[grade=A] Shipdeck fleet module and manual deploy flow

Adds validated fleet install/lifecycle routes, bridge-backed Git and OCI workflows, persistent service cards, and the Local-tab Shipdeck deployment UI while preserving catalog and External flows.

Judge: urn:ump:if6udffdyelsf4qvskkr65ikhuprsjiajzij6h653fhf2zgyynzq

dashcaddy-api/__tests__/routes/shipdeck-fleet.routes.test.js

@@ -0,0 +1,70 @@
+const express = require('express');
+
+function fetcher(fixtures) {
+  return jest.fn(async (url, opts = {}) => {
+    const key = `${opts.method || 'GET'} ${url.replace(/^https?:\/\/[^/]+/, '')}`;
+    const hit = fixtures[key] || { status: 404, body: { ok: false, error: 'missing fixture' } };
+    return { status: hit.status, json: async () => hit.body };
+  });
+}
+
+function appFor(fixtures = {}, initial = []) {
+  process.env.SHIPDECK_BRIDGE_URL = 'http://127.0.0.1:8977';
+  process.env.SHIPDECK_BRIDGE_TOKEN_FILE = '';
+  jest.resetModules();
+  const make = require('../../routes/shipdeck-fleet');
+  let services = initial.slice();
+  const router = make({
+    asyncHandler: (fn) => async (req, res, next) => { try { await fn(req, res, next); } catch (e) { next(e); } },
+    log: { info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+    auditLogger: { log: jest.fn(async () => {}) },
+    fetchT: fetcher(fixtures),
+    servicesStateManager: { read: async () => services, update: async (fn) => { services = await fn(services); } },
+  });
+  const app = express(); app.use(express.json()); app.use('/api/v1/fleet', router);
+  app.use((err, req, res, next) => res.status(500).json({ success: false, error: err.message }));
+  return { app, services: () => services };
+}
+
+async function request(app, path, options) {
+  const server = app.listen(0); const port = server.address().port;
+  try { const response = await fetch(`http://127.0.0.1:${port}${path}`, options); return { response, body: await response.json() }; }
+  finally { server.close(); }
+}
+
+describe('Shipdeck fleet routes', () => {
+  test('from-git rejects privileged inputs before bridge', async () => {
+    const { app } = appFor();
+    const { response } = await request(app, '/api/v1/fleet/from-git', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ repo_url: 'https://github.com/a/b;id', name: '../bad', subdomain: 'bad', port: 80 }) });
+    expect(response.status).toBe(400);
+  });
+
+  test('from-git persists the card server-side while never returning or storing the token', async () => {
+    const fixtures = { 'POST /api/install': { status: 200, body: { ok: true, service: { logo: '', host: 'localhost', shipdeckfile: '/var/lib/shipdeck/services/demo/Shipdeckfile', journal_row_id: 'demo:1' } } } };
+    const { app, services } = appFor(fixtures);
+    const secret = 'ghp_private_secret';
+    const { response, body } = await request(app, '/api/v1/fleet/from-git', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ repo_url: 'https://github.com/acme/demo', name: 'demo', subdomain: 'demo', port: 8080, token: secret }) });
+    expect(response.status).toBe(200); expect(body.success).toBe(true);
+    expect(JSON.stringify(body)).not.toContain(secret); expect(JSON.stringify(services())).not.toContain(secret);
+    expect(services()[0].managedBy).toBe('shipdeck');
+    expect(services()[0].shipdeckfile).toBe('/var/lib/shipdeck/services/demo/Shipdeckfile');
+  });
+
+  test('from-image validates mounts and registry refs', async () => {
+    const { app } = appFor();
+    const { response } = await request(app, '/api/v1/fleet/from-image', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ image: 'alpine;id', name: 'demo', subdomain: 'demo', port: 8080, mounts: [{ source: '/tmp/../etc', target: '/data' }] }) });
+    expect(response.status).toBe(400);
+  });
+
+  test('lifecycle validates service and proxies argv-shaped action', async () => {
+    const { app } = appFor({ 'POST /api/restart': { status: 200, body: { ok: true, output: 'RESTART demo' } } });
+    const { response, body } = await request(app, '/api/v1/fleet/restart', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'demo' }) });
+    expect(response.status).toBe(200); expect(body.action).toBe('restart');
+  });
+
+  test('shipdeckfile requires registered canonical path', async () => {
+    const { app } = appFor({}, [{ id: 'demo', managedBy: 'shipdeck', shipdeckfile: '/tmp/evil' }]);
+    const { response } = await request(app, '/api/v1/fleet/shipdeckfile?id=demo');
+    expect(response.status).toBe(404);
+  });
+});

dashcaddy-api/routes/fleet.js

@@ -43,6 +43,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { ok, errorResponse } = require('../src/utils/responses');
 const { ErrorCodes } = require('../src/utilities/error-codes');
+const shipdeckFleet = require('./shipdeck-fleet');
 const {
   validateFleetHost,
   resolveAndCheckAddress,
@@ -58,7 +59,7 @@ const MAX_PROBE_CONCURRENCY = 5;
 // Per-host probe timeout for /fleet/status.
 const PROBE_TIMEOUT_MS = 3000;
 
-module.exports = function({ log, asyncHandler }) {
+module.exports = function({ log, asyncHandler, auditLogger, fetchT, servicesStateManager }) {
   const wrap = asyncHandler || ((fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next));
   const router = express.Router();
 
@@ -352,5 +353,15 @@ module.exports = function({ log, asyncHandler }) {
     });
   }));
 
+  // Shipdeck v0.2 lifecycle and install endpoints share the existing /fleet
+  // namespace without changing the DC-108 host-management routes above.
+  router.use('/fleet', shipdeckFleet({
+    asyncHandler: wrap,
+    log,
+    auditLogger,
+    fetchT,
+    servicesStateManager,
+  }));
+
   return router;
 };

dashcaddy-api/routes/shipdeck-fleet.js

@@ -0,0 +1,185 @@
+/**
+ * Shipdeck fleet module. All privileged values are fail-closed here before
+ * crossing the token-gated host bridge. Tokens are forwarded in-memory only:
+ * never logged, audited, persisted, or returned.
+ */
+const express = require('express');
+const { ok, errorResponse } = require('../src/utils/responses');
+
+const BRIDGE_URL = process.env.SHIPDECK_BRIDGE_URL || '';
+const BRIDGE_TOKEN_FILE = process.env.SHIPDECK_BRIDGE_TOKEN_FILE || '';
+const PROBE_TIMEOUT = Number(process.env.SHIPDECK_PROBE_TIMEOUT || 15000);
+const DEPLOY_TIMEOUT = Number(process.env.SHIPDECK_DEPLOY_TIMEOUT || 920000);
+
+const reServiceName = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const reBinaryPath = /^\/?[A-Za-z0-9][A-Za-z0-9._\-/]{0,255}$/;
+const reSHA256 = /^[a-f0-9]{64}$/;
+const reRegistryRef = /^(?:[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?\/)?[A-Za-z0-9][A-Za-z0-9._/-]*(?::[A-Za-z0-9][A-Za-z0-9._-]{0,127}|@sha256:[a-f0-9]{64})$/;
+const reGitURL = /^https:\/\/[A-Za-z0-9.-]+(?::\d{1,5})?\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?\/?$/;
+const reEnvName = /^[A-Z_][A-Z0-9_]*$/;
+const reToken = /^[A-Za-z0-9_.=~-]{0,512}$/;
+const reUser = /^[A-Za-z0-9_][A-Za-z0-9_.-]*(?::[A-Za-z0-9_][A-Za-z0-9_.-]*)?$/;
+const reMountPath = new RegExp('^/[A-Za-z0-9._/-]+$');
+
+function hasControl(value) {
+  return Array.from(value).some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127);
+}
+
+function cleanEnv(value) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('env must be an object');
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (!reEnvName.test(key) || typeof val !== 'string' || val.length > 300 || val.includes('"') || val.includes('\\') || hasControl(val)) {
+      throw new Error('env must map uppercase names to strings <=300 chars without quotes, backslashes, or control characters');
+    }
+    out[key] = val;
+  }
+  return out;
+}
+
+function cleanMounts(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 32) throw new Error('mounts must be an array of at most 32 entries');
+  return value.map((mount) => {
+    if (!mount || typeof mount !== 'object' || Array.isArray(mount)) throw new Error('invalid mount');
+    const source = String(mount.source || '');
+    const target = String(mount.target || '');
+    if (!reMountPath.test(source) || !reMountPath.test(target) || source.includes('..') || target.includes('..')) throw new Error('mount paths must be safe absolute paths');
+    if (mount.read_only !== undefined && typeof mount.read_only !== 'boolean') throw new Error('mount read_only must be boolean');
+    return { source, target, read_only: mount.read_only === true };
+  });
+}
+
+function cleanCommand(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 64 || value.some((v) => typeof v !== 'string' || !v || v.length > 1024 || hasControl(v))) throw new Error('cmd must be an array of safe argument strings');
+  if (!reBinaryPath.test(value[0])) throw new Error('cmd executable is invalid');
+  return value.slice();
+}
+
+function readToken() {
+  if (!BRIDGE_TOKEN_FILE) return '';
+  try { return require('fs').readFileSync(BRIDGE_TOKEN_FILE, 'utf8').trim(); } catch (_) { return ''; }
+}
+
+module.exports = function fleetRoutes({ asyncHandler, log, auditLogger, fetchT, servicesStateManager }) {
+  const router = express.Router();
+
+  async function bridge(method, path, body, timeout = PROBE_TIMEOUT) {
+    const headers = { 'X-Shipdeck-Token': readToken() };
+    const options = { method, headers };
+    if (body !== undefined) { headers['Content-Type'] = 'application/json'; options.body = JSON.stringify(body); }
+    const response = await fetchT(BRIDGE_URL + path, options, timeout);
+    let parsed;
+    try { parsed = await response.json(); } catch (_) { parsed = { ok: false, error: 'bridge returned non-JSON response' }; }
+    return { status: response.status, body: parsed };
+  }
+
+  function bridgeError(res, status, body, fallback) {
+    const outward = status === 400 || status === 409 ? status : 502;
+    return errorResponse(res, outward, body.error || fallback, body.output ? { output: String(body.output).slice(-4000) } : undefined);
+  }
+
+  router.use((req, res, next) => {
+    if (!BRIDGE_URL) return errorResponse(res, 501, 'Fleet feature not configured: set SHIPDECK_BRIDGE_URL');
+    next();
+  });
+
+  router.post('/from-git', asyncHandler(async (req, res) => {
+    const { repo_url: repoUrl, name, subdomain, port, token, sha256 } = req.body || {};
+    if (typeof repoUrl !== 'string' || !reGitURL.test(repoUrl)) return errorResponse(res, 400, 'repo_url must be https://host/owner/repo');
+    if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    if (typeof subdomain !== 'string' || !reServiceName.test(subdomain)) return errorResponse(res, 400, 'invalid subdomain');
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return errorResponse(res, 400, 'port must be 1-65535');
+    if (sha256 !== undefined && (typeof sha256 !== 'string' || !reSHA256.test(sha256))) return errorResponse(res, 400, 'sha256 must be 64 lowercase hex characters');
+    if (token !== undefined && (typeof token !== 'string' || !reToken.test(token))) return errorResponse(res, 400, 'invalid token');
+    let env; try { env = cleanEnv(req.body.env); } catch (e) { return errorResponse(res, 400, e.message); }
+    try {
+      const payload = { repo_url: repoUrl, service: name, subdomain, port, env, sha256 };
+      if (token !== undefined) payload.token = token;
+      const { status, body } = await bridge('POST', '/api/install', payload, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Git deployment failed');
+      const deployed = body.service || {};
+      const card = {
+        id: name, name, url: `https://${subdomain}.sami`, ip: deployed.host || 'localhost',
+        port, logo: deployed.logo || `/assets/${name}.png`, tailscaleOnly: true,
+        isCustom: true, managedBy: 'shipdeck', repoUrl,
+        shipdeckfile: deployed.shipdeckfile, journalRowId: deployed.journal_row_id,
+      };
+      await servicesStateManager.update((services) => {
+        const i = services.findIndex((s) => s.id === name);
+        if (i >= 0) services[i] = { ...services[i], ...card }; else services.push(card);
+        return services;
+      });
+      if (auditLogger) auditLogger.log({ action: 'fleet.from-git', resource: name, details: { repo_url: repoUrl, port }, outcome: 'success' }).catch(() => {});
+      log.info('fleet', 'Shipdeck Git deployment completed', { service: name, port });
+      return ok(res, { service: card, journal_row_id: deployed.journal_row_id, phase: 'live' });
+    } catch (e) {
+      log.error('fleet', 'bridge unreachable during Git deployment', { service: name, error: e.message });
+      return errorResponse(res, 502, 'shipdeck bridge unreachable');
+    }
+  }));
+
+  router.post('/from-image', asyncHandler(async (req, res) => {
+    const { image, name, subdomain, port, user, restart, sha256 } = req.body || {};
+    if (typeof image !== 'string' || !reRegistryRef.test(image)) return errorResponse(res, 400, 'invalid registry image reference');
+    if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    if (typeof subdomain !== 'string' || !reServiceName.test(subdomain)) return errorResponse(res, 400, 'invalid subdomain');
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return errorResponse(res, 400, 'port must be 1-65535');
+    if (sha256 !== undefined && (typeof sha256 !== 'string' || !reSHA256.test(sha256))) return errorResponse(res, 400, 'sha256 must be 64 lowercase hex characters');
+    if (user !== undefined && (typeof user !== 'string' || !reUser.test(user))) return errorResponse(res, 400, 'invalid user');
+    if (restart !== undefined && !['no', 'always', 'unless-stopped', 'on-failure'].includes(restart)) return errorResponse(res, 400, 'invalid restart policy');
+    let env, mounts, cmd;
+    try { env = cleanEnv(req.body.env); mounts = cleanMounts(req.body.mounts); cmd = cleanCommand(req.body.cmd); } catch (e) { return errorResponse(res, 400, e.message); }
+    try {
+      const { status, body } = await bridge('POST', '/api/image/install', { image, name, subdomain, port, env, mounts, user, restart, cmd, sha256 }, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Image deployment failed');
+      const deployed = body.service || {};
+      const card = { id: name, name, url: `https://${subdomain}.sami`, ip: 'localhost', port, logo: `/assets/${name}.png`, tailscaleOnly: true, isCustom: true, managedBy: 'shipdeck', image: deployed.image || image, shipdeckfile: deployed.shipdeckfile, journalRowId: deployed.journal_row_id };
+      await servicesStateManager.update((services) => { const i = services.findIndex((s) => s.id === name); if (i >= 0) services[i] = { ...services[i], ...card }; else services.push(card); return services; });
+      if (auditLogger) auditLogger.log({ action: 'fleet.from-image', resource: name, details: { image, port }, outcome: 'success' }).catch(() => {});
+      return ok(res, { service: card, journal_row_id: deployed.journal_row_id, phase: 'live' });
+    } catch (e) { log.error('fleet', 'bridge unreachable during image deployment', { service: name, error: e.message }); return errorResponse(res, 502, 'shipdeck bridge unreachable'); }
+  }));
+
+  router.get('/list', asyncHandler(async (req, res) => {
+    const { status, body } = await bridge('GET', '/api/managed');
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'fleet listing failed');
+    return ok(res, { services: body.services || [] });
+  }));
+
+  for (const action of ['start', 'stop', 'restart', 'rm']) {
+    router.post('/' + action, asyncHandler(async (req, res) => {
+      const name = req.body && req.body.name;
+      if (typeof name !== 'string' || !reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+      const { status, body } = await bridge('POST', '/api/' + action, { name }, DEPLOY_TIMEOUT);
+      if (status !== 200 || !body.ok) return bridgeError(res, status, body, action + ' failed');
+      if (action === 'rm') await servicesStateManager.update((services) => services.filter((s) => s.id !== name));
+      return ok(res, { name, action, output: String(body.output || '').slice(-4000) });
+    }));
+  }
+
+  router.get('/logs', asyncHandler(async (req, res) => {
+    const name = String(req.query.name || '');
+    if (!reServiceName.test(name)) return errorResponse(res, 400, 'invalid service name');
+    const { status, body } = await bridge('GET', '/api/logs?name=' + encodeURIComponent(name));
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'logs failed');
+    return ok(res, { name, logs: String(body.output || '').slice(-64000) });
+  }));
+
+  router.get('/shipdeckfile', asyncHandler(async (req, res) => {
+    const id = String(req.query.id || '');
+    if (!reServiceName.test(id)) return errorResponse(res, 400, 'invalid service id');
+    const services = await servicesStateManager.read();
+    const service = services.find((s) => s.id === id && s.managedBy === 'shipdeck');
+    if (!service || typeof service.shipdeckfile !== 'string' || !/^\/var\/lib\/shipdeck\/services\/[a-z0-9-]+\/Shipdeckfile$/.test(service.shipdeckfile)) return errorResponse(res, 404, 'Shipdeckfile not registered for this service');
+    const { status, body } = await bridge('GET', '/api/shipdeckfile?name=' + encodeURIComponent(id));
+    if (status !== 200 || !body.ok) return bridgeError(res, status, body, 'Shipdeckfile read failed');
+    return ok(res, { id, shipdeckfile: String(body.shipdeckfile || '') });
+  }));
+
+  return router;
+};
+
+module.exports._validation = { reServiceName, reBinaryPath, reSHA256, reRegistryRef, cleanEnv, cleanMounts, cleanCommand };

dashcaddy-api/src/app.js

@@ -676,6 +676,9 @@ async function createApp() {
   apiRouter.use(fleetRoutes({
     log: ctx.log,
     asyncHandler: ctx.asyncHandler,
+    auditLogger: ctx.auditLogger,
+    fetchT: ctx.fetchT,
+    servicesStateManager: ctx.servicesStateManager,
   }));
   apiRouter.use(updatesRoutes({
     updateManager: ctx.updateManager,

