-09 03:13:54 -04:00

backup_service.py

feat(backups): backup protection backend — policy, scheduler, smart backups, API

2026-06-22 19:53:23 -04:00

backup_verify_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

bandwidth_service.py

feat(hosting): per-domain bandwidth accounting

2026-07-03 15:21:48 -04:00

bootstrap_service.py

feat(manifest): finish appliance volumes + one-shot bootstrap (plan 35 ph2)

2026-07-09 03:05:08 -04:00

bounce_service.py

feat(notifications): restore email-bounce webhook slice (plan 42 ph3)

2026-07-09 04:55:53 -04:00

build_service.py

feat: Phase 2 developer experience — build packs, config snapshots, catalog certification

2026-06-23 18:49:04 -04:00

buildpack_service.py

feat(manifest): network identity — fromServer, SERVER_PUBLIC_IP, shared net (plan 35 ph5)

2026-07-09 03:28:08 -04:00

cache_service.py

Add performance optimization: Redis caching and background jobs

2026-03-23 02:27:52 -04:00

cf_ops_change_service.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

chat_webhook_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

cli_api_client.py

harden: broaden insecure-secret detection, bind API to loopback, fix break-glass sub

2026-07-15 12:07:14 -04:00

cloudflare_ops_bridge.py

feat(extensions): Phase 5 — extract Cloudflare zone-ops into serverkit-cloudflare-ops

2026-07-02 01:04:03 -04:00

compose_env_service.py

fix(deployments): stop stuck 0% installs, deploy repo apps on create, unify install UX

2026-07-21 22:57:33 -04:00

configuration_service.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

connection_registry.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

connection_string.py

Introduce sk1 connection string format and GUI plugin

2026-05-05 14:03:31 -04:00

container_registry_service.py

feat(connections): authenticate private container registry pulls

2026-07-01 01:35:44 -04:00

container_scale_service.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

container_sleep_service.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

container_status_service.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

contribution_service.py

feat(extensions): deliver runtime ESM frontends to production panels (#39)

2026-07-22 17:24:36 -04:00

cron_run_service.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

cron_service.py

fix(recovery): restore lost cron-completion service methods (plan 34)

2026-07-08 02:05:39 -04:00

database_service.py

fix(databases): distinguish a connection failure from an empty database

2026-06-15 00:01:41 -04:00

db_admin_sso_service.py

feat(databases): managed DB users and one-click Adminer SSO

2026-07-03 14:24:15 -04:00

db_config_tuner_service.py

feat(databases): curated engine config tuner

2026-07-03 14:24:03 -04:00

db_process_service.py

feat(databases): live processlist with kill in the explorer

2026-07-03 14:24:02 -04:00

db_sync_service.py

feat(wordpress): finish Phase-A glue — create hardening, real URLs, offsite snapshots, push-to-deploy, API keys

2026-05-31 22:39:57 -04:00

ddns_service.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

deployment_job_service.py

feat(deploy): every deploy is a job — async deploy_app, retry endpoint, plan-in-GET

2026-07-22 16:37:08 -04:00

deployment_runner.py

feat(deploy): batched RunLogStream seam + streaming compose + deploy socket channel

2026-07-22 16:36:58 -04:00

deployment_service.py

feat(services): first-class managed volumes for apps

2026-07-01 01:57:07 -04:00

discovery_service.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

dns_change_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_cutover_service.py

fix(dns-cutover): restore snapshot() staging + provider-named 501 (plan 42 D7/ph5)

2026-07-09 04:50:16 -04:00

dns_ownership_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_provider_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_zone_service.py

feat(domains): unify domains & DNS into one surface + admin-only Connections

2026-06-23 00:34:55 -04:00

docker_service.py

feat(deploy): batched RunLogStream seam + streaming compose + deploy socket channel

2026-07-22 16:36:58 -04:00

doctor_service.py

fix(recovery): gpu core-slim move + cross-service doctor/schedule wiring

2026-07-08 01:41:54 -04:00

domain_attach_service.py

feat(manifest): apply engine — resolve/plan/apply + core domain attach (Phase 2)

2026-07-04 01:28:16 -04:00

drift_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

email_relay_service.py

refactor(unify): §6 Phase C6b — Postfix relay backed by EmailProviderConnection

2026-06-24 14:36:08 -04:00

env_reference_service.py

feat(manifest): network identity — fromServer, SERVER_PUBLIC_IP, shared net (plan 35 ph5)

2026-07-09 03:28:08 -04:00

env_service.py

feat(manifest): fromSecret/fromService/generate reference binders (Phase 3)