ops/shipdeck-bridge/bridge.py

@@ -0,0 +1,340 @@
+#!/usr/bin/env python3
+"""shipdeck-bridge — token-gated HTTP wrapper around the shipdeck CLI.
+
+Runs on the DNS2 HOST (not in the container) so that SSH keys, fleet-dns
+credentials and root-level execution stay out of the DashCaddy web container.
+The container reaches it via the docker bridge IP (172.17.0.1), the same
+pattern as the Caddy admin API.
+
+Endpoints (all require X-Shipdeck-Token matching /etc/shipdeck/bridge-token):
+  GET  /api/health                  -> {ok, version}
+  GET  /api/repos                   -> deployable repos (dirs with a Shipdeckfile)
+  GET  /api/services                -> journal-derived service inventory
+  GET  /api/journal?service=N      -> journal rows (newest first)
+  GET  /api/status?service=N       -> live re-probe output
+  POST /api/deploy    {dir}         -> run `shipdeck deploy <dir>` (serialized)
+  POST /api/rollback  {service}     -> run `shipdeck rollback <service>` (serialized)
+  POST /api/install   {repo_url, service, subdomain?} -> GitHub clone+deploy+card (DC-131)
+
+Security model:
+  - Listens on 127.0.0.1:8977 and 172.17.0.1:8977 ONLY (docker bridge + local).
+  - Every request must carry the shared token (0600 file, root-owned).
+  - Deploy dirs are validated: realpath must sit under SHIPDECK_REPOS_ROOT and
+    contain a Shipdeckfile. Service names are strict [a-z0-9-].
+  - The CLI is exec'd via argv lists — never a shell.
+  - Mutations (deploy/rollback) are serialized with a lock; status/journal are
+    concurrent.
+"""
+
+import json
+import os
+import re
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlparse, parse_qs
+from gh_install import gh_install  # DC-131: GitHub -> card installs (init_shared below)
+from gh_install import list_repos as gitea_list_repos  # DC-133
+from image_install import install_image
+import image_install as _image
+
+SHIPDECK_BIN = os.environ.get("SHIPDECK_BIN", "/usr/local/bin/shipdeck")
+TOKEN_FILE = os.environ.get("SHIPDECK_BRIDGE_TOKEN_FILE", "/etc/shipdeck/bridge-token")
+REPOS_ROOT = os.environ.get("SHIPDECK_REPOS_ROOT", "/root")
+LISTEN_HOSTS = ["127.0.0.1", os.environ.get("SHIPDECK_BRIDGE_DOCKER_IP", "172.17.0.1")]
+PORT = int(os.environ.get("SHIPDECK_BRIDGE_PORT", "8977"))
+DEPLOY_TIMEOUT = int(os.environ.get("SHIPDECK_DEPLOY_TIMEOUT", "600"))
+PROBE_TIMEOUT = 90
+MAX_BODY = 65536
+
+RE_SERVICE = re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$")
+
+mutation_lock = threading.Lock()
+
+
+def read_token() -> str:
+    with open(TOKEN_FILE, "r", encoding="utf-8") as f:
+        token = f.read().strip()
+    if not token:
+        raise RuntimeError("SHIPDECK_BRIDGE_TOKEN_FILE is empty; refusing to start unauthenticated")
+    return token
+
+
+TOKEN = read_token()
+
+
+def run_shipdeck(args, timeout):
+    """Exec the shipdeck CLI via argv (no shell). Returns (code, stdout+stderr)."""
+    try:
+        proc = subprocess.run(
+            [SHIPDECK_BIN] + args,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            env={**os.environ, "SHIPDECK_JOURNAL": os.environ.get("SHIPDECK_JOURNAL", "/var/lib/shipdeck/journal.jsonl")},
+        )
+        return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+    except subprocess.TimeoutExpired:
+        return 124, f"shipdeck {' '.join(args)} timed out after {timeout}s"
+    except FileNotFoundError:
+        return 127, f"shipdeck binary not found at {SHIPDECK_BIN}"
+
+
+# DC-131: hand shared state to the GitHub-install module (after run_shipdeck's
+# def so everything it needs exists; avoids a circular import).
+import gh_install as _gh
+_gh.init_shared(RE_SERVICE, REPOS_ROOT, PORT, mutation_lock, run_shipdeck)
+_image.init_shared(mutation_lock, run_shipdeck)
+
+
+def parse_journal(raw: str):
+    """Parse `shipdeck journal [name]` output rows robustly."""
+    rows = []
+    for line in raw.splitlines():
+        m = re.match(
+            r"^(\d{4}-\d{2}-\d{2}T[\d:]+Z)\s+(\S+)\s+(\S+)\s+epoch=(\d+)\s+(\S+)$",
+            line.strip(),
+        )
+        if m:
+            rows.append(
+                {
+                    "time": m.group(1),
+                    "service": m.group(2),
+                    "action": m.group(3),
+                    "epoch": int(m.group(4)),
+                    "duration": m.group(5),
+                }
+            )
+            continue
+        # rollback rows can have 0.0s duration too; tolerate missing duration
+        m = re.match(r"^(\d{4}-\d{2}-\d{2}T[\d:]+Z)\s+(\S+)\s+(\S+)\s+epoch=(\d+)$", line.strip())
+        if m:
+            rows.append(
+                {
+                    "time": m.group(1),
+                    "service": m.group(2),
+                    "action": m.group(3),
+                    "epoch": int(m.group(4)),
+                    "duration": None,
+                }
+            )
+    return rows
+
+
+def service_inventory():
+    code, out = run_shipdeck(["journal"], PROBE_TIMEOUT)
+    if code != 0:
+        return None, out
+    rows = parse_journal(out)
+    inv = {}
+    for r in rows:
+        s = inv.setdefault(
+            r["service"],
+            {"name": r["service"], "host": None, "last_action": r["action"], "last_time": r["time"], "last_epoch": r["epoch"]},
+        )
+        if s["host"] is None:
+            code2, out2 = run_shipdeck(["status", r["service"]], PROBE_TIMEOUT)
+            m = re.search(r"host (\S+)", out2)
+            if m:
+                s["host"] = m.group(1)
+    return sorted(inv.values(), key=lambda x: x["last_time"], reverse=True), None
+
+
+def list_repos():
+    """Depth-1 scan of REPOS_ROOT for dirs containing a Shipdeckfile."""
+    repos = []
+    try:
+        for name in sorted(os.listdir(REPOS_ROOT)):
+            d = os.path.join(REPOS_ROOT, name)
+            if not os.path.isdir(d) or name.startswith("."):
+                continue
+            if os.path.isfile(os.path.join(d, "Shipdeckfile")):
+                repos.append({"dir": d, "name": name})
+    except OSError as e:
+        return None, str(e)
+    return repos, None
+
+
+def resolve_deploy_dir(d):
+    """Validate a deploy dir request. Returns (realpath, None) or (None, error)."""
+    if not isinstance(d, str) or not d.strip():
+        return None, "dir is required"
+    real = os.path.realpath(d)
+    root_real = os.path.realpath(REPOS_ROOT)
+    if real != root_real and not real.startswith(root_real + os.sep):
+        return None, "dir must be under " + root_real
+    if not os.path.isfile(os.path.join(real, "Shipdeckfile")):
+        return None, "no Shipdeckfile in " + real
+    return real, None
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "shipdeck-bridge/1.0"
+
+    def log_message(self, fmt, *args):  # quiet default access log
+        pass
+
+    def _authed(self) -> bool:
+        return bool(TOKEN) and self.headers.get("X-Shipdeck-Token", "") == TOKEN
+
+    def _send(self, code, payload):
+        body = json.dumps(payload).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _deny(self):
+        self._send(401, {"ok": False, "error": "invalid or missing X-Shipdeck-Token"})
+
+    # ----- GET -----
+    def do_GET(self):
+        if not self._authed():
+            return self._deny()
+        u = urlparse(self.path)
+        q = parse_qs(u.query)
+        if u.path == "/api/health":
+            code, out = run_shipdeck(["version"], 10)
+            return self._send(200, {"ok": code == 0, "shipdeck": out.strip()})
+        if u.path == "/api/repos":
+            repos, err = list_repos()
+            if err:
+                return self._send(500, {"ok": False, "error": err})
+            return self._send(200, {"ok": True, "repos": repos})
+        if u.path == "/api/services":
+            inv, err = service_inventory()
+            if err:
+                return self._send(500, {"ok": False, "error": err})
+            return self._send(200, {"ok": True, "services": inv})
+        if u.path == "/api/managed":
+            code, out = run_shipdeck(["ls", "--json"], PROBE_TIMEOUT)
+            if code != 0:
+                return self._send(500, {"ok": False, "error": "shipdeck ls failed", "output": out[-4000:]})
+            try:
+                services = json.loads(out)
+            except json.JSONDecodeError:
+                return self._send(500, {"ok": False, "error": "shipdeck ls returned invalid JSON"})
+            return self._send(200, {"ok": True, "services": services})
+        if u.path == "/api/logs":
+            service = (q.get("name") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["logs", "-n", "300", service], PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "output": out[-64000:]})
+        if u.path == "/api/shipdeckfile":
+            service = (q.get("name") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["shipdeckfile", service], PROBE_TIMEOUT)
+            if code != 0:
+                return self._send(404, {"ok": False, "error": "Shipdeckfile not found"})
+            out = re.sub(r'(?im)^([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY)[A-Z0-9_]*)\s*=.*$', r'\1 = "<redacted>"', out)
+            return self._send(200, {"ok": True, "shipdeckfile": out})
+        if u.path == "/api/journal":
+            service = (q.get("service") or [""])[0]
+            args = ["journal"]
+            if service:
+                if not RE_SERVICE.match(service):
+                    return self._send(400, {"ok": False, "error": "invalid service name"})
+                args.append(service)
+            code, out = run_shipdeck(args, PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "rows": parse_journal(out), "raw": out[-4000:]})
+        if u.path == "/api/status":
+            service = (q.get("service") or [""])[0]
+            if not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            code, out = run_shipdeck(["status", service], PROBE_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "output": out[-8000:]})
+        return self._send(404, {"ok": False, "error": "not found"})
+
+    # ----- POST -----
+    def do_POST(self):
+        if not self._authed():
+            return self._deny()
+        u = urlparse(self.path)
+        length = int(self.headers.get("Content-Length", "0") or 0)
+        if length > MAX_BODY:
+            return self._send(413, {"ok": False, "error": "body too large"})
+        raw = self.rfile.read(length) if length else b"{}"
+        try:
+            payload = json.loads(raw or b"{}")
+        except json.JSONDecodeError:
+            return self._send(400, {"ok": False, "error": "invalid JSON body"})
+
+        if u.path == "/api/deploy":
+            real, err = resolve_deploy_dir(payload.get("dir"))
+            if err:
+                return self._send(400, {"ok": False, "error": err})
+            with mutation_lock:
+                code, out = run_shipdeck(["deploy", real], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path == "/api/rollback":
+            service = payload.get("service")
+            if not isinstance(service, str) or not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            with mutation_lock:
+                code, out = run_shipdeck(["rollback", service], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path in {"/api/start", "/api/stop", "/api/restart", "/api/rm"}:
+            service = payload.get("name")
+            if not isinstance(service, str) or not RE_SERVICE.match(service):
+                return self._send(400, {"ok": False, "error": "invalid service name"})
+            action = u.path.rsplit("/", 1)[-1]
+            with mutation_lock:
+                code, out = run_shipdeck([action, service], DEPLOY_TIMEOUT)
+            return self._send(200 if code == 0 else 500, {"ok": code == 0, "exit": code, "output": out[-16000:]})
+
+        if u.path == "/api/image/install":
+            if not isinstance(payload, dict):
+                return self._send(400, {"ok": False, "error": "JSON object required"})
+            code, body = install_image(payload)
+            return self._send(code, body)
+
+        if u.path == "/api/gitea/repos":
+            code, body = gitea_list_repos(payload if isinstance(payload, dict) else {})
+            return self._send(code, body)
+
+        if u.path == "/api/install":
+            # DC-131: GitHub URL -> clone -> Shipdeckfile -> deploy -> metadata.
+            # Serialized with the same mutation lock; long timeout (build).
+            if not isinstance(payload, dict):
+                return self._send(400, {"ok": False, "error": "JSON object required"})
+            code, body = gh_install(payload)
+            return self._send(code, body)
+
+        return self._send(404, {"ok": False, "error": "not found"})
+
+
+def main():
+    servers = []
+    last_err = None
+    for host in LISTEN_HOSTS:
+        try:
+            srv = ThreadingHTTPServer((host, PORT), Handler)
+            srv.daemon_threads = True
+            servers.append(srv)
+        except OSError as e:
+            last_err = e
+            print(f"shipdeck-bridge: FAILED to bind {host}:{PORT}: {e}", file=sys.stderr, flush=True)
+    if not servers:
+        # fail fast: systemd restarts us; a silently-dead daemon is worse
+        print(f"shipdeck-bridge: no listeners could bind on {LISTEN_HOSTS}:{PORT}; exiting", file=sys.stderr, flush=True)
+        sys.exit(1)
+    for srv in servers:
+        threading.Thread(target=srv.serve_forever, daemon=True).start()
+        print(f"shipdeck-bridge listening on {srv.server_address[0]}:{PORT}", flush=True)
+    if last_err is not None:
+        # degraded-but-alive: at least one listener bound; keep serving
+        print("shipdeck-bridge: running in DEGRADED mode (partial bind); check logs", file=sys.stderr, flush=True)
+    try:
+        threading.Event().wait()
+    except KeyboardInterrupt:
+        pass
+
+
+if __name__ == "__main__":
+    main()

ops/shipdeck-bridge/gh_install.py

@@ -0,0 +1,503 @@
+# DC-131: GitHub install — clone, detect, emit Shipdeckfile, deploy, persist metadata.
+import json
+import hashlib
+import os
+import re
+import subprocess
+import sys
+
+# Imported by bridge.py (kept separate so the core bridge stays reviewable).
+import shutil
+import time
+import urllib.parse
+import urllib.request
+
+# DC-133: source server is a user choice. Any https host with /owner/repo.
+REPO_URL_RE = re.compile(
+    r"^https://([A-Za-z0-9.-]+)(?::(\d+))?/([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+?)(?:\.git)?/?$")
+GITHUB_API_HOSTS = {"github.com", "www.github.com"}
+FLEET_GITEA_HOST = os.environ.get("SHIPDECK_GITEA_HOST", "git.dashcaddy.net")
+FLEET_GITEA_TOKEN_FILE = os.environ.get("SHIPDECK_GITEA_TOKEN_FILE", "/etc/shipdeck/gitea-token")
+RESERVED_NAMES = {
+    "dashcaddy", "sec", "chat", "plex", "jellyfin", "atis", "atistest",
+    "status", "get", "get2", "mail", "sami", "moviecast", "cast", "shipdeck",
+    "src", "docs", "router", "sync", "torrent", "radarr", "sonarr", "prowlarr",
+    "portainer", "requests", "emby", "seerr", "gitea", "qdrant", "albyhub",
+}
+INSTALL_PORT_MIN, INSTALL_PORT_MAX = 8950, 8999
+INSTALL_TIMEOUT = int(os.environ.get("SHIPDECK_INSTALL_TIMEOUT", "900"))
+GH_APPS_DIR = os.environ.get("DASHCADDY_GH_APPS_DIR", "/opt/dashcaddy/dashcaddy-api/data/gh-apps")
+Q3 = chr(34) * 3
+SAFE_GO_PACKAGE_RE = re.compile(r"^(?:\.|\./[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)*)$")
+_STATE = {}
+def init_shared(re_service, repos_root, port, lock, run_fn):
+    # bridge.py calls this once at import; avoids a circular import.
+    _STATE.update(RE_SERVICE=re_service, REPOS_ROOT=repos_root,
+                  PORT=port, LOCK=lock, RUN=run_fn)
+
+
+def _used_ports():
+    used = set([_STATE['PORT']])
+    try:
+        out = subprocess.run(["ss", "-ltn"], capture_output=True, text=True, timeout=10).stdout
+        for line in out.splitlines():
+            m = re.search(r":(\d+)\s", line)
+            if m:
+                used.add(int(m.group(1)))
+    except Exception:
+        pass
+    return used
+
+
+def _pick_port():
+    used = _used_ports()
+    for p in range(INSTALL_PORT_MIN, INSTALL_PORT_MAX + 1):
+        if p not in used:
+            return p
+    return None
+
+
+def _detect_and_emit(repo_dir, service, subdomain, host_ts_ip, requested_port=None):
+    """Detect Go/Node/Python, write a Shipdeckfile, and return launch metadata."""
+    port = requested_port or _pick_port()
+    if not isinstance(port, int) or port < 1 or port > 65535:
+        raise RuntimeError("port must be 1-65535")
+    if port in _used_ports():
+        raise RuntimeError("requested port is already in use")
+
+    pkg_bin = "bin/app"
+    mode = ""
+    launch = []
+    build_cmd = ""
+    import glob as _glob
+
+    if os.path.isfile(os.path.join(repo_dir, "go.mod")):
+        main_pkg = None
+        for gf in _glob.glob(os.path.join(repo_dir, "*.go")):
+            try:
+                with open(gf, encoding="utf-8", errors="replace") as fh:
+                    if "package main" in fh.read(2048):
+                        main_pkg = "."
+                        break
+            except OSError:
+                continue
+        if main_pkg is None:
+            dirs = sorted(_glob.glob(os.path.join(repo_dir, "*")))
+            dirs += sorted(_glob.glob(os.path.join(repo_dir, "cmd", "*")))
+            for d in dirs:
+                if not os.path.isdir(d):
+                    continue
+                for gf in _glob.glob(os.path.join(d, "*.go")):
+                    try:
+                        with open(gf, encoding="utf-8", errors="replace") as fh:
+                            if "package main" in fh.read(2048):
+                                main_pkg = "./" + os.path.relpath(d, repo_dir)
+                                break
+                    except OSError:
+                        continue
+                if main_pkg:
+                    break
+        if not main_pkg:
+            raise RuntimeError("no Go main package found (module root, subdirs, or cmd/*)")
+        # main_pkg comes from repository-controlled directory names and is
+        # embedded in Shipdeck's shell build_cmd. Reject every shell metachar,
+        # whitespace byte and traversal segment before rendering it.
+        if not SAFE_GO_PACKAGE_RE.fullmatch(main_pkg) or ".." in main_pkg.split("/"):
+            raise RuntimeError("Go main package path contains unsafe characters")
+        build_cmd = "go build -buildvcs=false -o " + pkg_bin + " " + main_pkg
+        launch = ["/opt/" + service + "/current/app"]
+        mode = "go-build"
+    elif os.path.isfile(os.path.join(repo_dir, "package.json")):
+        with open(os.path.join(repo_dir, "package.json"), encoding="utf-8") as fh:
+            package = json.load(fh)
+        entry = package.get("main") or "server.js"
+        if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._/-]*$", entry) or ".." in entry:
+            raise RuntimeError("package.json main is not a safe relative path")
+        pkg_bin = ".shipdeck-app"
+        build_cmd = ("npm ci && npm run build --if-present && rm -rf .shipdeck-app && "
+                     "mkdir .shipdeck-app && cp -a package.json node_modules .shipdeck-app/ && "
+                     "if [ -d dist ]; then cp -a dist .shipdeck-app/; fi && "
+                     "if [ -d src ]; then cp -a src .shipdeck-app/; fi && "
+                     "if [ -f " + entry + " ]; then mkdir -p .shipdeck-app/$(dirname " + entry + ") && cp -a " + entry + " .shipdeck-app/" + entry + "; fi")
+        launch = ["/usr/bin/node", "/opt/" + service + "/current/.shipdeck-app/" + entry]
+        mode = "node-build"
+    elif os.path.isfile(os.path.join(repo_dir, "requirements.txt")) or os.path.isfile(os.path.join(repo_dir, "pyproject.toml")):
+        entry = "app.py" if os.path.isfile(os.path.join(repo_dir, "app.py")) else "main.py"
+        if not os.path.isfile(os.path.join(repo_dir, entry)):
+            raise RuntimeError("Python repo requires app.py or main.py for automatic install")
+        pkg_bin = ".shipdeck-app"
+        install = ".venv/bin/pip install -r requirements.txt" if os.path.isfile(os.path.join(repo_dir, "requirements.txt")) else ".venv/bin/pip install ."
+        build_cmd = ("rm -rf .shipdeck-app .venv && python3 -m venv .venv && " + install +
+                     " && mkdir .shipdeck-app && cp -a .venv " + entry + " .shipdeck-app/")
+        launch = ["/opt/" + service + "/current/.shipdeck-app/.venv/bin/python", "/opt/" + service + "/current/.shipdeck-app/" + entry]
+        mode = "python-build"
+    else:
+        raise RuntimeError("no automatic recipe: expected go.mod, package.json, requirements.txt, or pyproject.toml")
+
+    nl = "\n"
+    block = subdomain + ".sami {" + nl + "\treverse_proxy 127.0.0.1:" + str(port) + nl + "}"
+    Q = chr(34)
+    cfg = (
+        "# Shipdeckfile generated by shipdeck-bridge /api/install" + nl
+        + "[service]" + nl
+        + "name = " + Q + service + Q + nl
+        + "build_cmd = " + Q + build_cmd.replace("\\", "\\\\").replace(Q, "\\" + Q) + Q + nl
+        + "binary = " + Q + pkg_bin + Q + nl
+        + nl + "[deploy]" + nl
+        + "host = " + Q + "dns2" + Q + nl
+        + "systemd_unit = " + Q + service + ".service" + Q + nl
+        + "port = " + str(port) + nl
+        + nl + "[caddy]" + nl
+        + "block = " + Q*3 + nl + block + nl + Q*3 + nl
+        + "tailnet_only = true" + nl
+        + nl + "[dns]" + nl
+        + "zone = " + Q + "sami" + Q + nl
+        + "record = " + Q + subdomain + ".sami" + Q + nl
+        + "target = " + Q + host_ts_ip + Q + nl
+        + nl + "[verify]" + nl
+        + "http = " + Q + "https://" + subdomain + ".sami/" + Q + nl
+        + "timeout = 20" + nl
+    )
+    shipdeckfile = os.path.join(repo_dir, "Shipdeckfile")
+    with open(shipdeckfile, "w") as fh:
+        fh.write(cfg)
+    return {"mode": mode, "port": port, "binary": pkg_bin, "launch": launch,
+            "shipdeckfile": shipdeckfile}
+
+# args->unit support (DC-131): optional launch args become a repo-provided
+# systemd unit so shipdeck stages + packages it like any repo unit.
+ARG_RE = re.compile(r"^[A-Za-z0-9_./=+-]+$")
+
+
+def _write_repo_unit(repo_dir, service, binary_rel, args, env=None, launcher=None):
+    """Write deploy/<service>.service with args + env baked in."""
+    unit_dir = os.path.join(repo_dir, "deploy")
+    os.makedirs(unit_dir, exist_ok=True)
+    binbase = os.path.basename(binary_rel)
+    if launcher:
+        if (not isinstance(launcher, list) or not launcher or any(
+                not isinstance(a, str) or not a or chr(10) in a or chr(13) in a
+                for a in launcher)):
+            raise ValueError("invalid detected launcher")
+        exec_line = " ".join(launcher)
+    else:
+        exec_line = "/opt/" + service + "/current/" + binbase
+    if args:
+        exec_line += " " + " ".join(args)
+    env_lines = ""
+    for k, v in sorted((env or {}).items()):
+        # gh_install validates this before shared-state mutation. Keep the
+        # helper fail-closed too: never silently drop an environment value.
+        if (not isinstance(k, str) or not isinstance(v, str)
+                or not re.match(r"^[A-Z_][A-Z0-9_]*$", k)
+                or len(v) > 300 or chr(34) in v or chr(92) in v
+                or any(ord(ch) < 32 or ord(ch) == 127 for ch in v)):
+            raise ValueError("invalid systemd environment entry: " + str(k)[:40])
+        env_lines += "Environment=" + chr(34) + k + "=" + v + chr(34) + chr(10)
+    nl = chr(10)
+    q = chr(34)
+    unit = (
+        "[Unit]" + nl
+        + "Description=" + service + " (shipdeck)" + nl
+        + "After=network-online.target" + nl
+        + "Wants=network-online.target" + nl
+        + nl + "[Service]" + nl
+        + "Type=simple" + nl
+        + "ExecStart=" + exec_line + nl
+        + env_lines
+        + "Restart=always" + nl
+        + "RestartSec=5" + nl
+        + "User=root" + nl
+        + nl + "[Install]" + nl
+        + "WantedBy=multi-user.target" + nl
+    )
+    path = os.path.join(unit_dir, service + ".service")
+    with open(path, "w") as fh:
+        fh.write(unit)
+    return path
+
+# ---- Gitea support (DC-132, 2026-09-14) ------------------------------------
+GITEA_HOST = os.environ.get("SHIPDECK_GITEA_HOST", "git.dashcaddy.net")
+GITEA_URL_RE = re.compile(
+    r"^https://" + re.escape(GITEA_HOST) + r"/([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+?)(?:\.git)?/?$")
+GITEA_TOKEN_FILE = os.environ.get("SHIPDECK_GITEA_TOKEN_FILE", "/etc/shipdeck/gitea-token")
+
+
+def _gitea_token():
+    try:
+        with open(GITEA_TOKEN_FILE) as fh:
+            return fh.read().strip()
+    except OSError:
+        return ""
+
+
+def _gitea_api(path):
+    tok = _gitea_token()
+    req = urllib.request.Request(
+        "https://" + GITEA_HOST + "/api/v1" + path,
+        headers={"Authorization": "token " + tok, "User-Agent": "shipdeck-bridge"})
+    with urllib.request.urlopen(req, timeout=15) as r:
+        return json.loads(r.read().decode("utf-8", "replace"))
+
+
+def list_repos(payload):
+    """List repos from the configured fleet Gitea only.
+
+    Arbitrary Git hosts remain valid clone sources for /api/install, but this
+    privileged bridge never turns a user-supplied host into an authenticated
+    HTTP metadata request (SSRF boundary).
+    """
+    g_url = payload.get("gitea_url")
+    token_supplied = "token" in payload
+    req_tok = payload.get("token")
+    if req_tok is not None and (not isinstance(req_tok, str)
+                                or len(req_tok) > 512):
+        # same contract as the panel proxy layer (routes/deploys.js)
+        return 400, {"ok": False, "error": "invalid token"}
+    if g_url is not None and not isinstance(g_url, str):
+        return 400, {"ok": False, "error": "gitea_url must be a string"}
+    g_url = (g_url or "").strip().rstrip("/")
+    if g_url:
+        try:
+            parsed = urllib.parse.urlparse(g_url)
+            parsed_port = parsed.port
+        except ValueError:
+            return 400, {"ok": False, "error": "invalid gitea_url"}
+        if (parsed.scheme != "https" or parsed.hostname != FLEET_GITEA_HOST
+                or parsed.username or parsed.password or parsed.path not in ("", "/")
+                or parsed.query or parsed.fragment or parsed_port not in (None, 443)):
+            return 400, {"ok": False, "error": "gitea_url must be the configured fleet Gitea host"}
+        api_base = "https://" + FLEET_GITEA_HOST + "/api/v1"
+        tok = (req_tok or "").strip()
+    else:
+        api_base = "https://" + FLEET_GITEA_HOST + "/api/v1"
+        # Omitted token = use fleet credential. Explicit empty token =
+        # anonymous, even against the fleet host (wire-level distinction).
+        tok = (req_tok or "").strip() if token_supplied else _gitea_token()
+    headers = {"User-Agent": "shipdeck-bridge"}
+    if tok:
+        headers["Authorization"] = "token " + tok
+    try:
+        req = urllib.request.Request(api_base + "/repos/search?limit=50&archived=false",
+                                     headers=headers)
+        with urllib.request.urlopen(req, timeout=15) as r:
+            repos = json.loads(r.read().decode("utf-8", "replace"))
+    except Exception as e:
+        return 502, {"ok": False, "error": "gitea API unreachable: " + str(e)[:200]}
+    host = re.match(r"https?://([^/]+)", api_base).group(1)
+    items = []
+    for repo in repos.get("data", []):
+        full = repo.get("full_name", "")
+        items.append({
+            "id": full.split("/")[-1].lower().replace("_", "-"),
+            "name": repo.get("name"),
+            "full_name": full,
+            "url": "https://" + host + "/" + full,
+            "host": host,
+            "logo": (repo.get("owner") or {}).get("avatar_url") or "",
+            "description": (repo.get("description") or "")[:120],
+        })
+    return 200, {"ok": True, "repos": items}
+
+def _http_json(url, timeout=20, headers=None):
+    h = {"User-Agent": "shipdeck-bridge"}
+    if headers:
+        h.update(headers)
+    req = urllib.request.Request(url, headers=h)
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return json.loads(r.read().decode("utf-8", "replace"))
+
+
+def _gh_env_token():
+    return os.environ.get("SHIPDECK_GH_TOKEN", "")
+
+def gh_install(payload):
+    """Clone, detect, emit Shipdeckfile, deploy, persist metadata. -> (code, body)"""
+    repo_url = payload.get("repo_url")
+    service = payload.get("service")
+    subdomain = payload.get("subdomain")
+    req_token_raw = payload.get("token")
+    token_supplied = "token" in payload
+    # Validate types BEFORE any string ops: a non-string from a direct
+    # bridge call must 400, never raise (same contract as the panel proxy).
+    if repo_url is not None and not isinstance(repo_url, str):
+        return 400, {"ok": False, "error": "repo_url must be a string"}
+    if service is not None and not isinstance(service, str):
+        return 400, {"ok": False, "error": "service must be a string"}
+    if subdomain is not None and not isinstance(subdomain, str):
+        return 400, {"ok": False, "error": "subdomain must be a string"}
+    if req_token_raw is not None and not isinstance(req_token_raw, str):
+        return 400, {"ok": False, "error": "invalid token"}
+    repo_url = repo_url or ""
+    service = (service or "").strip().lower()
+    subdomain = (subdomain or service).strip().lower()
+    req_token = (req_token_raw or "").strip()
+    m = REPO_URL_RE.match(repo_url)
+    if not m:
+        return 400, {"ok": False, "error": "repo_url must be https://host/owner/repo"}
+    rh, rport, owner, repo = m.group(1), m.group(2), m.group(3), m.group(4)
+    if len(req_token) > 512:
+        return 400, {"ok": False, "error": "token too long"}
+    if req_token and not re.match(r"^[A-Za-z0-9_.=~-]+$", req_token):
+        return 400, {"ok": False, "error": "token has unexpected characters"}
+    # metadata: GitHub API for github.com, Gitea API for anything else.
+    # Best-effort: an install can proceed even if metadata is unavailable.
+    logo_url = ""
+    name = repo
+    try:
+        if rh in GITHUB_API_HOSTS:
+            logo_url = "https://github.com/" + owner + ".png"
+            gh_headers = {}
+            gh_token = req_token if token_supplied else _gh_env_token()
+            if gh_token:
+                gh_headers["Authorization"] = "token " + gh_token
+            meta = _http_json("https://api.github.com/repos/%s/%s" % (owner, repo),
+                              headers=gh_headers)
+            name = meta.get("name") or repo
+            logo_url = (meta.get("owner") or {}).get("avatar_url") or logo_url
+        elif rh == FLEET_GITEA_HOST and rport in (None, "443"):
+            g_api = "https://" + rh + (":" + rport if rport else "") + "/api/v1"
+            g_tok = req_token if token_supplied else (
+                _gitea_token() if rh == FLEET_GITEA_HOST else "")
+            g_headers = {"Authorization": "token " + g_tok} if g_tok else {}
+            meta = _http_json(g_api + "/repos/" + owner + "/" + repo,
+                              headers=g_headers)
+            name = meta.get("name") or repo
+            logo_url = (meta.get("owner") or {}).get("avatar_url") or (
+                "https://" + rh + "/avatars/" + owner)
+        # Other HTTPS Git hosts are clone-only. Do not make an HTTP metadata
+        # request to an arbitrary user-selected host from this root service.
+    except Exception as exc:
+        # Metadata is best-effort; the install can proceed without it. Log a
+        # sanitized diagnostic (repo identity only — never token values) so
+        # failures aren't silent.
+        print("gh_install: metadata lookup failed for %s/%s on %s: %s"
+              % (owner, repo, rh, exc), file=sys.stderr)
+    # clone auth: per-request token wins; else fleet token for fleet gitea.
+    # Credentials are passed via env-based git config (GIT_CONFIG_*), which
+    # never appears in process argv (/proc/cmdline) and never lands in the
+    # clone URL, so git's own error output cannot echo the token.
+    clone_url = repo_url
+    tok = req_token if token_supplied else (
+        _gitea_token() if rh == FLEET_GITEA_HOST else "")
+    # Start from the service environment but strip inherited GIT_CONFIG_*
+    # injection. Otherwise an operator/debug environment could leak an
+    # unrelated header into an explicit-anonymous clone. Add back only the
+    # one scoped auth config constructed here.
+    clone_env = {k: v for k, v in os.environ.items()
+                 if not k.startswith("GIT_CONFIG_")}
+    clone_env["GIT_TERMINAL_PROMPT"] = "0"
+    if tok:
+        clone_env["GIT_CONFIG_COUNT"] = "1"
+        clone_env["GIT_CONFIG_KEY_0"] = "http.https://%s%s/.extraheader" % (
+            rh, ":" + rport if rport else "")
+        clone_env["GIT_CONFIG_VALUE_0"] = "Authorization: Bearer " + tok
+
+    def _scrub(text):
+        # defense-in-depth: never echo a token value back to the panel
+        return text.replace(tok, "<redacted>") if tok else text
+    if not _STATE["RE_SERVICE"].match(service):
+        return 400, {"ok": False, "error": "service must match ^[a-z0-9][a-z0-9-]{0,62}$"}
+    if service in RESERVED_NAMES or subdomain in RESERVED_NAMES:
+        return 400, {"ok": False, "error": "service name is reserved"}
+    if not _STATE["RE_SERVICE"].match(subdomain):
+        return 400, {"ok": False, "error": "invalid subdomain"}
+    target = os.path.join(_STATE["REPOS_ROOT"], "repos", "gh-" + service)
+    if os.path.exists(target):
+        return 409, {"ok": False, "error": "service dir already exists: " + target}
+    # Cheap input validation for args/env happens HERE, before the lock:
+    # a payload that was never valid must not touch shared state (no clone
+    # dir, no Shipdeckfile, no port scan). Port augmentation still happens
+    # after detection because it needs the chosen port.
+    args_cfg = payload.get("args")
+    if args_cfg is not None and (not isinstance(args_cfg, list) or any(
+            not isinstance(a, str) or not ARG_RE.match(a) or len(a) > 120
+            for a in args_cfg)):
+        return 400, { "ok": False, "error": "args must be a list of simple tokens" }
+    env_cfg = payload.get("env")
+    if env_cfg is not None and (not isinstance(env_cfg, dict) or any(
+            not isinstance(k, str) or not isinstance(v, str)
+            or not re.match(r"^[A-Z_][A-Z0-9_]*$", k)
+            or len(v) > 300 or chr(34) in v or chr(92) in v
+            or any(ord(ch) < 32 or ord(ch) == 127 for ch in v)
+            for k, v in env_cfg.items())):
+        return 400, {"ok": False, "error": (
+            "env must map valid uppercase names to strings <=300 chars "
+            "without quotes, backslashes, or control characters")}
+    requested_port = payload.get("port")
+    if requested_port is not None and (not isinstance(requested_port, int) or
+                                       isinstance(requested_port, bool) or
+                                       requested_port < 1 or requested_port > 65535):
+        return 400, {"ok": False, "error": "port must be an integer from 1 to 65535"}
+    sha_pin = payload.get("sha256")
+    if sha_pin is not None and (not isinstance(sha_pin, str) or
+                                not re.match(r"^[a-f0-9]{64}$", sha_pin)):
+        return 400, {"ok": False, "error": "sha256 must be 64 lowercase hex characters"}
+    # Serialize the shared-state window on the bridge mutation lock.
+    # Judge round-3: port selection previously ran outside the lock
+    # (ss-snapshot race between concurrent installs). Now clone, port
+    # choice, file writes and deploy all run under the lock, so a
+    # concurrent install's ss scan sees the ports the previous install
+    # already bound — allocation is serialized, not racy.
+    with _STATE['LOCK']:
+        t0 = time.time()
+
+        clone = subprocess.run(
+            ["git", "clone", "--depth", "1", "--single-branch", clone_url, target],
+            capture_output=True, text=True, timeout=180,
+            env=clone_env)
+        if clone.returncode != 0:
+            shutil.rmtree(target, ignore_errors=True)
+            return 400, {"ok": False,
+                         "error": "clone failed: " + _scrub((clone.stderr or ""))[-400:]}
+        if sha_pin:
+            archived = subprocess.run(
+                ["git", "-C", target, "archive", "--format=tar", "HEAD"],
+                capture_output=True, timeout=60)
+            if archived.returncode != 0:
+                shutil.rmtree(target, ignore_errors=True)
+                return 400, {"ok": False, "error": "could not hash cloned source"}
+            actual_sha = hashlib.sha256(archived.stdout).hexdigest()
+            if actual_sha != sha_pin:
+                shutil.rmtree(target, ignore_errors=True)
+                return 400, {"ok": False, "error": "source sha256 mismatch"}
+        try:
+            ts = subprocess.run(["tailscale", "ip", "-4"], capture_output=True,
+                                text=True, timeout=10).stdout.split()
+            host_ts_ip = ts[0] if ts else ""
+            det = _detect_and_emit(target, service, subdomain, host_ts_ip, requested_port)
+        except Exception as e:
+            shutil.rmtree(target, ignore_errors=True)
+            return 400, {"ok": False, "error": str(e)[:400]}
+        args = payload.get("args") or []
+        # align the listen port with the deployed caddy target unless the
+        # caller supplied one
+        has_listen = any(a.lower().lstrip("-").startswith("listen") or a.lower().lstrip("-").startswith("addr") for a in args)
+        if not has_listen and det.get("port"):
+            args = args + ["-listen", "127.0.0.1:" + str(det["port"])]
+        env_cfg = payload.get("env") or {}
+        env_out = {str(k): str(v) for k, v in (env_cfg or {}).items()}
+        if det.get("port"):
+            env_out.setdefault("PORT", str(det["port"]))
+        _write_repo_unit(target, service, det.get("binary", "bin/app"), args,
+                         env_out, det.get("launch"))
+
+        code, out = _STATE["RUN"](["deploy", target], INSTALL_TIMEOUT)
+        if code != 0:
+            return 500, {"ok": False, "error": "deploy failed", "output": out[-4000:], "dir": target}
+        info = {
+            "id": service, "name": name, "repo_url": repo_url,
+            "subdomain": subdomain, "url": "https://%s.sami" % subdomain,
+            "logo": logo_url, "mode": det.get("mode"), "port": det.get("port"),
+            "dir": target, "installed_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            "shipdeckfile": "/var/lib/shipdeck/services/" + service + "/Shipdeckfile",
+            "journal_row_id": service + ":" + str(int(time.time())),
+            "deploy_seconds": round(time.time() - t0, 1),
+        }
+        try:
+            os.makedirs(GH_APPS_DIR, exist_ok=True)
+            with open(os.path.join(GH_APPS_DIR, service + ".json"), "w") as f:
+                json.dump(info, f, indent=1)
+        except OSError:
+            pass
+        return 200, {"ok": True, "service": info, "output": out[-2000:]}