2026-07-04 01:34:54 -04:00

environment_docker_service.py

Add configurable dev paths and centralize path management

2026-01-28 21:12:55 -05:00

environment_domain_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

environment_health_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

environment_pipeline_service.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

event_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

extension_lifecycle.py

feat(extensions): Phase 3 — platform primitives (models, jobs, sockets, perms)

2026-07-01 22:11:09 -04:00

extension_migration.py

refactor(extensions): extract seven builtins to standalone repos

2026-07-20 01:16:16 -04:00

fail2ban_jail_service.py

refactor(security): generalize the Fail2ban jail engine beyond WordPress

2026-07-22 17:37:20 -04:00

file_integrity_service.py

feat(security): scoped file-integrity monitoring

2026-07-03 15:21:34 -04:00

file_service.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

firewall_service.py

Use system utils for commands and services

2026-02-10 08:09:38 -05:00

fleet_doctor_service.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

fleet_monitor_service.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

fleet_repair_service.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

fleet_sweep.py

feat(agent): V2 capability pack — survey/doctor/fleet sweep+repair (plan 28)

2026-07-07 20:29:24 -04:00

git_deploy_service.py

feat(manifest): persist manifest + seed env + health-check gate (Phase 1)

2026-07-04 01:16:29 -04:00

git_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

gitea_api_service.py

Add git webhook and deployment management APIs

2026-01-21 21:31:57 -05:00

htaccess_converter.py

feat(hosting): .htaccess to nginx converter

2026-07-03 15:22:05 -04:00

image_scanner_service.py

feat(security): per-image CVE scanning (grype) and SBOM generation (syft)

2026-06-19 01:33:45 -04:00

image_update_service.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

invitation_service.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

linked_panel_agent.py

fix(linked-panel): accept compose file path in project_path from remote runner

2026-07-22 00:48:13 -04:00

linked_panel_service.py

feat(servers): ServerKit-to-ServerKit peering — embedded agent mode

2026-07-22 00:35:33 -04:00

log_service.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

login_link_service.py

feat(auth): one-time login links and demo mode

2026-07-03 14:23:50 -04:00

malware_scan_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

managed_database_service.py

feat(databases): track managed databases as first-class resources

2026-07-01 09:44:48 -04:00

managed_db_user_service.py

feat(databases): managed DB users and one-click Adminer SSO

2026-07-03 14:24:15 -04:00

manifest_apply_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_persistence_service.py

feat(manifest): persist manifest + seed env + health-check gate (Phase 1)

2026-07-04 01:16:29 -04:00

manifest_preview_service.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

manifest_scaffold_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_spec_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_sync_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

member_action_service.py

feat(security): authz hardening round 2 (plan 29)

2026-07-07 20:29:24 -04:00

metadata_guard_service.py

feat(security): cloud-metadata egress guard for app containers

2026-07-03 14:23:11 -04:00

metrics_history_service.py

fix(recovery): restore agent scopes, DNS preflight, catalog events, thread guards

2026-07-08 02:06:01 -04:00

migration_service.py

Surface Docker DBs, add base port & migration fixes

2026-06-06 23:29:22 -04:00

module_service.py

feat(extensions): Phase 5 — extract WordPress into serverkit-wordpress (backend)

2026-07-02 00:15:10 -04:00

monitoring_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

nginx_advanced_service.py

Add Nginx advanced config: reverse proxy, load balancing, caching

2026-03-23 02:19:33 -04:00

nginx_service.py

feat(ops): config drift detection, per-resource repair and doctor sweep

2026-07-03 15:21:09 -04:00

nonce_service.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

notification_service.py

feat(notifications): queue-backed Notification Bus + email system

2026-06-21 19:57:02 -04:00

openapi_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

pairing_service.py

fix(pairing): verify Ed25519 proof-of-possession on pairing poll

2026-05-31 16:08:32 -04:00

passkey_service.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

permission_service.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

php_service.py

Add log fallbacks, privilege helpers, and checks

2026-03-04 00:02:52 -05:00

plugin_service.py

feat(extensions): deliver runtime ESM frontends to production panels (#39)

2026-07-22 17:24:36 -04:00

postfix_service.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

preview_service.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

private_url_service.py

feat(phase5): add PrivateURLService for slug generation

2026-01-19 02:35:18 -05:00

process_service.py

feat(services): support manual/local apps and zip uploads

2026-06-18 22:16:00 -04:00

project_service.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

proxy_stack_service.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

python_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

registrar_service.py

Polish connections: domain-expiry alerts, S3 image preview, encryption-health banner