ops/shipdeck-bridge/image_install.py

@@ -0,0 +1,103 @@
+"""Validated OCI image installs for shipdeck-bridge."""
+import json
+import os
+import re
+import shutil
+import subprocess
+import time
+
+RE_SERVICE = re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$")
+RE_IMAGE = re.compile(r"^(?:[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?/)?[A-Za-z0-9][A-Za-z0-9._/-]*(?::[A-Za-z0-9][A-Za-z0-9._-]{0,127}|@sha256:[a-f0-9]{64})$")
+RE_SHA = re.compile(r"^[a-f0-9]{64}$")
+RE_ENV = re.compile(r"^[A-Z_][A-Z0-9_]*$")
+RE_USER = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9_.-]*(?::[A-Za-z0-9_][A-Za-z0-9_.-]*)?$")
+RE_CMD0 = re.compile(r"^/?[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$")
+RESTARTS = {"no", "always", "unless-stopped", "on-failure"}
+DRAFT_ROOT = os.environ.get("SHIPDECK_IMAGE_DRAFTS", "/var/lib/shipdeck/drafts")
+_STATE = {}
+
+
+def init_shared(lock, run_fn):
+    _STATE.update(LOCK=lock, RUN=run_fn)
+
+
+def _q(value):
+    return json.dumps(value, ensure_ascii=True)
+
+
+def install_image(payload):
+    image = payload.get("image")
+    name = payload.get("name")
+    subdomain = payload.get("subdomain")
+    port = payload.get("port")
+    sha = payload.get("sha256")
+    env = payload.get("env") or {}
+    mounts = payload.get("mounts") or []
+    user = payload.get("user") or ""
+    restart = payload.get("restart") or "unless-stopped"
+    cmd = payload.get("cmd") or []
+    if not isinstance(image, str) or not RE_IMAGE.match(image): return 400, {"ok": False, "error": "invalid image"}
+    if not isinstance(name, str) or not RE_SERVICE.match(name): return 400, {"ok": False, "error": "invalid service name"}
+    if not isinstance(subdomain, str) or not RE_SERVICE.match(subdomain): return 400, {"ok": False, "error": "invalid subdomain"}
+    if not isinstance(port, int) or isinstance(port, bool) or not 1 <= port <= 65535: return 400, {"ok": False, "error": "invalid port"}
+    if sha is not None and (not isinstance(sha, str) or not RE_SHA.match(sha)): return 400, {"ok": False, "error": "invalid sha256"}
+    if user and (not isinstance(user, str) or not RE_USER.match(user)): return 400, {"ok": False, "error": "invalid user"}
+    if restart not in RESTARTS: return 400, {"ok": False, "error": "invalid restart"}
+    if not isinstance(env, dict) or any(not isinstance(k, str) or not isinstance(v, str) or not RE_ENV.match(k) or len(v) > 300 or any(ord(c) < 32 or ord(c) == 127 for c in v) or '"' in v or '\\' in v for k, v in env.items()): return 400, {"ok": False, "error": "invalid env"}
+    if not isinstance(cmd, list) or len(cmd) > 64 or any(not isinstance(v, str) or not v or len(v) > 1024 or any(c in v for c in "\x00\r\n") for v in cmd): return 400, {"ok": False, "error": "invalid cmd"}
+    if cmd and not RE_CMD0.match(cmd[0]): return 400, {"ok": False, "error": "invalid cmd executable"}
+    if not isinstance(mounts, list) or len(mounts) > 32: return 400, {"ok": False, "error": "invalid mounts"}
+    clean_mounts = []
+    for mount in mounts:
+        if not isinstance(mount, dict): return 400, {"ok": False, "error": "invalid mount"}
+        source, target = mount.get("source"), mount.get("target")
+        if not isinstance(source, str) or not isinstance(target, str) or not source.startswith("/") or not target.startswith("/") or ".." in source or ".." in target or not re.match(r"^/[A-Za-z0-9._/-]+$", source + target): return 400, {"ok": False, "error": "invalid mount path"}
+        if mount.get("read_only") not in (None, True, False): return 400, {"ok": False, "error": "invalid mount mode"}
+        clean_mounts.append({"source": source, "target": target, "read_only": mount.get("read_only") is True})
+
+    with _STATE["LOCK"]:
+        pull_args = ["pull", "--json"]
+        if sha: pull_args += ["--sha256", sha]
+        pull_args.append(image)
+        code, pull_out = _STATE["RUN"](pull_args, 900)
+        if code != 0: return 500, {"ok": False, "error": "image pull failed", "output": pull_out[-4000:]}
+        try:
+            pulled = json.loads(pull_out)
+            digest = pulled["digest"]
+            if not re.match(r"^sha256:[a-f0-9]{64}$", digest): raise ValueError("bad digest")
+            pin = digest.split(":", 1)[1]
+            if not cmd:
+                image_cfg = (pulled.get("config") or {}).get("config") or {}
+                cmd = list(image_cfg.get("Entrypoint") or []) + list(image_cfg.get("Cmd") or [])
+        except (ValueError, KeyError, TypeError):
+            return 500, {"ok": False, "error": "shipdeck pull returned invalid metadata"}
+        if not cmd or not RE_CMD0.match(cmd[0]):
+            return 400, {"ok": False, "error": "image has no safe default command; provide cmd"}
+        ts = subprocess.run(["tailscale", "ip", "-4"], capture_output=True, text=True, timeout=10).stdout.split()
+        if not ts: return 500, {"ok": False, "error": "could not determine fleet host Tailscale IP"}
+        draft = os.path.join(DRAFT_ROOT, name)
+        if os.path.exists(draft): shutil.rmtree(draft)
+        os.makedirs(draft, mode=0o700, exist_ok=False)
+        lines = [
+            "# Generated by shipdeck-bridge; immutable manifest pin.", "[service]",
+            "name = " + _q(name), "binary = " + _q(cmd[0] if cmd else "/bin/sh"), "",
+            "[source]", "image = " + _q(image), "sha256 = " + _q(pin), "",
+            "[deploy]", 'host = "dns2"', "systemd_unit = " + _q(name + ".service"),
+            "port = " + str(port), "", "[runtime]", "user = " + _q(user),
+            "restart = " + _q(restart), "cmd = " + _q(cmd), "",
+        ]
+        if env:
+            lines.append("[env]")
+            lines.extend(k + " = " + _q(v) for k, v in sorted(env.items()))
+            lines.append("")
+        for mount in clean_mounts:
+            lines += ["[[volumes]]", "source = " + _q(mount["source"]), "target = " + _q(mount["target"]), "read_only = " + ("true" if mount["read_only"] else "false"), ""]
+        lines += ["[caddy]", 'block = """', subdomain + ".sami {", "\treverse_proxy 127.0.0.1:" + str(port), "}", '"""', "tailnet_only = true", "", "[dns]", 'zone = "sami"', "record = " + _q(subdomain + ".sami"), "target = " + _q(ts[0]), "", "[verify]", "http = " + _q("https://" + subdomain + ".sami/"), "timeout = 30", ""]
+        path = os.path.join(draft, "Shipdeckfile")
+        with open(path, "w", encoding="utf-8") as fh: fh.write("\n".join(lines))
+        os.chmod(path, 0o600)
+        code, out = _STATE["RUN"](["deploy", draft], 900)
+        if code != 0: return 500, {"ok": False, "error": "image deploy failed", "output": out[-4000:]}
+        installed_path = "/var/lib/shipdeck/services/" + name + "/Shipdeckfile"
+        row_id = name + ":" + str(int(time.time()))
+        return 200, {"ok": True, "service": {"name": name, "image": image + "@sha256:" + pin, "port": port, "shipdeckfile": installed_path, "journal_row_id": row_id}, "output": out[-2000:]}

ops/shipdeck-bridge/shipdeck-bridge.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=shipdeck-bridge — token-gated HTTP wrapper for the shipdeck CLI (DashCaddy deploys panel)
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /opt/shipdeck-bridge/bridge.py
+Environment=SHIPDECK_BIN=/usr/local/bin/shipdeck
+Environment=SHIPDECK_BRIDGE_TOKEN_FILE=/etc/shipdeck/bridge-token
+Environment=SHIPDECK_REPOS_ROOT=/root
+Environment=SHIPDECK_BRIDGE_PORT=8977
+Restart=on-failure
+RestartSec=3
+# root: needs the ssh keys + fleet-dns that shipdeck orchestrates
+User=root
+
+[Install]
+WantedBy=multi-user.target

ops/shipdeck-bridge/test_fleet_ops.py

@@ -0,0 +1,115 @@
+import json
+import os
+import tempfile
+import unittest
+from unittest import mock
+
+import gh_install
+import image_install
+import bridge
+
+
+class FleetOpsTests(unittest.TestCase):
+    def test_empty_bridge_token_fails_closed(self):
+        with mock.patch("builtins.open", mock.mock_open(read_data="  \n")):
+            with self.assertRaisesRegex(RuntimeError, "refusing to start unauthenticated"):
+                bridge.read_token()
+
+    def test_detects_go_node_python_at_requested_port(self):
+        gh_install._STATE.update(PORT=8977)
+        with mock.patch.object(gh_install, "_used_ports", return_value={8977}):
+            cases = {
+                "go": {"go.mod": "module x\n", "main.go": "package main\nfunc main(){}\n"},
+                "node": {"package.json": json.dumps({"main": "server.js"}), "server.js": ""},
+                "python": {"requirements.txt": "", "app.py": ""},
+            }
+            for i, (kind, files) in enumerate(cases.items()):
+                with tempfile.TemporaryDirectory() as d:
+                    for name, body in files.items():
+                        with open(os.path.join(d, name), "w", encoding="utf-8") as fh: fh.write(body)
+                    got = gh_install._detect_and_emit(d, "demo-" + kind, "demo-" + kind, "100.121.150.22", 8100 + i)
+                    self.assertEqual(got["port"], 8100 + i)
+                    self.assertTrue(got["mode"].startswith(kind))
+                    self.assertTrue(os.path.isfile(got["shipdeckfile"]))
+
+    def test_rejects_repository_controlled_go_package_shell_metachars(self):
+        gh_install._STATE.update(PORT=8977)
+        with tempfile.TemporaryDirectory() as d, mock.patch.object(
+                gh_install, "_used_ports", return_value={8977}):
+            os.mkdir(os.path.join(d, "cmd;touch-pwned"))
+            with open(os.path.join(d, "go.mod"), "w", encoding="utf-8") as fh:
+                fh.write("module x\n")
+            with open(os.path.join(d, "cmd;touch-pwned", "main.go"), "w", encoding="utf-8") as fh:
+                fh.write("package main\nfunc main(){}\n")
+            with self.assertRaisesRegex(RuntimeError, "unsafe characters"):
+                gh_install._detect_and_emit(d, "demo", "demo", "100.121.150.22", 8100)
+
+    def test_gitea_repo_listing_rejects_arbitrary_hosts_before_http(self):
+        with mock.patch("gh_install.urllib.request.urlopen") as urlopen:
+            code, body = gh_install.list_repos({"gitea_url": "https://127.0.0.1"})
+        self.assertEqual(code, 400)
+        self.assertIn("configured fleet Gitea", body["error"])
+        urlopen.assert_not_called()
+
+    def test_unknown_git_host_skips_metadata_http_but_remains_cloneable(self):
+        payload = {"repo_url": "https://code.example/owner/repo", "service": "demo"}
+        lock = mock.MagicMock()
+        lock.__enter__ = mock.Mock()
+        lock.__exit__ = mock.Mock(return_value=False)
+        gh_install._STATE.update(RE_SERVICE=gh_install.re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$"),
+                                 REPOS_ROOT="/tmp", PORT=8977, LOCK=lock, RUN=mock.Mock())
+        with mock.patch("gh_install._http_json") as http_json, mock.patch(
+                "gh_install.os.path.exists", return_value=True):
+            code, _ = gh_install.gh_install(payload)
+        self.assertEqual(code, 409)
+        http_json.assert_not_called()
+
+    def test_git_token_is_env_only_never_clone_url_or_error(self):
+        secret = "ghp_private_secret"
+        lock = mock.MagicMock()
+        lock.__enter__ = mock.Mock()
+        lock.__exit__ = mock.Mock(return_value=False)
+        with tempfile.TemporaryDirectory() as root:
+            gh_install._STATE.update(RE_SERVICE=gh_install.re.compile(r"^[a-z0-9][a-z0-9-]{0,62}$"),
+                                     REPOS_ROOT=root, PORT=8977, LOCK=lock, RUN=mock.Mock())
+            failed = mock.Mock(returncode=1, stdout="", stderr="clone rejected " + secret)
+            with mock.patch.object(gh_install, "_http_json", return_value={"name": "repo", "owner": {}}), mock.patch(
+                    "gh_install.subprocess.run", return_value=failed) as run:
+                code, body = gh_install.gh_install({"repo_url": "https://github.com/acme/repo", "service": "demo", "token": secret})
+        self.assertEqual(code, 400)
+        argv = run.call_args.args[0]
+        env = run.call_args.kwargs["env"]
+        self.assertEqual(argv[-2], "https://github.com/acme/repo")
+        self.assertNotIn(secret, " ".join(argv))
+        self.assertIn(secret, env["GIT_CONFIG_VALUE_0"])
+        self.assertNotIn(secret, json.dumps(body))
+
+    def test_image_install_pins_digest_and_never_returns_env_secret(self):
+        digest = "a" * 64
+        pull = {"digest": "sha256:" + digest, "config": {"config": {"Entrypoint": [], "Cmd": ["/bin/app"]}}}
+        calls = []
+        def run(args, timeout):
+            calls.append(args)
+            return (0, json.dumps(pull)) if args[0] == "pull" else (0, "DEPLOYED")
+        image_install.init_shared(mock.MagicMock(), run)
+        image_install._STATE["LOCK"].__enter__ = mock.Mock()
+        image_install._STATE["LOCK"].__exit__ = mock.Mock(return_value=False)
+        payload = {"image": "alpine:3.20", "name": "demo", "subdomain": "demo", "port": 8080, "env": {"API_TOKEN": "private-value"}}
+        with tempfile.TemporaryDirectory() as drafts, mock.patch.object(image_install, "DRAFT_ROOT", drafts), mock.patch("image_install.subprocess.run") as sp:
+            sp.return_value.stdout = "100.121.150.22\n"
+            code, body = image_install.install_image(payload)
+        self.assertEqual(code, 200)
+        self.assertNotIn("private-value", json.dumps(body))
+        self.assertEqual(calls[0][:2], ["pull", "--json"])
+        self.assertEqual(calls[1][0], "deploy")
+        self.assertIn("@sha256:" + digest, body["service"]["image"])
+
+    def test_image_install_rejects_traversal_before_pull(self):
+        run = mock.Mock()
+        image_install.init_shared(mock.MagicMock(), run)
+        code, _ = image_install.install_image({"image": "alpine:3.20", "name": "demo", "subdomain": "demo", "port": 8080, "mounts": [{"source": "/tmp/../etc", "target": "/data"}]})
+        self.assertEqual(code, 400)
+        run.assert_not_called()
+
+
+if __name__ == "__main__": unittest.main()