2026-06-15 19:43:00 -04:00

registry_service.py

Marketplace trust: split 409 reasons, hide unreviewed outside dev mode

2026-07-22 23:18:33 -04:00

remote_cloudflared_service.py

Add panel-driven cloudflared login flow

2026-05-01 05:52:11 -04:00

remote_cron_service.py

fix(recovery): restore lost cron-completion service methods (plan 34)

2026-07-08 02:05:39 -04:00

remote_docker_service.py

feat(servers): store the agent's self-reported footprint dirs

2026-07-02 22:36:34 -04:00

remote_file_service.py

Add agent Phase4 primitives, remote files & UI

2026-05-01 03:37:33 -04:00

remote_packages_service.py

Add remote packages, services, sudo, job streaming and capability re-probe

2026-05-01 04:33:08 -04:00

remote_runtimes_service.py

Add Packages/Services tabs, JobProgressModal, pyenv runtime mgmt and template library

2026-05-01 04:42:30 -04:00

remote_systemd_service.py

Add remote packages, services, sudo, job streaming and capability re-probe

2026-05-01 04:33:08 -04:00

repository_manifest_service.py

feat(templates): deploy templates as a backend repo-kind catalog entry

2026-07-10 02:38:46 -04:00

resource_grant_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

resource_tier_service.py

Add resource tier enforcement and UI for WordPress creation

2026-01-25 20:01:07 -05:00

run_log_service.py

feat(deploy): batched RunLogStream seam + streaming compose + deploy socket channel

2026-07-22 16:36:58 -04:00

search_service.py

feat(search): unified entity omnisearch endpoint for the palette

2026-07-11 00:26:40 -04:00

secret_vault_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

security_policy_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

security_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

server_metrics_service.py

Add server historical metrics API and service

2026-01-22 08:51:31 -05:00

server_onboarding_service.py

feat: Phase 4 polish & fleet — onboarding completion, fleet proxy, shared-resource depth, docs

2026-06-23 20:04:04 -04:00

server_template_service.py

fix(plugins): make plugin/template features fail honestly, not silently (audit H2)

2026-06-12 18:35:35 -04:00

settings_service.py

Marketplace trust: split 409 reasons, hide unreviewed outside dev mode

2026-07-22 23:18:33 -04:00

setup_health_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

setup_reconcile_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

shared_resource_service.py

feat: per-service targeting for the compose env overlay

2026-06-23 23:19:41 -04:00

site_base_domain_service.py

feat(sites): base-domain registry so sites can publish under multiple domains

2026-07-01 00:07:00 -04:00

site_domain_service.py

fix(recovery): restore agent scopes, DNS preflight, catalog events, thread guards

2026-07-08 02:06:01 -04:00

site_import_service.py

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

sites_https_service.py

feat(sites): per-base wildcard HTTPS + base-domain registry API

2026-07-01 00:11:18 -04:00

source_connection_service.py

feat(connections): one-click GitHub setup via the GitHub App manifest flow

2026-07-10 23:06:09 -04:00

speed_test_service.py

feat(monitoring): on-demand server speed test card

2026-07-03 14:23:29 -04:00

ssl_service.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

sso_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

storage_provider_service.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

support_bundle_service.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

survey_service.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

system_service.py

fix(system): report IANA timezone_id; guard chart formatting against bad zones

2026-07-01 22:55:11 -04:00

telemetry_service.py

Truncate large telemetry payloads & UI robustness fixes

2026-06-22 01:45:15 -04:00

template_service.py

fix(templates): only bind-mount absolute file paths; relative files are build-context only

2026-07-21 23:26:13 -04:00

terminal_service.py

Add full-stack remote terminal/PTY support

2026-01-22 16:44:06 -05:00

test_sandbox_service.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

theme_registry_service.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

theme_service.py

feat(themes): backend model, API, and registry pipeline (plan 60 Phase 2-3)

2026-07-23 00:24:00 -04:00

theme_tokens.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

totp_service.py

Add two-factor authentication (2FA) support

2026-01-18 01:03:56 -05:00

unit_compose_service.py

feat(manifest): multi-container units (plan 35 ph3)

2026-07-09 03:13:54 -04:00

upload_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

uptime_service.py

Add server uptime tracking and visualization

2026-01-17 13:37:40 -05:00

volume_service.py

feat(manifest): finish appliance volumes + one-shot bootstrap (plan 35 ph2)

2026-07-09 03:05:08 -04:00

waf_service.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

webhook_gateway_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

webhook_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

wordpress_bridge.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

workspace_service.py

feat(workspaces): improve workspace switching and secrets/webhooks UI

2026-06-21 18:32:25 -04:00

yara_scan_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00