status/dist/core.js

@@ -1,4 +1,4 @@
-(function(c){"use strict";class a{constructor(){this.errors=[],this.maxErrors=50}logError(h,b,g={}){const v={timestamp:new Date().toISOString(),context:h,message:b instanceof Error?b.message:b,stack:b instanceof Error?b.stack:null,metadata:g};this.errors.push(v),this.errors.length>this.maxErrors&&this.errors.shift(),console.error(`[Onboarding Error] ${h}:`,b,g)}recoverFromError(h,b){switch(this.classifyError(h)){case"ELEMENT_NOT_FOUND":return this.logError("Element Not Found",h,{currentStep:b}),{action:"SKIP_STEP",nextStep:b+1,message:"Target element not found, skipping to next step"};case"STORAGE_UNAVAILABLE":return this.logError("Storage Unavailable",h),{action:"USE_MEMORY_STORAGE",message:"Local storage unavailable, using in-memory storage"};case"DRIVER_NOT_LOADED":return this.logError("Driver.js Not Loaded",h),{action:"ABORT_TOUR",message:"Driver.js library not loaded, cannot start tour"};case"INVALID_TOOLTIP":return this.logError("Invalid Tooltip Configuration",h,{currentStep:b}),{action:"SKIP_STEP",nextStep:b+1,message:"Invalid tooltip configuration, skipping"};case"THEME_DETECTION_FAILED":return this.logError("Theme Detection Failed",h),{action:"USE_DEFAULT_THEME",message:"Using default dark theme"};default:return this.logError("Unknown Error",h,{currentStep:b}),{action:"ABORT_TOUR",message:"Unexpected error occurred, aborting tour"}}}classifyError(h){const b=h.message||h.toString();return b.includes("element")&&b.includes("not found")?"ELEMENT_NOT_FOUND":b.includes("storage")||b.includes("quota")?"STORAGE_UNAVAILABLE":b.includes("driver")||b.includes("undefined")?"DRIVER_NOT_LOADED":b.includes("invalid")||b.includes("validation")?"INVALID_TOOLTIP":b.includes("theme")?"THEME_DETECTION_FAILED":"UNKNOWN"}getErrors(){return[...this.errors]}clearErrors(){this.errors=[]}getStatistics(){const h={total:this.errors.length,byContext:{},byType:{},recent:this.errors.slice(-10)};return this.errors.forEach(b=>{h.byContext[b.context]=(h.byContext[b.context]||0)+1;const g=this.classifyError({message:b.message});h.byType[g]=(h.byType[g]||0)+1}),h}handleDriverLoadFailure(){this.logError("Driver.js Load Failure","Driver.js library failed to load");const h=document.createElement("div");return h.id="onboarding-fallback",h.style.cssText=`
+(function(u){"use strict";class o{constructor(){this.errors=[],this.maxErrors=50}logError(h,b,g={}){const v={timestamp:new Date().toISOString(),context:h,message:b instanceof Error?b.message:b,stack:b instanceof Error?b.stack:null,metadata:g};this.errors.push(v),this.errors.length>this.maxErrors&&this.errors.shift(),console.error(`[Onboarding Error] ${h}:`,b,g)}recoverFromError(h,b){switch(this.classifyError(h)){case"ELEMENT_NOT_FOUND":return this.logError("Element Not Found",h,{currentStep:b}),{action:"SKIP_STEP",nextStep:b+1,message:"Target element not found, skipping to next step"};case"STORAGE_UNAVAILABLE":return this.logError("Storage Unavailable",h),{action:"USE_MEMORY_STORAGE",message:"Local storage unavailable, using in-memory storage"};case"DRIVER_NOT_LOADED":return this.logError("Driver.js Not Loaded",h),{action:"ABORT_TOUR",message:"Driver.js library not loaded, cannot start tour"};case"INVALID_TOOLTIP":return this.logError("Invalid Tooltip Configuration",h,{currentStep:b}),{action:"SKIP_STEP",nextStep:b+1,message:"Invalid tooltip configuration, skipping"};case"THEME_DETECTION_FAILED":return this.logError("Theme Detection Failed",h),{action:"USE_DEFAULT_THEME",message:"Using default dark theme"};default:return this.logError("Unknown Error",h,{currentStep:b}),{action:"ABORT_TOUR",message:"Unexpected error occurred, aborting tour"}}}classifyError(h){const b=h.message||h.toString();return b.includes("element")&&b.includes("not found")?"ELEMENT_NOT_FOUND":b.includes("storage")||b.includes("quota")?"STORAGE_UNAVAILABLE":b.includes("driver")||b.includes("undefined")?"DRIVER_NOT_LOADED":b.includes("invalid")||b.includes("validation")?"INVALID_TOOLTIP":b.includes("theme")?"THEME_DETECTION_FAILED":"UNKNOWN"}getErrors(){return[...this.errors]}clearErrors(){this.errors=[]}getStatistics(){const h={total:this.errors.length,byContext:{},byType:{},recent:this.errors.slice(-10)};return this.errors.forEach(b=>{h.byContext[b.context]=(h.byContext[b.context]||0)+1;const g=this.classifyError({message:b.message});h.byType[g]=(h.byType[g]||0)+1}),h}handleDriverLoadFailure(){this.logError("Driver.js Load Failure","Driver.js library failed to load");const h=document.createElement("div");return h.id="onboarding-fallback",h.style.cssText=`
         position: fixed;
         bottom: 20px;
         right: 20px;
@@ -16,48 +16,48 @@
           The interactive tour is unavailable, but you can explore the dashboard freely.
           Check the documentation for help getting started.
         </p>
-      `,document.body.appendChild(h),setTimeout(()=>{h.parentNode&&h.parentNode.removeChild(h)},1e4),!0}handleStorageUnavailable(){this.logError("Storage Unavailable","Local storage is not available");const h={data:{},getItem(b){return this.data[b]||null},setItem(b,g){this.data[b]=g},removeItem(b){delete this.data[b]},clear(){this.data={}}};return console.warn("[ErrorHandler] Using in-memory storage - progress will not persist"),h}sendToErrorTracking(h){}}c.ErrorHandler=a,console.log("[ErrorHandler] Module loaded")})(window),(function(){try{var a=typeof localStorage<"u"&&localStorage.getItem("dashcaddy-health-settings")||null;if(a){var m=JSON.parse(a);m.statsPollingInterval&&m.statsPollingInterval>=5&&m.statsPollingInterval<=3600&&(window.__DC_STATS_OVERRIDE=m.statsPollingInterval*1e3)}}catch{}})();const DC={NAME:"DashCaddy",POLL:{DASHBOARD:1e4,LOGS:3e3,STATS:typeof window<"u"&&window.__DC_STATS_OVERRIDE||5e3,WEATHER:6e5,HEALTH:1e3,DEPLOY_SSL:5e3},DELAYS:{BTN_RESET:2e3,RELOAD:5e3,MODAL_CLOSE:500,PORT_CHECK:500,DEPLOY_INIT:3e3},DEFAULTS:{DNS_PORT:"5380",SERVICE_PORT:"8080",TTL:300,CADDYFILE:"C:\\caddy\\Caddyfile"}},errorHandler=new ErrorHandler,_cachedCfg=JSON.parse(localStorage.getItem("dashcaddy_site_config")||"null"),SITE={tld:_cachedCfg&&_cachedCfg.tld||".home",dnsIp:"",dnsPort:DC.DEFAULTS.DNS_PORT,dnsServers:{},configurationType:_cachedCfg&&_cachedCfg.configurationType||"homelab",domain:_cachedCfg&&_cachedCfg.domain||"",defaults:_cachedCfg&&_cachedCfg.defaults||{},routingMode:_cachedCfg&&_cachedCfg.routingMode||"subdomain",onboardingCompleted:!1};window.__dashcaddySiteConfigLoaded=(async function(){try{const h=await fetch("/api/v1/config");if(h.ok){const b=await h.json();if(b.tld&&(SITE.tld=b.tld.startsWith(".")?b.tld:"."+b.tld),b.dns&&(SITE.dnsIp=b.dns.ip||"",SITE.dnsPort=b.dns.port||DC.DEFAULTS.DNS_PORT),b.dnsServers&&typeof b.dnsServers=="object")for(const[v,p]of Object.entries(b.dnsServers))v!=="__proto__"&&v!=="constructor"&&v!=="prototype"&&(SITE.dnsServers[v]=p);b.configurationType&&(SITE.configurationType=b.configurationType),b.domain&&(SITE.domain=b.domain),b.defaults&&(SITE.defaults=b.defaults),b.routingMode&&(SITE.routingMode=b.routingMode),SITE.onboardingCompleted=b.onboardingCompleted===!0,localStorage.setItem("dashcaddy_site_config",JSON.stringify({tld:SITE.tld,configurationType:SITE.configurationType,domain:SITE.domain,routingMode:SITE.routingMode})),renderDnsCards();const g=document.getElementById("manage-tokens");g&&(g.style.display=Object.keys(SITE.dnsServers).length?"":"none")}}catch{}document.querySelectorAll("[data-tld]").forEach(h=>h.textContent=SITE.tld);const a=document.getElementById("edit-tld-suffix");a&&(a.textContent=SITE.tld);const m=document.getElementById("external-proxy-ip");m&&SITE.dnsIp&&(m.value=SITE.dnsIp,m.placeholder=SITE.dnsIp)})();function buildDomain(c){return c+SITE.tld}function buildServiceUrl(c){return SITE.routingMode==="subdirectory"&&SITE.domain?"https://"+SITE.domain+"/"+c:SITE.configurationType==="public"&&SITE.domain?"https://"+c+"."+SITE.domain:"https://"+buildDomain(c)}function getDnsServerAddr(c){const a=SITE.dnsServers[c];return a?`${a.ip}:${a.port}`:buildDomain(c)}function getPrimaryDnsId(){if(!SITE.dnsIp)return null;for(const[c,a]of Object.entries(SITE.dnsServers))if(a.ip===SITE.dnsIp)return c;return null}function renderDnsCards(){const c=document.querySelector(".top");if(!c)return;const a=Object.keys(SITE.dnsServers);if(!a.length)return;const m='<svg viewBox="0 0 24 24" class="service-icon"><rect x="3" y="4" width="18" height="16" rx="2" fill="#34495e"/><rect x="5" y="6" width="14" height="2" rx="1" fill="#3498db"/><rect x="5" y="9" width="10" height="1" fill="#ecf0f1"/><rect x="5" y="11" width="12" height="1" fill="#ecf0f1"/><rect x="5" y="13" width="8" height="1" fill="#ecf0f1"/><rect x="5" y="15" width="14" height="1" fill="#ecf0f1"/><circle cx="17" cy="11" r="2" fill="#e74c3c"/><path d="M17 9v4M15 11h4" stroke="white" stroke-width="1"/></svg>',h=c.firstElementChild;a.forEach(b=>{const g=escapeHtml(b),v=escapeHtml((SITE.dnsServers[b].name||b).toUpperCase()),p=document.createElement("div");p.className="card",p.setAttribute("data-app",b),p.setAttribute("data-status","off"),p.innerHTML=`<span id="${g}-dot" class="dot bad at-bl"></span><div class="row"><div class="logo-wrap">${m}</div><span class="name">${v}</span><span class="spacer"></span><span id="${g}-pill" class="badge off" data-i18n-live-status="binary">OFF</span></div><div class="response-row"><span id="${g}-time" class="response-time">--</span></div><div class="health-row" id="health-${g}"><span id="uptime-${g}" class="uptime-chip">--</span><div class="uptime-mini-bar"><div class="fill" id="uptime-bar-${g}" style="width: 0%"></div></div></div><div class="btn-row"><button id="${g}-restart" class="restart-btn" data-i18n="action.restart">Restart</button><button id="${g}-update" class="update-btn" title="Update DNS server">\u2B06\uFE0F</button><button id="${g}-open" data-i18n="action.open">OpLine truncated
+      `,document.body.appendChild(h),setTimeout(()=>{h.parentNode&&h.parentNode.removeChild(h)},1e4),!0}handleStorageUnavailable(){this.logError("Storage Unavailable","Local storage is not available");const h={data:{},getItem(b){return this.data[b]||null},setItem(b,g){this.data[b]=g},removeItem(b){delete this.data[b]},clear(){this.data={}}};return console.warn("[ErrorHandler] Using in-memory storage - progress will not persist"),h}sendToErrorTracking(h){}}u.ErrorHandler=o,console.log("[ErrorHandler] Module loaded")})(window),(function(){try{var o=typeof localStorage<"u"&&localStorage.getItem("dashcaddy-health-settings")||null;if(o){var m=JSON.parse(o);m.statsPollingInterval&&m.statsPollingInterval>=5&&m.statsPollingInterval<=3600&&(window.__DC_STATS_OVERRIDE=m.statsPollingInterval*1e3)}}catch{}})();const DC={NAME:"DashCaddy",POLL:{DASHBOARD:1e4,LOGS:3e3,STATS:typeof window<"u"&&window.__DC_STATS_OVERRIDE||5e3,WEATHER:6e5,HEALTH:1e3,DEPLOY_SSL:5e3},DELAYS:{BTN_RESET:2e3,RELOAD:5e3,MODAL_CLOSE:500,PORT_CHECK:500,DEPLOY_INIT:3e3},DEFAULTS:{DNS_PORT:"5380",SERVICE_PORT:"8080",TTL:300,CADDYFILE:"C:\\caddy\\Caddyfile"}},errorHandler=new ErrorHandler,_cachedCfg=JSON.parse(localStorage.getItem("dashcaddy_site_config")||"null"),SITE={tld:_cachedCfg&&_cachedCfg.tld||".home",dnsIp:"",dnsPort:DC.DEFAULTS.DNS_PORT,dnsServers:{},configurationType:_cachedCfg&&_cachedCfg.configurationType||"homelab",domain:_cachedCfg&&_cachedCfg.domain||"",defaults:_cachedCfg&&_cachedCfg.defaults||{},routingMode:_cachedCfg&&_cachedCfg.routingMode||"subdomain",onboardingCompleted:!1};window.__dashcaddySiteConfigLoaded=(async function(){try{const h=await fetch("/api/v1/config");if(h.ok){const b=await h.json();if(b.tld&&(SITE.tld=b.tld.startsWith(".")?b.tld:"."+b.tld),b.dns&&(SITE.dnsIp=b.dns.ip||"",SITE.dnsPort=b.dns.port||DC.DEFAULTS.DNS_PORT),b.dnsServers&&typeof b.dnsServers=="object")for(const[v,p]of Object.entries(b.dnsServers))v!=="__proto__"&&v!=="constructor"&&v!=="prototype"&&(SITE.dnsServers[v]=p);b.configurationType&&(SITE.configurationType=b.configurationType),b.domain&&(SITE.domain=b.domain),b.defaults&&(SITE.defaults=b.defaults),b.routingMode&&(SITE.routingMode=b.routingMode),SITE.onboardingCompleted=b.onboardingCompleted===!0,localStorage.setItem("dashcaddy_site_config",JSON.stringify({tld:SITE.tld,configurationType:SITE.configurationType,domain:SITE.domain,routingMode:SITE.routingMode})),renderDnsCards();const g=document.getElementById("manage-tokens");g&&(g.style.display=Object.keys(SITE.dnsServers).length?"":"none")}}catch{}document.querySelectorAll("[data-tld]").forEach(h=>h.textContent=SITE.tld);const o=document.getElementById("edit-tld-suffix");o&&(o.textContent=SITE.tld);const m=document.getElementById("external-proxy-ip");m&&SITE.dnsIp&&(m.value=SITE.dnsIp,m.placeholder=SITE.dnsIp)})();function buildDomain(u){return u+SITE.tld}function buildServiceUrl(u){return SITE.routingMode==="subdirectory"&&SITE.domain?"https://"+SITE.domain+"/"+u:SITE.configurationType==="public"&&SITE.domain?"https://"+u+"."+SITE.domain:"https://"+buildDomain(u)}function getDnsServerAddr(u){const o=SITE.dnsServers[u];return o?`${o.ip}:${o.port}`:buildDomain(u)}function getPrimaryDnsId(){if(!SITE.dnsIp)return null;for(const[u,o]of Object.entries(SITE.dnsServers))if(o.ip===SITE.dnsIp)return u;return null}function renderDnsCards(){const u=document.querySelector(".top");if(!u)return;const o=Object.keys(SITE.dnsServers);if(!o.length)return;const m='<svg viewBox="0 0 24 24" class="service-icon"><rect x="3" y="4" width="18" height="16" rx="2" fill="#34495e"/><rect x="5" y="6" width="14" height="2" rx="1" fill="#3498db"/><rect x="5" y="9" width="10" height="1" fill="#ecf0f1"/><rect x="5" y="11" width="12" height="1" fill="#ecf0f1"/><rect x="5" y="13" width="8" height="1" fill="#ecf0f1"/><rect x="5" y="15" width="14" height="1" fill="#ecf0f1"/><circle cx="17" cy="11" r="2" fill="#e74c3c"/><path d="M17 9v4M15 11h4" stroke="white" stroke-width="1"/></svg>',h=u.firstElementChild;o.forEach(b=>{const g=escapeHtml(b),v=escapeHtml((SITE.dnsServers[b].name||b).toUpperCase()),p=document.createElement("div");p.className="card",p.setAttribute("data-app",b),p.setAttribute("data-status","off"),p.innerHTML=`<span id="${g}-dot" class="dot bad at-bl"></span><div class="row"><div class="logo-wrap">${m}</div><span class="name">${v}</span><span class="spacer"></span><span id="${g}-pill" class="badge off" data-i18n-live-status="binary">OFF</span></div><div class="response-row"><span id="${g}-time" class="response-time">--</span></div><div class="health-row" id="health-${g}"><span id="uptime-${g}" class="uptime-chip">--</span><div class="uptime-mini-bar"><div class="fill" id="uptime-bar-${g}" style="width: 0%"></div></div></div><div class="btn-row"><button id="${g}-restart" class="restart-btn" data-i18n="action.restart">Restart</button><button id="${g}-update" class="update-btn" title="Update DNS server">\u2B06\uFE0F</button><button id="${g}-open" data-i18n="action.open">OpLine truncated
     position: fixed; top: 20px; right: 20px;
     background: ${g.bg}; color: ${g.fg};
     padding: 16px 24px; border-radius: 8px;
     box-shadow: 0 4px 12px rgba(0,0,0,.3);
     z-index: 10000; animation: slideIn 0.3s ease-out;
     max-width: 400px; white-space: pre-line; font-size: 14px;
-  `,document.body.appendChild(v),m>0&&setTimeout(()=>v.remove(),m)}function timeAgo(c){const a=Date.now()-new Date(c).getTime();return a<6e4?"just now":a<36e5?Math.floor(a/6e4)+"m ago":a<864e5?Math.floor(a/36e5)+"h ago":Math.floor(a/864e5)+"d ago"}function safeGet(c,a=null){try{const m=localStorage.getItem(c);return m!==null?m:a}catch{return a}}function safeSet(c,a){try{localStorage.setItem(c,a)}catch{}}function safeRemove(c){try{localStorage.removeItem(c)}catch{}}function safeSessionGet(c,a=null){try{const m=sessionStorage.getItem(c);return m!==null?m:a}catch{return a}}function safeSessionSet(c,a){try{sessionStorage.setItem(c,a)}catch{}}function safeGetJSON(c,a=null){try{const m=localStorage.getItem(c);return m?JSON.parse(m):a}catch{return a}}function escapeHtml(c){return String(c??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function injectModal(c,a){document.getElementById(c)||document.body.insertAdjacentHTML("beforeend",a)}const DC_BUS={_handlers:{},on(c,a){var m;((m=this._handlers)[c]||(m[c]=[])).push(a)},off(c,a){this._handlers[c]=this._handlers[c]?.filter(m=>m!==a)},emit(c,a){this._handlers[c]?.forEach(m=>m(a))}},AppState={_apps:[],getApps(){return this._apps},setApps(c){this._apps=c,window.APPS=c,DC_BUS.emit("apps:changed",c)},findApp(c){return this._apps.find(a=>a.id===c)},addApp(c){this._apps.push(c),window.APPS=this._apps,DC_BUS.emit("apps:changed",this._apps)},removeApp(c){const a=this._apps.findIndex(m=>m.id===c);return a>-1&&(this._apps.splice(a,1),window.APPS=this._apps,DC_BUS.emit("apps:changed",this._apps)),a>-1},updateApp(c,a){const m=this._apps.find(h=>h.id===c);if(m){for(const[h,b]of Object.entries(a))h!=="__proto__"&&h!=="constructor"&&h!=="prototype"&&(m[h]=b);DC_BUS.emit("apps:changed",this._apps)}return m}};(function(){function c(){const h=document.createElement("div");return h.className="skeleton-card",h.innerHTML='<div style="display:flex;align-items:center;gap:12px;margin-bottom:12px"><div class="skeleton-bar" style="width:48px;height:48px;border-radius:8px;flex-shrink:0"></div><div style="flex:1"><div class="skeleton-bar" style="width:60%;height:14px;margin-bottom:6px"></div><div class="skeleton-bar" style="width:35%;height:10px"></div></div><div class="skeleton-bar" style="width:42px;height:22px;border-radius:11px"></div></div><div class="skeleton-bar" style="width:45%;height:12px;margin-bottom:10px"></div><div style="display:flex;gap:8px;margin-top:auto"><div class="skeleton-bar" style="width:64px;height:28px;border-radius:8px"></div><div class="skeleton-bar" style="width:64px;height:28px;border-radius:8px"></div></div>',h}function a(h){const b=document.getElementById("cards");if(!(!b||b.querySelector(".card"))){h=h||6;for(let g=0;g<h;g++){const v=c();b.appendChild(v),setTimeout(function(){v.classList.add("loaded")},g*60)}}}function m(){const h=document.getElementById("cards");if(h){var b=h.querySelectorAll(".skeleton-card");b.length&&(b.forEach(function(g,v){setTimeout(function(){g.style.opacity="0",g.style.transform="translateY(-10px)"},v*25)}),setTimeout(function(){b.forEach(function(g){g.parentNode&&g.remove()})},b.length*25+300))}}window.SkeletonLoader={show:a,hide:m}})(),(function(){var c="theme",a="user-themes",m="custom-theme",h=["dark","light","blue","black","nord","dracula","solarized-dark","solarized-light","taxi","ocean"],b=h.slice(),g=["bg","fg","muted","fg-muted","card-base","card-bg","border","hover","card-hover","base","ok-bg","ok-fg","bad-bg","bad-fg","dot-ok","dot-bad","uptime","success","error","warning","accent","accent-strong"],v=["bg","fg","muted","card-base","card-bg","border","ok-bg","ok-fg","bad-bg","bad-fg","dot-ok","dot-bad","uptime","accent","accent-strong"],p=["fg-muted","hover","card-hover","base","success","error","warning"],d={dark:{bg:"#0b0f1a",fg:"#e8ecf5",muted:"#9aa6bf","fg-muted":"#6b7a94","card-base":"#121826","card-bg":"#121826",border:"#263552",hover:"#1a2235","card-hover":"#161e2e",base:"#151c2b","ok-bg":"#0c2430","ok-fg":"#7ef2ff","bad-bg":"#2a121a","bad-fg":"#ff9aa3","dot-ok":"#35d1ff","dot-bad":"#ff5f7a",uptime:"#35d1ff",success:"#4caf50",error:"#e74c3c",warning:"#f39c12",accent:"#8FD6FF","accent-strong":"#1F7BFF"},light:{bg:"#f6f7fb",fg:"#0f1115",muted:"#5f6b7a","fg-muted":"#8993a4","card-base":"#ffffff","card-bg":"#ffffff",border:"#e2e7ef",hover:"#eef1f6","card-hover":"#f5f6fa",base:"#ebeef3","ok-bg":"#eafff1","ok-fg":"#0a7c3a","bad-bg":"#ffefef","bad-fg":"#b00020","dot-ok":"#0fb15a","dot-bad":"#d93b3b",uptime:"#0fb15a",success:"#0a7c3a",error:"#b00020",warning:"#d68a00",accent:"#4a90d9","accent-strong":"#2563eb",lightBg:!0},blue:{bg:"#1908AC",fg:"#e8f1ff",muted:"#d6e2ff","fg-muted":"#9eafdb","card-base":"#0d1533","card-bg":"#0d1533",border:"#1c2d6a",hover:"#141f4a","card-hover":"#111a3e",base:"#0f1840","ok-bg":"#162040","ok-fg":"#edffff","bad-bg":"#0a0e24","bad-fg":"#ffb3c0","dot-ok":"#c7e5ff","dot-bad":"#ffd6dc",uptime:"#7ec8ff",success:"#7ec8ff",error:"#ffb3c0",
Line truncated
+  `,document.body.appendChild(v),m>0&&setTimeout(()=>v.remove(),m)}function timeAgo(u){const o=Date.now()-new Date(u).getTime();return o<6e4?"just now":o<36e5?Math.floor(o/6e4)+"m ago":o<864e5?Math.floor(o/36e5)+"h ago":Math.floor(o/864e5)+"d ago"}function safeGet(u,o=null){try{const m=localStorage.getItem(u);return m!==null?m:o}catch{return o}}function safeSet(u,o){try{localStorage.setItem(u,o)}catch{}}function safeRemove(u){try{localStorage.removeItem(u)}catch{}}function safeSessionGet(u,o=null){try{const m=sessionStorage.getItem(u);return m!==null?m:o}catch{return o}}function safeSessionSet(u,o){try{sessionStorage.setItem(u,o)}catch{}}function safeGetJSON(u,o=null){try{const m=localStorage.getItem(u);return m?JSON.parse(m):o}catch{return o}}function escapeHtml(u){return String(u??"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function injectModal(u,o){document.getElementById(u)||document.body.insertAdjacentHTML("beforeend",o)}const DC_BUS={_handlers:{},on(u,o){var m;((m=this._handlers)[u]||(m[u]=[])).push(o)},off(u,o){this._handlers[u]=this._handlers[u]?.filter(m=>m!==o)},emit(u,o){this._handlers[u]?.forEach(m=>m(o))}},AppState={_apps:[],getApps(){return this._apps},setApps(u){this._apps=u,window.APPS=u,DC_BUS.emit("apps:changed",u)},findApp(u){return this._apps.find(o=>o.id===u)},addApp(u){this._apps.push(u),window.APPS=this._apps,DC_BUS.emit("apps:changed",this._apps)},removeApp(u){const o=this._apps.findIndex(m=>m.id===u);return o>-1&&(this._apps.splice(o,1),window.APPS=this._apps,DC_BUS.emit("apps:changed",this._apps)),o>-1},updateApp(u,o){const m=this._apps.find(h=>h.id===u);if(m){for(const[h,b]of Object.entries(o))h!=="__proto__"&&h!=="constructor"&&h!=="prototype"&&(m[h]=b);DC_BUS.emit("apps:changed",this._apps)}return m}};(function(){function u(){const h=document.createElement("div");return h.className="skeleton-card",h.innerHTML='<div style="display:flex;align-items:center;gap:12px;margin-bottom:12px"><div class="skeleton-bar" style="width:48px;height:48px;border-radius:8px;flex-shrink:0"></div><div style="flex:1"><div class="skeleton-bar" style="width:60%;height:14px;margin-bottom:6px"></div><div class="skeleton-bar" style="width:35%;height:10px"></div></div><div class="skeleton-bar" style="width:42px;height:22px;border-radius:11px"></div></div><div class="skeleton-bar" style="width:45%;height:12px;margin-bottom:10px"></div><div style="display:flex;gap:8px;margin-top:auto"><div class="skeleton-bar" style="width:64px;height:28px;border-radius:8px"></div><div class="skeleton-bar" style="width:64px;height:28px;border-radius:8px"></div></div>',h}function o(h){const b=document.getElementById("cards");if(!(!b||b.querySelector(".card"))){h=h||6;for(let g=0;g<h;g++){const v=u();b.appendChild(v),setTimeout(function(){v.classList.add("loaded")},g*60)}}}function m(){const h=document.getElementById("cards");if(h){var b=h.querySelectorAll(".skeleton-card");b.length&&(b.forEach(function(g,v){setTimeout(function(){g.style.opacity="0",g.style.transform="translateY(-10px)"},v*25)}),setTimeout(function(){b.forEach(function(g){g.parentNode&&g.remove()})},b.length*25+300))}}window.SkeletonLoader={show:o,hide:m}})(),(function(){var u="theme",o="user-themes",m="custom-theme",h=["dark","light","blue","black","nord","dracula","solarized-dark","solarized-light","taxi","ocean"],b=h.slice(),g=["bg","fg","muted","fg-muted","card-base","card-bg","border","hover","card-hover","base","ok-bg","ok-fg","bad-bg","bad-fg","dot-ok","dot-bad","uptime","success","error","warning","accent","accent-strong"],v=["bg","fg","muted","card-base","card-bg","border","ok-bg","ok-fg","bad-bg","bad-fg","dot-ok","dot-bad","uptime","accent","accent-strong"],p=["fg-muted","hover","card-hover","base","success","error","warning"],c={dark:{bg:"#0b0f1a",fg:"#e8ecf5",muted:"#9aa6bf","fg-muted":"#6b7a94","card-base":"#121826","card-bg":"#121826",border:"#263552",hover:"#1a2235","card-hover":"#161e2e",base:"#151c2b","ok-bg":"#0c2430","ok-fg":"#7ef2ff","bad-bg":"#2a121a","bad-fg":"#ff9aa3","dot-ok":"#35d1ff","dot-bad":"#ff5f7a",uptime:"#35d1ff",success:"#4caf50",error:"#e74c3c",warning:"#f39c12",accent:"#8FD6FF","accent-strong":"#1F7BFF"},light:{bg:"#f6f7fb",fg:"#0f1115",muted:"#5f6b7a","fg-muted":"#8993a4","card-base":"#ffffff","card-bg":"#ffffff",border:"#e2e7ef",hover:"#eef1f6","card-hover":"#f5f6fa",base:"#ebeef3","ok-bg":"#eafff1","ok-fg":"#0a7c3a","bad-bg":"#ffefef","bad-fg":"#b00020","dot-ok":"#0fb15a","dot-bad":"#d93b3b",uptime:"#0fb15a",success:"#0a7c3a",error:"#b00020",warning:"#d68a00",accent:"#4a90d9","accent-strong":"#2563eb",lightBg:!0},blue:{bg:"#1908AC",fg:"#e8f1ff",muted:"#d6e2ff","fg-muted":"#9eafdb","card-base":"#0d1533","card-bg":"#0d1533",border:"#1c2d6a",hover:"#141f4a","card-hover":"#111a3e",base:"#0f1840","ok-bg":"#162040","ok-fg":"#edffff","bad-bg":"#0a0e24","bad-fg":"#ffb3c0","dot-ok":"#c7e5ff","dot-bad":"#ffd6dc",uptime:"#7ec8ff",success:"#7ec8ff",error:"#ffb3c0",
Line truncated
   background:
-    radial-gradient(1200px 800px at 10% -10%, rgba(`+C.r+","+C.g+","+C.b+`, .08), transparent 60%),
-    radial-gradient(1000px 700px at 110% 10%, rgba(`+C.r+","+C.g+","+C.b+`, .05), transparent 55%),
+    radial-gradient(1200px 800px at 10% -10%, rgba(`+k.r+","+k.g+","+k.b+`, .08), transparent 60%),
+    radial-gradient(1000px 700px at 110% 10%, rgba(`+k.r+","+k.g+","+k.b+`, .05), transparent 55%),
     var(--bg);
 }
-`:":root."+x+` body {
+`:":root."+w+` body {
   background:
-    radial-gradient(1200px 900px at 8% -12%, rgba(`+C.r+","+C.g+","+C.b+`, .10), transparent 60%),
-    radial-gradient(1000px 700px at 110% -10%, rgba(`+C.r+","+C.g+","+C.b+`, .07), transparent 55%),
+    radial-gradient(1200px 900px at 8% -12%, rgba(`+k.r+","+k.g+","+k.b+`, .10), transparent 60%),
+    radial-gradient(1000px 700px at 110% -10%, rgba(`+k.r+","+k.g+","+k.b+`, .07), transparent 55%),
     var(--bg);
 }
-`}function o(x,B){var A=B.lightBg||B.bg&&s(B.bg)>.4;return A?":root."+x+` button:hover {
+`}function t(w,L){var A=L.lightBg||L.bg&&r(L.bg)>.4;return A?":root."+w+` button:hover {
   background: color-mix(in srgb, var(--accent-strong) 12%, white 88%);
   border-color: rgba(0, 0, 0, .15);
   box-shadow: 0 1px 6px rgba(0, 0, 0, .08), inset 0 1px 0 rgba(255, 255, 255, .8);
 }
-`:":root."+x+` button:hover {
+`:":root."+w+` button:hover {
   background: color-mix(in srgb, var(--accent) 18%, transparent);
   border-color: color-mix(in srgb, var(--accent) 35%, var(--border));
 }
-`}function u(){return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}function n(){g.forEach(function(x){document.documentElement.style.removeProperty("--"+x)})}function i(x,B){var A=x.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"");A||(A="custom"),h.indexOf(A)!==-1&&(A=A+"-custom");for(var E=safeGetJSON(a,{}),C=A,T=2;E[A]&&A!==B;)A=C+"-"+T++;return A}function l(x){var B=document.getElementById("user-theme-styles");B&&B.remove(),b.length=h.length,Object.keys(d).forEach(function($){h.indexOf($)===-1&&delete d[$]});var A=x||safeGetJSON(a,{}),E=Object.keys(A);if(E=E.filter(function($){return h.indexOf($)===-1}),!!E.length){var C="";E.forEach(function($){var I=A[$];b.indexOf($)===-1&&b.push($);var P={};g.forEach(function(O){I[O]&&(P[O]=I[O])}),P["card-bg"]=I["card-base"]||I.bg,I.lightBg&&(P.lightBg=!0);var D=t(P);p.forEach(function(O){!P[O]&&D[O]&&(P[O]=D[O])}),d[$]=P,C+=":root."+$+` {
-`,g.forEach(function(O){P[O]&&(C+="  --"+O+": "+P[O]+`;
-`)}),C+=`}
-`,C+=e($,P),C+=o($,P)});var T=document.createElement("style");T.id="user-theme-styles",T.textContent=C,document.head.appendChild(T)}}function y(){secureFetch("/api/v1/themes").then(function(x){return x.json()}).then(function(x){if(!(!x.success||!x.themes)){var B=x.themes,A=safeGetJSON(a,{});if(JSON.stringify(B)!==JSON.stringify(A)){safeSet(a,JSON.stringify(B)),l(B);var E=safeGet(c);E&&b.indexOf(E)!==-1&&k(E)}}}).catch(function(){})}function S(){var x=safeGetJSON(m);if(x){var B=x.name||"Custom",A=i(B),E={name:B};g.forEach(function($){x[$]&&(E[$]=x[$])});var C=safeGetJSON(a,{});C[A]=E,safeSet(a,JSON.stringify(C)),safeGet(c)==="custom"&&safeSet(c,A),safeRemove(m);var T={};g.forEach(function($){E[$]&&(T[$]=E[$])}),fetch("/api/v1/themes/"+A,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:B,colors:T})}).catch(function(){})}}function k(x){document.documentElement.classList.add("theme-transitioning"),b.forEach(function(C){C!=="dark"&&document.documentElement.classList.remove(C)}),n(),x!=="dark"&&document.documentElement.classList.add(x),safeSet(c,x);var B=d[x],A=document.querySelector('meta[name="theme-color"]');A&&B&&A.setAttribute("content",B.bg);var E=B&&B.lightBg;!E&&B&&B.bg&&(E=s(B.bg)>.4),E?document.documentElement.classList.add("light-bg"):document.documentElement.classList.remove("light-bg"),setTimeout(function(){document.documentElement.classList.remove("theme-transitioning")},300)}S(),l();var L=safeGet(c);L==="red"&&(L="black",safeSet(c,"black")),L&&L!=="dark"&&b.indexOf(L)===-1&&(L=null),k(L||u()),y(),window.matchMedia("(prefers-color-scheme: dark)").addEventListener("change",function(x){safeGet(c)||k(x.matches?"dark":"light")}),window.THEMES=b,window.BUILTIN_THEMES=h,window.THEME_COLORS=d,window.THEME_PROPS=g,window.BASE_PROPS=v,window.DERIVED_PROPS=p,window.USER_THEMES_KEY=a,window.applyTheme=k,window.clearCustomProperties=n,window.injectUserThemeStyles=l,window.syncThemesFromServer=y,window.slugifyThemeName=i,window.getActiveTheme=function(){return safeGet(c)||u()},window.deriveExtendedColors=t,window.hexToRgb=r,window.rgbToHex=f,window.blendColors=w})(),(function(){let c=null;async function a(){if(c)return c;try{const w=await fetch("/api/v1/auth/login/methods",{cache:"no-store"});if(!w.ok)throw new Error(`methods HTTP ${w.status}`);const s=await w.json();return c=Array.isArray(s.providers)?s.providers:[],c}catch(w){return console.warn("[auth-gate] methods fetch failed; falling back to TOTP-only",w),[]}}function m(w){const s=document.getElementById("totp-overlay");if(!s)return;const t=s.querySelector(".totp-card");if(!t)return;const e=t.innerHTML;t.dataset.originalBody||(t.dataset.originalBody=e);const o=w.map(u=>{const n=u.config&&(u.config.label||u.name)||u.name;return`<button class="provider-btn" data-provider="${u.name}"
+`}function i(){return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}function n(){g.forEach(function(w){document.documentElement.style.removeProperty("--"+w)})}function d(w,L){var A=w.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"");A||(A="custom"),h.indexOf(A)!==-1&&(A=A+"-custom");for(var E=safeGetJSON(o,{}),k=A,B=2;E[A]&&A!==L;)A=k+"-"+B++;return A}function l(w){var L=document.getElementById("user-theme-styles");L&&L.remove(),b.length=h.length,Object.keys(c).forEach(function($){h.indexOf($)===-1&&delete c[$]});var A=w||safeGetJSON(o,{}),E=Object.keys(A);if(E=E.filter(function($){return h.indexOf($)===-1}),!!E.length){var k="";E.forEach(function($){var I=A[$];b.indexOf($)===-1&&b.push($);var P={};g.forEach(function(O){I[O]&&(P[O]=I[O])}),P["card-bg"]=I["card-base"]||I.bg,I.lightBg&&(P.lightBg=!0);var D=a(P);p.forEach(function(O){!P[O]&&D[O]&&(P[O]=D[O])}),c[$]=P,k+=":root."+$+` {
+`,g.forEach(function(O){P[O]&&(k+="  --"+O+": "+P[O]+`;
+`)}),k+=`}
+`,k+=e($,P),k+=t($,P)});var B=document.createElement("style");B.id="user-theme-styles",B.textContent=k,document.head.appendChild(B)}}function f(){secureFetch("/api/v1/themes").then(function(w){return w.json()}).then(function(w){if(!(!w.success||!w.themes)){var L=w.themes,A=safeGetJSON(o,{});if(JSON.stringify(L)!==JSON.stringify(A)){safeSet(o,JSON.stringify(L)),l(L);var E=safeGet(u);E&&b.indexOf(E)!==-1&&S(E)}}}).catch(function(){})}function C(){var w=safeGetJSON(m);if(w){var L=w.name||"Custom",A=d(L),E={name:L};g.forEach(function($){w[$]&&(E[$]=w[$])});var k=safeGetJSON(o,{});k[A]=E,safeSet(o,JSON.stringify(k)),safeGet(u)==="custom"&&safeSet(u,A),safeRemove(m);var B={};g.forEach(function($){E[$]&&(B[$]=E[$])}),fetch("/api/v1/themes/"+A,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:L,colors:B})}).catch(function(){})}}function S(w){document.documentElement.classList.add("theme-transitioning"),b.forEach(function(k){k!=="dark"&&document.documentElement.classList.remove(k)}),n(),w!=="dark"&&document.documentElement.classList.add(w),safeSet(u,w);var L=c[w],A=document.querySelector('meta[name="theme-color"]');A&&L&&A.setAttribute("content",L.bg);var E=L&&L.lightBg;!E&&L&&L.bg&&(E=r(L.bg)>.4),E?document.documentElement.classList.add("light-bg"):document.documentElement.classList.remove("light-bg"),setTimeout(function(){document.documentElement.classList.remove("theme-transitioning")},300)}C(),l();var T=safeGet(u);T==="red"&&(T="black",safeSet(u,"black")),T&&T!=="dark"&&b.indexOf(T)===-1&&(T=null),S(T||i()),f(),window.matchMedia("(prefers-color-scheme: dark)").addEventListener("change",function(w){safeGet(u)||S(w.matches?"dark":"light")}),window.THEMES=b,window.BUILTIN_THEMES=h,window.THEME_COLORS=c,window.THEME_PROPS=g,window.BASE_PROPS=v,window.DERIVED_PROPS=p,window.USER_THEMES_KEY=o,window.applyTheme=S,window.clearCustomProperties=n,window.injectUserThemeStyles=l,window.syncThemesFromServer=f,window.slugifyThemeName=d,window.getActiveTheme=function(){return safeGet(u)||i()},window.deriveExtendedColors=a,window.hexToRgb=s,window.rgbToHex=y,window.blendColors=x})(),(function(){let u=null;async function o(){if(u)return u;try{const x=await fetch("/api/v1/auth/login/methods",{cache:"no-store"});if(!x.ok)throw new Error(`methods HTTP ${x.status}`);const r=await x.json();return u=Array.isArray(r.providers)?r.providers:[],u}catch(x){return console.warn("[auth-gate] methods fetch failed; falling back to TOTP-only",x),[]}}function m(x){const r=document.getElementById("totp-overlay");if(!r)return;const a=r.querySelector(".totp-card");if(!a)return;const e=a.innerHTML;a.dataset.originalBody||(a.dataset.originalBody=e);const t=x.map(i=>{const n=i.config&&(i.config.label||i.name)||i.name;return`<button class="provider-btn" data-provider="${i.name}"
                           style="margin: 6px 4px; padding: 10px 16px; background: var(--accent); color: white; border: 0; border-radius: 6px; cursor: pointer; font-size: 0.95rem;">
         Sign in with ${n}
       </button>`}).join(`
-`);t.innerHTML=`
+`);a.innerHTML=`
       <img class="totp-logo totp-logo-dark" src="/assets/dashcaddy-logo-dark.png" alt="DashCaddy" onerror="this.style.display='none'">
       <img class="totp-logo totp-logo-light" src="/assets/dashcaddy-logo-light.png" alt="DashCaddy" onerror="this.style.display='none'">
       <p class="subtitle">Choose how to sign in</p>
-      <div id="auth-gate-providers" style="margin: 14px 0 10px;">${o}</div>
+      <div id="auth-gate-providers" style="margin: 14px 0 10px;">${t}</div>
       <div id="auth-gate-message" style="margin-top: 8px; color: var(--muted); font-size: 0.8rem;"></div>
-    `,s.classList.add("show"),t.querySelectorAll(".provider-btn").forEach(u=>{u.addEventListener("click",()=>{const n=u.dataset.provider,i=w.find(l=>l.name===n);b(i)})})}function h(){const w=document.getElementById("totp-overlay");if(!w)return;const s=w.querySelector(".totp-card");!s||!s.dataset.originalBody||(s.innerHTML=s.dataset.originalBody,window.location.reload())}function b(w){const s=document.getElementById("totp-overlay");if(!s)return;const t=s.querySelector(".totp-card");if(t){if(w.name==="totp"){window.location.reload();return}if(w.name==="email"){t.innerHTML=`
+    `,r.classList.add("show"),a.querySelectorAll(".provider-btn").forEach(i=>{i.addEventListener("click",()=>{const n=i.dataset.provider,d=x.find(l=>l.name===n);b(d)})})}function h(){const x=document.getElementById("totp-overlay");if(!x)return;const r=x.querySelector(".totp-card");!r||!r.dataset.originalBody||(r.innerHTML=r.dataset.originalBody,window.location.reload())}function b(x){const r=document.getElementById("totp-overlay");if(!r)return;const a=r.querySelector(".totp-card");if(a){if(x.name==="totp"){window.location.reload();return}if(x.name==="email"){a.innerHTML=`
         <img class="totp-logo totp-logo-dark" src="/assets/dashcaddy-logo-dark.png" alt="DashCaddy" onerror="this.style.display='none'">
         <img class="totp-logo totp-logo-light" src="/assets/dashcaddy-logo-light.png" alt="DashCaddy" onerror="this.style.display='none'">
         <p class="subtitle">Sign in with email</p>
@@ -75,13 +75,13 @@
         <div style="margin-top: 16px;">
           <a href="#" id="auth-gate-back" style="color: var(--muted); font-size: 0.8rem;">\u2190 Back</a>
         </div>
-      `,s.classList.add("show");const e=t.querySelector("#auth-gate-email-input"),o=t.querySelector("#auth-gate-email-submit"),u=t.querySelector("#auth-gate-email-status"),n=t.querySelector("#auth-gate-back");o.addEventListener("click",async()=>{const i=(e.value||"").trim();if(!i||!i.includes("@")){u.textContent="Enter a valid email address.",u.style.color="var(--error, #d33)";return}o.disabled=!0,u.textContent="Sending\u2026",u.style.color="";try{const y=await(await fetch("/api/v1/auth/login/email/initiate",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:i})})).json();if(y.success){const S=y.deliveredVia||"email",k=y.maskedEmail||i;S==="dev-console"?u.innerHTML=`
+      `,r.classList.add("show");const e=a.querySelector("#auth-gate-email-input"),t=a.querySelector("#auth-gate-email-submit"),i=a.querySelector("#auth-gate-email-status"),n=a.querySelector("#auth-gate-back");t.addEventListener("click",async()=>{const d=(e.value||"").trim();if(!d||!d.includes("@")){i.textContent="Enter a valid email address.",i.style.color="var(--error, #d33)";return}t.disabled=!0,i.textContent="Sending\u2026",i.style.color="";try{const f=await(await fetch("/api/v1/auth/login/email/initiate",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:d})})).json();if(f.success){const C=f.deliveredVia||"email",S=f.maskedEmail||d;C==="dev-console"?i.innerHTML=`
                 Check the server logs for your one-time link.
-                (Dev mode: no SMTP configured. In production this would email <strong>${k}</strong>.)`:u.innerHTML=`Sign-in link sent to <strong>${k}</strong>.
-                Check your inbox (and spam folder).`,u.style.color="var(--success, #2a7)"}else u.textContent=y.error||"Could not send link.",u.style.color="var(--error, #d33)",o.disabled=!1}catch{u.textContent="Connection error. Try again.",u.style.color="var(--error, #d33)",o.disabled=!1}}),e.addEventListener("keydown",i=>{i.key==="Enter"&&o.click()}),n.addEventListener("click",i=>{i.preventDefault(),m(providers)});return}console.warn("[auth-gate] unknown provider",w.name),window.location.reload()}}async function g(){if(!document.getElementById("totp-overlay"))return;const s=await a();if(s.length===0){typeof window._showTotpOverlay=="function"&&window._showTotpOverlay();return}if(s.length===1&&s[0].name==="totp"){v(s[0]);return}m(s)}function v(w){const s=c&&c.find(u=>u.name==="email");if(!s){typeof window._showTotpOverlay=="function"&&window._showTotpOverlay();return}const t=document.getElementById("totp-overlay"),e=t.querySelector(".totp-card");if(!e)return;if(e.dataset.originalBody||(e.dataset.originalBody=e.innerHTML),!e.querySelector("#auth-gate-email-alt")){const u=document.createElement("div");u.id="auth-gate-email-alt",u.style.cssText="margin-top: 18px; padding-top: 14px; border-top: 1px solid var(--border); font-size: 0.85rem;",u.innerHTML=`<a href="#" id="auth-gate-email-alt-link"
+                (Dev mode: no SMTP configured. In production this would email <strong>${S}</strong>.)`:i.innerHTML=`Sign-in link sent to <strong>${S}</strong>.
+                Check your inbox (and spam folder).`,i.style.color="var(--success, #2a7)"}else i.textContent=f.error||"Could not send link.",i.style.color="var(--error, #d33)",t.disabled=!1}catch{i.textContent="Connection error. Try again.",i.style.color="var(--error, #d33)",t.disabled=!1}}),e.addEventListener("keydown",d=>{d.key==="Enter"&&t.click()}),n.addEventListener("click",d=>{d.preventDefault(),m(providers)});return}console.warn("[auth-gate] unknown provider",x.name),window.location.reload()}}async function g(){if(!document.getElementById("totp-overlay"))return;const r=await o();if(r.length===0){typeof window._showTotpOverlay=="function"&&window._showTotpOverlay();return}if(r.length===1&&r[0].name==="totp"){v(r[0]);return}m(r)}function v(x){const r=u&&u.find(i=>i.name==="email");if(!r){typeof window._showTotpOverlay=="function"&&window._showTotpOverlay();return}const a=document.getElementById("totp-overlay"),e=a.querySelector(".totp-card");if(!e)return;if(e.dataset.originalBody||(e.dataset.originalBody=e.innerHTML),!e.querySelector("#auth-gate-email-alt")){const i=document.createElement("div");i.id="auth-gate-email-alt",i.style.cssText="margin-top: 18px; padding-top: 14px; border-top: 1px solid var(--border); font-size: 0.85rem;",i.innerHTML=`<a href="#" id="auth-gate-email-alt-link"
         style="color: var(--accent); text-decoration: none;">
         Or sign in with email instead \u2192
-      </a>`,e.appendChild(u),u.querySelector("#auth-gate-email-alt-link").addEventListener("click",n=>{n.preventDefault(),b(s)})}t.classList.add("show")}window.__dc_049_handled=!0;function p(w){try{const s=new URL(w,window.location.origin);if(!["http:","https:"].includes(s.protocol))return!1;if(s.origin===window.location.origin)return!0;if(s.protocol!=="https:")return!1;const t=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`;return s.hostname===t.slice(1)||s.hostname.endsWith(t)}catch{return!1}}function d(w,s){const t=new URL(w,window.location.origin);if(t.origin===window.location.origin)return t.toString();const e=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,o=t.hostname===e.slice(1)||t.hostname.endsWith(e);if(t.protocol!=="https:"||!o||!s)return null;const u=`${t.pathname}${t.search}${t.hash}`;return t.pathname="/dashcaddy-sso",t.search="",t.hash="",t.searchParams.set("token",s),t.searchParams.set("return",u),t.toString()}async function r(w){if(!w||!p(w))return!1;try{const s=new URL(w,window.location.origin),t=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,e=s.hostname.slice(0,-t.length);if(!/^[a-z0-9][a-z0-9-]*$/.test(e))return!1;const o=await fetch(`/api/v1/auth/sso-handoff?serviceId=${encodeURIComponent(e)}`,{credentials:"include",cache:"no-store"});if(!o.ok)return!1;const u=await o.json(),n=u.success&&d(w,u.ssoToken);if(!n)return!1;try{sessionStorage.removeItem("totp_redirect")}catch{}return window.location.replace(n),!0}catch{return!1}}const f=new URLSearchParams(window.location.search);if(f.get("auth")==="required"){const w=f.get("return");if(w&&p(w))try{sessionStorage.setItem("totp_redirect",w)}catch{}window.history.replaceState({},"",window.location.pathname),setTimeout(async()=>{await r(w)||await g()},0)}window._showAuthGate=g,window._authGateMethods=a})(),(function(){function c(){const p=document.querySelector(".totp-card");if(!p)return;const r=getComputedStyle(p).backgroundColor.match(/\d+/g);if(!r)return;const f=(.299*+r[0]+.587*+r[1]+.114*+r[2])/255,w=p.querySelector(".totp-logo-dark"),s=p.querySelector(".totp-logo-light");w&&(w.style.display=f>.5?"none":""),s&&(s.style.display=f>.5?"":"none")}function a(){const p=document.getElementById("totp-overlay");if(p){p.classList.add("show"),setTimeout(c,50);const d=p.querySelector(".totp-digits input");d&&setTimeout(()=>d.focus(),100)}typeof window._refreshRecoveryLink=="function"&&window._refreshRecoveryLink()}function m(){const p=document.getElementById("totp-overlay");p&&p.classList.remove("show")}function h(p,d){const r=new URL(p,window.location.origin);if(r.origin===window.location.origin)return r.toString();const f=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,w=r.hostname===f.slice(1)||r.hostname.endsWith(f);if(r.protocol!=="https:"||!w)return null;if(!d)return r.toString();const s=`${r.pathname}${r.search}${r.hash}`;return r.pathname="/dashcaddy-sso",r.search="",r.hash="",r.searchParams.set("token",d),r.searchParams.set("return",s),r.toString()}const b=document.getElementById("totp-digits");if(b){const p=b.querySelectorAll("input");p.forEach((d,r)=>{d.addEventListener("input",f=>{const w=f.target.value.replace(/\D/g,"");f.target.value=w.slice(0,1),w&&r<p.length-1&&p[r+1].focus();const s=Array.from(p).map(t=>t.value).join("");s.length===6&&g(s)}),d.addEventListener("keydown",f=>{f.key==="Backspace"&&!f.target.value&&r>0&&(p[r-1].focus(),p[r-1].value="")}),d.addEventListener("paste",f=>{f.preventDefault();const w=(f.clipboardData.getData("text")||"").replace(/\D/g,"");w.length>=6&&(p.forEach((s,t)=>{s.value=w[t]||""}),p[5].focus(),g(w.slice(0,6)))})})}async function g(p){const d=document.getElementById("totp-error");d.textContent="Verifying...",d.className="totp-error verifying";const r=safeSessionGet("totp_redirect");let f=null;if(r)try{const w=new URL(r,window.location.origin),s=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,t=w.hostname.slice(0,-s.length);w.hostname.endsWith(s)&&/^[a-z0-9][a-z0-9-]*$/.test(t)&&(f=t)}catch{}try{const s=await(await secureFetch("/api/v1/totp/verify",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:p,serviceId:f})})).json();if(s.success){if(d.textContent="",s.csrfToken&&(csrfToken=s.csrfToken),m(),r){try{sessionStorage.removeItem("totp_redirect")}catch{}const t=h(r,s.ssoToken);if(!t)return;window.location.href=t;return}typeof window.initializeDashboard=="function"&&window.initializeDashboard(),window._dcAuthLost=!1,typeof window._sseResume=="function"?window._sseResume():typeof window._sseReconnect=="function"&&window._sseReconnect(),typeof window.refreshAll=="function"&&window.refreshAll()}else{d.textContent=s.error||"Invalid code",d.className="totp-error";const t=document.querySelectorAll("#totp-digits input");t.forEach(e=>{e.value=""}),t[0]?.focus()}}catch{d.textContent="Connection error",d.className="totp-error"}}if(!!!window.__dc_049_handled&&urlParams.get("auth")==="required"){const p=urlParams.get("return");if(p)try{const d=new URL(p,window.location.origin)Line truncated
+      </a>`,e.appendChild(i),i.querySelector("#auth-gate-email-alt-link").addEventListener("click",n=>{n.preventDefault(),b(r)})}a.classList.add("show")}window.__dc_049_handled=!0;function p(x){try{const r=new URL(x,window.location.origin);if(!["http:","https:"].includes(r.protocol))return!1;if(r.origin===window.location.origin)return!0;if(r.protocol!=="https:")return!1;const a=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`;return r.hostname===a.slice(1)||r.hostname.endsWith(a)}catch{return!1}}function c(x,r){const a=new URL(x,window.location.origin);if(a.origin===window.location.origin)return a.toString();const e=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,t=a.hostname===e.slice(1)||a.hostname.endsWith(e);if(a.protocol!=="https:"||!t||!r)return null;const i=`${a.pathname}${a.search}${a.hash}`;return a.pathname="/dashcaddy-sso",a.search="",a.hash="",a.searchParams.set("token",r),a.searchParams.set("return",i),a.toString()}async function s(x){if(!x||!p(x))return!1;try{const r=new URL(x,window.location.origin),a=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,e=r.hostname.slice(0,-a.length);if(!/^[a-z0-9][a-z0-9-]*$/.test(e))return!1;const t=await fetch(`/api/v1/auth/sso-handoff?serviceId=${encodeURIComponent(e)}`,{credentials:"include",cache:"no-store"});if(!t.ok)return!1;const i=await t.json(),n=i.success&&c(x,i.ssoToken);if(!n)return!1;try{sessionStorage.removeItem("totp_redirect")}catch{}return window.location.replace(n),!0}catch{return!1}}const y=new URLSearchParams(window.location.search);if(y.get("auth")==="required"){const x=y.get("return");if(x&&p(x))try{sessionStorage.setItem("totp_redirect",x)}catch{}window.history.replaceState({},"",window.location.pathname),setTimeout(async()=>{await s(x)||await g()},0)}window._showAuthGate=g,window._authGateMethods=o})(),(function(){function u(){const p=document.querySelector(".totp-card");if(!p)return;const s=getComputedStyle(p).backgroundColor.match(/\d+/g);if(!s)return;const y=(.299*+s[0]+.587*+s[1]+.114*+s[2])/255,x=p.querySelector(".totp-logo-dark"),r=p.querySelector(".totp-logo-light");x&&(x.style.display=y>.5?"none":""),r&&(r.style.display=y>.5?"":"none")}function o(){const p=document.getElementById("totp-overlay");if(p){p.classList.add("show"),setTimeout(u,50);const c=p.querySelector(".totp-digits input");c&&setTimeout(()=>c.focus(),100)}typeof window._refreshRecoveryLink=="function"&&window._refreshRecoveryLink()}function m(){const p=document.getElementById("totp-overlay");p&&p.classList.remove("show")}function h(p,c){const s=new URL(p,window.location.origin);if(s.origin===window.location.origin)return s.toString();const y=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,x=s.hostname===y.slice(1)||s.hostname.endsWith(y);if(s.protocol!=="https:"||!x)return null;if(!c)return s.toString();const r=`${s.pathname}${s.search}${s.hash}`;return s.pathname="/dashcaddy-sso",s.search="",s.hash="",s.searchParams.set("token",c),s.searchParams.set("return",r),s.toString()}const b=document.getElementById("totp-digits");if(b){const p=b.querySelectorAll("input");p.forEach((c,s)=>{c.addEventListener("input",y=>{const x=y.target.value.replace(/\D/g,"");y.target.value=x.slice(0,1),x&&s<p.length-1&&p[s+1].focus();const r=Array.from(p).map(a=>a.value).join("");r.length===6&&g(r)}),c.addEventListener("keydown",y=>{y.key==="Backspace"&&!y.target.value&&s>0&&(p[s-1].focus(),p[s-1].value="")}),c.addEventListener("paste",y=>{y.preventDefault();const x=(y.clipboardData.getData("text")||"").replace(/\D/g,"");x.length>=6&&(p.forEach((r,a)=>{r.value=x[a]||""}),p[5].focus(),g(x.slice(0,6)))})})}async function g(p){const c=document.getElementById("totp-error");c.textContent="Verifying...",c.className="totp-error verifying";const s=safeSessionGet("totp_redirect");let y=null;if(s)try{const x=new URL(s,window.location.origin),r=SITE.tld.startsWith(".")?SITE.tld:`.${SITE.tld}`,a=x.hostname.slice(0,-r.length);x.hostname.endsWith(r)&&/^[a-z0-9][a-z0-9-]*$/.test(a)&&(y=a)}catch{}try{const r=await(await secureFetch("/api/v1/totp/verify",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:p,serviceId:y})})).json();if(r.success){if(c.textContent="",r.csrfToken&&(csrfToken=r.csrfToken),m(),s){try{sessionStorage.removeItem("totp_redirect")}catch{}const a=h(s,r.ssoToken);if(!a)return;window.location.href=a;return}typeof window.initializeDashboard=="function"&&window.initializeDashboard(),window._dcAuthLost=!1,typeof window._sseResume=="function"?window._sseResume():typeof window._sseReconnect=="function"&&window._sseReconnect(),typeof window.refreshAll=="function"&&window.refreshAll()}else{c.textContent=r.error||"Invalid code",c.className="totp-error";const a=document.querySelectorAll("#totp-digits input");a.forEach(e=>{e.value=""}),a[0]?.focus()}}catch{c.textContent="Connection error",c.className="totp-error"}}if(!!!window.__dc_049_handled&&urlParams.get("auth")==="required"){const p=urlParams.get("return");if(p)try{const c=new URL(p,window.location.origin)Line truncated
     <div class="weather-modal-content" style="min-width: 500px; max-width: 700px; max-height: 80vh;">
       <h3>\u{1F4C2} Browse for Media Folders</h3>
 
@@ -179,7 +179,7 @@
         </button>
       </div>
     </div>
-  </div>`);const a=document.getElementById("service-creds-modal");let m=null,h=null,b=!1;const g=["sonarr","radarr","prowlarr","overseerr"],v=["sonarr","radarr"];function p(e){return e.externalUrl||e.url||""}function d(e){const o=document.getElementById("svc-creds-error");o.textContent=e,o.style.display=""}function r(){const e=document.getElementById("svc-creds-error");e.textContent="",e.style.display="none"}async function f(e,o){if(!e)throw new Error(`${o} failed: no response`);let u;try{u=await e.json()}catch{throw new Error(`${o} failed: invalid server response`)}if(!e.ok||u?.success!==!0)throw new Error(u?.error||`${o} failed (${e.status||"unknown status"})`);return u}function w(e,o){return!!window.DCCredentialVault?.isAllowedReturnUrl(e,o)}window.openServiceCredsModal=async function(e,o={}){m=e,h=w(o.returnUrl,e.id)?o.returnUrl:null,b=!1,r();const u=document.getElementById("svc-creds-title"),n=document.getElementById("svc-creds-desc"),i=document.getElementById("svc-creds-seedhost"),l=document.getElementById("svc-creds-apikey"),y=document.getElementById("svc-creds-basic"),S=document.getElementById("svc-creds-quality");u.textContent=e.name+" \u2014 Encrypted Vault",document.getElementById("svc-creds-save").textContent=h?"Save to vault & open service":"Save to encrypted vault";const k=!!e.isExternal,L=g.includes(e.id)||g.includes(e.appTemplate),x=v.includes(e.id)||v.includes(e.appTemplate);i.style.display=k?"":"none",l.style.display=L?"":"none",S.style.display=x?"":"none",y.style.display=k?"none":"";const B=document.getElementById("svc-quality-select");B.innerHTML='<option value="">-- Enter API key first --</option>',document.getElementById("svc-quality-status").textContent="",k?(n.textContent="Seedhost credentials auto-login past the HTTP prompt. API key bypasses the app login.",document.getElementById("svc-seedhost-pass").placeholder=`Password for ${e.name}`):L?n.textContent="API key bypasses the app login screen automatically.":n.textContent="Credentials are injected automatically when accessing this service.",await s(e),a.classList.add("show")};async function s(e){const o=document.getElementById("svc-creds-dot"),u=document.getElementById("svc-creds-status"),n=document.getElementById("svc-creds-clear");let i=!1;if(e.isExternal){try{const S=await(await fetch(`/api/v1/seedhost-creds?serviceId=${e.id}`)).json();S.success?(document.getElementById("svc-seedhost-user").value=S.username||"",S.hasCredentials&&(i=!0)):document.getElementById("svc-seedhost-user").value=""}catch{}document.getElementById("svc-seedhost-pass").value=""}try{const S=await(await fetch(`/api/v1/services/${e.id}/credentials`)).json();S.success&&(S.hasApiKey?(document.getElementById("svc-apikey-input").value="\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",i=!0):document.getElementById("svc-apikey-input").value="",S.hasBasicAuth&&!e.isExternal?(document.getElementById("svc-basic-user").value=S.username||"",i=!0):document.getElementById("svc-basic-user").value="")}catch{}document.getElementById("svc-basic-pass")&&(document.getElementById("svc-basic-pass").value="");const l=e.id||e.appTemplate;if(v.includes(l)&&await t(e),i){b=!0,o.style.background="var(--ok-fg, #74dfc4)",u.style.color="var(--ok-fg, #74dfc4)",u.textContent="Credentials stored",n.style.display="";const y=document.getElementById(`creds-btn-${e.id}`);y&&y.classList.add("has-creds")}else o.style.background="var(--muted)",u.style.color="var(--muted)",u.textContent="No credentials stored",n.style.display="none"}async function t(e){const o=document.getElementById("svc-quality-select"),u=document.getElementById("svc-quality-status"),n=e.id||e.appTemplate,i=p(e);if(!i){o.innerHTML='<option value="">-- No service URL --</option>';return}o.innerHTML='<option value="">Loading...</option>',u.textContent="";try{const l=new URLSearchParams({service:n,url:i}),S=await(await fetch(`/api/v1/arr/quality-profiles?${l}`)).json();if(!S.success||!S.profiles?.length){o.innerHTML='<option value="">-- No profiles found (enter API key and click Fetch) --</option>';return}o.innerHTML="";for(const k of S.profiles){const L=document.createElement("option");L.value=k.id,L.textContent=k.name,o.appendChild(L)}if(S.storedProfileId&&(o.value=String(S.storedProfileId)),!o.value){const k=S.profiles.find(L=>/720/i.test(L.name));k&&(o.value=String(k.id))}!o.value&&S.profiles.length&&(o.value=String(S.profiles[0].id)),u.innerHTML=`<span style="color: var(--ok-fg);">${S.profiles.length} profiles loaded</span>`}catch(l){o.innerHTML='<option value="">-- Failed to load --</option>',u.innerHTML=`<span style="color: var(--error, #c62828);">Error: ${l.message}</span>`}}document.getElementById("svc-quality-fetch")?.addEventListener("click",async()=>{if(!m)return;const e=m.id||m.appTemplate,o=p(m),n=document.getElementById("svc-apikey-input")?.value.trim(),i=document.getElementById("svc-quality-select"),l=document.getElementById("svc-quality-status");if(!o){l.innerHTML='<span style="color: var(--error, #c62828);">No servLine truncated
+  </div>`);const o=document.getElementById("service-creds-modal");let m=null,h=null,b=!1;const g=["sonarr","radarr","prowlarr","overseerr"],v=["sonarr","radarr"];function p(e){return e.externalUrl||e.url||""}function c(e){const t=document.getElementById("svc-creds-error");t.textContent=e,t.style.display=""}function s(){const e=document.getElementById("svc-creds-error");e.textContent="",e.style.display="none"}async function y(e,t){if(!e)throw new Error(`${t} failed: no response`);let i;try{i=await e.json()}catch{throw new Error(`${t} failed: invalid server response`)}if(!e.ok||i?.success!==!0)throw new Error(i?.error||`${t} failed (${e.status||"unknown status"})`);return i}function x(e,t){return!!window.DCCredentialVault?.isAllowedReturnUrl(e,t)}window.openServiceCredsModal=async function(e,t={}){m=e,h=x(t.returnUrl,e.id)?t.returnUrl:null,b=!1,s();const i=document.getElementById("svc-creds-title"),n=document.getElementById("svc-creds-desc"),d=document.getElementById("svc-creds-seedhost"),l=document.getElementById("svc-creds-apikey"),f=document.getElementById("svc-creds-basic"),C=document.getElementById("svc-creds-quality");i.textContent=e.name+" \u2014 Encrypted Vault",document.getElementById("svc-creds-save").textContent=h?"Save to vault & open service":"Save to encrypted vault";const S=!!e.isExternal,T=g.includes(e.id)||g.includes(e.appTemplate),w=v.includes(e.id)||v.includes(e.appTemplate);d.style.display=S?"":"none",l.style.display=T?"":"none",C.style.display=w?"":"none",f.style.display=S?"none":"";const L=document.getElementById("svc-quality-select");L.innerHTML='<option value="">-- Enter API key first --</option>',document.getElementById("svc-quality-status").textContent="",S?(n.textContent="Seedhost credentials auto-login past the HTTP prompt. API key bypasses the app login.",document.getElementById("svc-seedhost-pass").placeholder=`Password for ${e.name}`):T?n.textContent="API key bypasses the app login screen automatically.":n.textContent="Credentials are injected automatically when accessing this service.",await r(e),o.classList.add("show")};async function r(e){const t=document.getElementById("svc-creds-dot"),i=document.getElementById("svc-creds-status"),n=document.getElementById("svc-creds-clear");let d=!1;if(e.isExternal){try{const C=await(await fetch(`/api/v1/seedhost-creds?serviceId=${e.id}`)).json();C.success?(document.getElementById("svc-seedhost-user").value=C.username||"",C.hasCredentials&&(d=!0)):document.getElementById("svc-seedhost-user").value=""}catch{}document.getElementById("svc-seedhost-pass").value=""}try{const C=await(await fetch(`/api/v1/services/${e.id}/credentials`)).json();C.success&&(C.hasApiKey?(document.getElementById("svc-apikey-input").value="\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",d=!0):document.getElementById("svc-apikey-input").value="",C.hasBasicAuth&&!e.isExternal?(document.getElementById("svc-basic-user").value=C.username||"",d=!0):document.getElementById("svc-basic-user").value="")}catch{}document.getElementById("svc-basic-pass")&&(document.getElementById("svc-basic-pass").value="");const l=e.id||e.appTemplate;if(v.includes(l)&&await a(e),d){b=!0,t.style.background="var(--ok-fg, #74dfc4)",i.style.color="var(--ok-fg, #74dfc4)",i.textContent="Credentials stored",n.style.display="";const f=document.getElementById(`creds-btn-${e.id}`);f&&f.classList.add("has-creds")}else t.style.background="var(--muted)",i.style.color="var(--muted)",i.textContent="No credentials stored",n.style.display="none"}async function a(e){const t=document.getElementById("svc-quality-select"),i=document.getElementById("svc-quality-status"),n=e.id||e.appTemplate,d=p(e);if(!d){t.innerHTML='<option value="">-- No service URL --</option>';return}t.innerHTML='<option value="">Loading...</option>',i.textContent="";try{const l=new URLSearchParams({service:n,url:d}),C=await(await fetch(`/api/v1/arr/quality-profiles?${l}`)).json();if(!C.success||!C.profiles?.length){t.innerHTML='<option value="">-- No profiles found (enter API key and click Fetch) --</option>';return}t.innerHTML="";for(const S of C.profiles){const T=document.createElement("option");T.value=S.id,T.textContent=S.name,t.appendChild(T)}if(C.storedProfileId&&(t.value=String(C.storedProfileId)),!t.value){const S=C.profiles.find(T=>/720/i.test(T.name));S&&(t.value=String(S.id))}!t.value&&C.profiles.length&&(t.value=String(C.profiles[0].id)),i.innerHTML=`<span style="color: var(--ok-fg);">${C.profiles.length} profiles loaded</span>`}catch(l){t.innerHTML='<option value="">-- Failed to load --</option>',i.innerHTML=`<span style="color: var(--error, #c62828);">Error: ${l.message}</span>`}}document.getElementById("svc-quality-fetch")?.addEventListener("click",async()=>{if(!m)return;const e=m.id||m.appTemplate,t=p(m),n=document.getElementById("svc-apikey-input")?.value.trim(),d=document.getElementById("svc-quality-select"),l=document.getElementById("svc-quality-status");if(!t){l.innerHTML='<span style="color: var(--error, #c62828);">No servLine truncated
     <div class="weather-modal-content" style="min-width: 420px; max-width: 520px;">
       <h3 style="margin: 0 0 16px; font-size: 1.1rem;">Authentication Settings</h3>
 
@@ -288,7 +288,7 @@
         </button>
       </div>
     </div>
-  </div>`);async function a(){try{const v=await(await fetch("/api/v1/totp/config")).json();if(!v.success)return;const{enabled:p,sessionDuration:d,isSetUp:r}=v.config,f=document.getElementById("totp-status-dot"),w=document.getElementById("totp-status-text"),s=document.getElementById("totp-status-banner"),t=document.getElementById("totp-setup-section"),e=document.getElementById("totp-qr-section"),o=document.getElementById("totp-duration-section"),u=document.getElementById("totp-disable-section");if(p&&r){f.style.background="var(--ok-fg, #7ef2ff)",s.style.borderColor="var(--ok-fg, #7ef2ff)",s.style.background="color-mix(in srgb, var(--ok-fg) 8%, transparent)",w.textContent="TOTP is active",w.style.color="var(--ok-fg, #7ef2ff)",t.style.display="block";const n=document.getElementById("totp-setup-btn");n&&(n.textContent="Generate New Secret"),e.style.display="none",o.style.display="block",u.style.display="block",document.getElementById("totp-duration-select").value=d}else f.style.background="var(--muted)",s.style.borderColor="var(--border)",s.style.background="transparent",w.textContent="TOTP is not configured",w.style.color="var(--muted)",t.style.display="block",e.style.display="none",o.style.display="none",u.style.display="none";b(p&&r,d)}catch(g){console.warn("Failed to load TOTP settings:",g)}}const m={"15m":"15 min","30m":"30 min","1h":"1 hour","2h":"2 hours","4h":"4 hours","8h":"8 hours","12h":"12 hours","24h":"24 hours",never:"Disabled"};function h(g,v){const p=window.DCI18n;return p&&p.isLoaded()?p.t(g):v}function b(g,v){const p=document.getElementById("auth-card"),d=document.getElementById("auth-pill"),r=document.getElementById("auth-dot"),f=document.getElementById("auth-status-text");p&&(g?(p.setAttribute("data-status","on"),d.className="badge on",d.textContent=h("card.status.yes","YES"),r.className="dot ok at-bl",f.textContent="Session: "+(m[v]||v)):(p.setAttribute("data-status","off"),d.className="badge off",d.textContent=h("card.status.no","NO"),r.className="dot bad at-bl",f.textContent=h("card.auth.not_configured","Not configured")))}document.getElementById("totp-setup-btn")?.addEventListener("click",async()=>{try{const v=await(await secureFetch("/api/v1/totp/setup",{method:"POST"})).json();v.success&&(document.getElementById("totp-qr-image").src=v.qrCode,document.getElementById("totp-manual-key").textContent=v.manualKey,document.getElementById("totp-setup-section").style.display="none",document.getElementById("totp-qr-section").style.display="block",document.getElementById("totp-setup-code").value="",document.getElementById("totp-setup-error").textContent="",document.getElementById("totp-setup-code").focus())}catch(g){c.logError("[TOTP] Setup Failed",g,{function:"setupTOTP"})}}),document.getElementById("totp-import-btn")?.addEventListener("click",async()=>{const g=document.getElementById("totp-import-key").value.trim(),v=document.getElementById("totp-import-error");if(v.textContent="",!g){v.textContent="Paste a Base32 secret key first";return}try{const d=await(await secureFetch("/api/v1/totp/setup",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({secret:g})})).json();d.success?(v.textContent="",document.getElementById("totp-qr-image").src=d.qrCode,document.getElementById("totp-manual-key").textContent=d.manualKey,document.getElementById("totp-setup-section").style.display="none",document.getElementById("totp-qr-section").style.display="block",document.getElementById("totp-setup-code").value="",document.getElementById("totp-setup-error").textContent="",document.getElementById("totp-setup-code").focus()):v.textContent=d.error||d.message||"Import failed"}catch{v.textContent="Connection error \u2014 try refreshing the page"}}),document.getElementById("totp-copy-key")?.addEventListener("click",()=>{const g=document.getElementById("totp-manual-key").textContent;navigator.clipboard.writeText(g).then(()=>{const v=document.getElementById("totp-copy-key");v.textContent="\u2705",setTimeout(()=>{v.textContent="\u{1F4CB}"},2e3)})}),document.getElementById("totp-download-backup")?.addEventListener("click",()=>{const g=document.getElementById("totp-manual-key").textContent.trim();if(!g)return;const v={service:"DashCaddy",type:"totp-secret",secret:g,issuer:"DashCaddy",algorithm:"SHA1",digits:6,period:30,issued:new Date().toISOString(),recovery_url:`${window.location.origin}/  (login screen \u2192 "Lost access?")`,note:'Keep this file somewhere safe. Anyone with this secret can generate your login codes. Use it ONLY to recover TOTP access via the "Lost access?" link on the DashCaddy login screen.'},p=new Blob([JSON.stringify(v,null,2)],{type:"application/json"}),d=URL.createObjectURL(p),r=document.createElement("a");r.href=d,r.download=`dashcaddy-totp-backup-${new Date().toISOString().slice(0,10)}.json`,document.body.appendChild(r),r.click(),document.body.removeChild(r),URL.revokeObjectURL(d);const f=document.getElementById("totp-download-backup");f.textContent="\u2705 Saved",setTimeLine truncated
+  </div>`);async function o(){try{const v=await(await fetch("/api/v1/totp/config")).json();if(!v.success)return;const{enabled:p,sessionDuration:c,isSetUp:s}=v.config,y=document.getElementById("totp-status-dot"),x=document.getElementById("totp-status-text"),r=document.getElementById("totp-status-banner"),a=document.getElementById("totp-setup-section"),e=document.getElementById("totp-qr-section"),t=document.getElementById("totp-duration-section"),i=document.getElementById("totp-disable-section");if(p&&s){y.style.background="var(--ok-fg, #7ef2ff)",r.style.borderColor="var(--ok-fg, #7ef2ff)",r.style.background="color-mix(in srgb, var(--ok-fg) 8%, transparent)",x.textContent="TOTP is active",x.style.color="var(--ok-fg, #7ef2ff)",a.style.display="block";const n=document.getElementById("totp-setup-btn");n&&(n.textContent="Generate New Secret"),e.style.display="none",t.style.display="block",i.style.display="block",document.getElementById("totp-duration-select").value=c}else y.style.background="var(--muted)",r.style.borderColor="var(--border)",r.style.background="transparent",x.textContent="TOTP is not configured",x.style.color="var(--muted)",a.style.display="block",e.style.display="none",t.style.display="none",i.style.display="none";b(p&&s,c)}catch(g){console.warn("Failed to load TOTP settings:",g)}}const m={"15m":"15 min","30m":"30 min","1h":"1 hour","2h":"2 hours","4h":"4 hours","8h":"8 hours","12h":"12 hours","24h":"24 hours",never:"Disabled"};function h(g,v){const p=window.DCI18n;return p&&p.isLoaded()?p.t(g):v}function b(g,v){const p=document.getElementById("auth-card"),c=document.getElementById("auth-pill"),s=document.getElementById("auth-dot"),y=document.getElementById("auth-status-text");p&&(g?(p.setAttribute("data-status","on"),c.className="badge on",c.textContent=h("card.status.yes","YES"),s.className="dot ok at-bl",y.textContent="Session: "+(m[v]||v)):(p.setAttribute("data-status","off"),c.className="badge off",c.textContent=h("card.status.no","NO"),s.className="dot bad at-bl",y.textContent=h("card.auth.not_configured","Not configured")))}document.getElementById("totp-setup-btn")?.addEventListener("click",async()=>{try{const v=await(await secureFetch("/api/v1/totp/setup",{method:"POST"})).json();v.success&&(document.getElementById("totp-qr-image").src=v.qrCode,document.getElementById("totp-manual-key").textContent=v.manualKey,document.getElementById("totp-setup-section").style.display="none",document.getElementById("totp-qr-section").style.display="block",document.getElementById("totp-setup-code").value="",document.getElementById("totp-setup-error").textContent="",document.getElementById("totp-setup-code").focus())}catch(g){u.logError("[TOTP] Setup Failed",g,{function:"setupTOTP"})}}),document.getElementById("totp-import-btn")?.addEventListener("click",async()=>{const g=document.getElementById("totp-import-key").value.trim(),v=document.getElementById("totp-import-error");if(v.textContent="",!g){v.textContent="Paste a Base32 secret key first";return}try{const c=await(await secureFetch("/api/v1/totp/setup",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({secret:g})})).json();c.success?(v.textContent="",document.getElementById("totp-qr-image").src=c.qrCode,document.getElementById("totp-manual-key").textContent=c.manualKey,document.getElementById("totp-setup-section").style.display="none",document.getElementById("totp-qr-section").style.display="block",document.getElementById("totp-setup-code").value="",document.getElementById("totp-setup-error").textContent="",document.getElementById("totp-setup-code").focus()):v.textContent=c.error||c.message||"Import failed"}catch{v.textContent="Connection error \u2014 try refreshing the page"}}),document.getElementById("totp-copy-key")?.addEventListener("click",()=>{const g=document.getElementById("totp-manual-key").textContent;navigator.clipboard.writeText(g).then(()=>{const v=document.getElementById("totp-copy-key");v.textContent="\u2705",setTimeout(()=>{v.textContent="\u{1F4CB}"},2e3)})}),document.getElementById("totp-download-backup")?.addEventListener("click",()=>{const g=document.getElementById("totp-manual-key").textContent.trim();if(!g)return;const v={service:"DashCaddy",type:"totp-secret",secret:g,issuer:"DashCaddy",algorithm:"SHA1",digits:6,period:30,issued:new Date().toISOString(),recovery_url:`${window.location.origin}/  (login screen \u2192 "Lost access?")`,note:'Keep this file somewhere safe. Anyone with this secret can generate your login codes. Use it ONLY to recover TOTP access via the "Lost access?" link on the DashCaddy login screen.'},p=new Blob([JSON.stringify(v,null,2)],{type:"application/json"}),c=URL.createObjectURL(p),s=document.createElement("a");s.href=c,s.download=`dashcaddy-totp-backup-${new Date().toISOString().slice(0,10)}.json`,document.body.appendChild(s),s.click(),document.body.removeChild(s),URL.revokeObjectURL(c);const y=document.getElementById("totp-download-backup");y.textContent="\u2705 Saved",setTimeLine truncated
   <div id="token-management-modal" class="weather-modal">
     <div class="weather-modal-content" style="min-width: 500px; max-width: 600px;">
       <h3>\u{1F511} DNS Credentials</h3>
@@ -306,9 +306,9 @@
       </div>
     </div>
   </div>
-  `);function c(){return Object.keys(SITE.dnsServers||{})}function a(n){return(SITE.dnsServers||{})[n]?.name||n.toUpperCase()}async function m(n,i){if(!n)throw new Error(`${i} failed: no response`);let l;try{l=await n.json()}catch{throw new Error(`${i} failed: invalid server response`)}if(!n.ok||l?.success!==!0)throw new Error(l?.error||`${i} failed (${n.status||"unknown status"})`);return l}function h(){const n=document.getElementById("dns-cred-sections");if(!n)return;n.innerHTML="";const i=c();if(i.length===0){n.innerHTML='<p style="color: var(--muted); text-align: center; padding: 20px;">No DNS servers configured.</p>';return}for(const l of i)n.insertAdjacentHTML("beforeend",`
+  `);function u(){return Object.keys(SITE.dnsServers||{})}function o(n){return(SITE.dnsServers||{})[n]?.name||n.toUpperCase()}async function m(n,d){if(!n)throw new Error(`${d} failed: no response`);let l;try{l=await n.json()}catch{throw new Error(`${d} failed: invalid server response`)}if(!n.ok||l?.success!==!0)throw new Error(l?.error||`${d} failed (${n.status||"unknown status"})`);return l}function h(){const n=document.getElementById("dns-cred-sections");if(!n)return;n.innerHTML="";const d=u();if(d.length===0){n.innerHTML='<p style="color: var(--muted); text-align: center; padding: 20px;">No DNS servers configured.</p>';return}for(const l of d)n.insertAdjacentHTML("beforeend",`
       <div class="token-section">
-        <h4 class="token-section-title">${a(l)}</h4>
+        <h4 class="token-section-title">${o(l)}</h4>
         <div class="token-grid">
           <div class="token-field">
             <label for="${l}-readonly-username">\u{1F4D6} Read-Only (Logs):</label>
@@ -329,17 +329,17 @@
         </div>
         <div class="token-status" id="${l}-token-status"></div>
       </div>
-      `)}function b(){let n=safeSessionGet("dashcaddy-encryption-key");if(n)return n;const i=safeGet("dashcaddy-encryption-key");if(i)return safeSessionSet("dashcaddy-encryption-key",i),safeRemove("dashcaddy-encryption-key"),i;const l=new Uint8Array(32);return crypto.getRandomValues(l),n=Array.from(l,y=>y.toString(16).padStart(2,"0")).join(""),safeSessionSet("dashcaddy-encryption-key",n),n}const g=b();function v(n,i){if(!n)return"";const l=crypto.getRandomValues(new Uint8Array(8)),y=Array.from(l,L=>L.toString(16).padStart(2,"0")).join(""),S=new TextEncoder().encode(i+y);let k="";for(let L=0;L<n.length;L++){const x=n.charCodeAt(L)^S[L%S.length]^l[L%l.length]^L*31+17&255;k+=String.fromCharCode(x)}return y+":"+btoa(k)}function p(n,i){if(!n)return"";try{if(n.indexOf(":")===16){const k=n.substring(0,16),L=new Uint8Array(k.match(/.{2}/g).map(E=>parseInt(E,16))),x=atob(n.substring(17)),B=new TextEncoder().encode(i+k);let A="";for(let E=0;E<x.length;E++){const C=x.charCodeAt(E)^B[E%B.length]^L[E%L.length]^E*31+17&255;A+=String.fromCharCode(C)}return A}const y=atob(n);let S="";for(let k=0;k<y.length;k++){const L=y.charCodeAt(k)^i.charCodeAt(k%i.length);S+=String.fromCharCode(L)}return S}catch{return""}}function d(n,i,l){const y=safeGet(`${n}-${i}-${l}-enc`);return p(y,g)}function r(n,i,l,y){const S=`${n}-${i}-${l}-enc`;y?safeSet(S,v(y,g)):safeRemove(S)}function f(n,i){return d(n,i,"token")}function w(n,i){return d(n,i,"username")}function s(n,i,l){r(n,i,"token",l)}function t(n,i,l){r(n,i,"username",l)}function e(){const n={};for(const i of c())n[i]={readonly:{username:w(i,"readonly"),token:f(i,"readonly")},admin:{username:w(i,"admin"),token:f(i,"admin")}};return n}function o(){c().forEach(n=>{["readonly","admin"].forEach(i=>{["token","username"].forEach(l=>{safeRemove(`${n}-${i}-${l}-enc`)})}),safeRemove(`${n}-token-enc`),safeRemove(`${n}-username-enc`)})}function u(n){const i=f(n,"readonly"),l=w(n,"readonly"),y=f(n,"admin"),S=w(n,"admin"),k=p(safeGet(`${n}-token-enc`),g),L=p(safeGet(`${n}-username-enc`),g);return{username:S||l||L,token:y||i||k,readonlyToken:i||k,readonlyUsername:l||L,adminToken:y||k,adminUsername:S||L}}document.getElementById("manage-tokens")?.addEventListener("click",()=>{h();const n=document.getElementById("token-management-modal"),i=e();c().forEach(l=>{const y=i[l];document.getElementById(`${l}-readonly-username`).value=y.readonly.username,document.getElementById(`${l}-readonly-token`).value=y.readonly.token,document.getElementById(`${l}-admin-username`).value=y.admin.username,document.getElementById(`${l}-admin-token`).value=y.admin.token,document.getElementById(`${l}-token-status`).textContent=""}),n.classList.add("show")}),document.getElementById("token-management-modal")?.addEventListener("click",n=>{const i=n.target.closest(".token-toggle");if(i){const l=i.dataset.target,y=document.getElementById(l);y.type==="password"?(y.type="text",i.textContent="\u{1F648}"):(y.type="password",i.textContent="\u{1F441}");return}n.target.id==="token-management-modal"&&n.target.classList.remove("show")}),document.getElementById("token-save")?.addEventListener("click",async()=>{const n=c(),i={};let l=!1;if(n.forEach(y=>{const S={},k=document.getElementById(`${y}-readonly-username`).value.trim(),L=document.getElementById(`${y}-readonly-token`).value.trim(),x=document.getElementById(`${y}-admin-username`).value.trim(),B=document.getElementById(`${y}-admin-token`).value.trim();k&&L&&(S.readonly={username:k,password:L},l=!0),x&&B&&(S.admin={username:x,password:B},l=!0),Object.keys(S).length>0&&(i[y]=S)}),l){n.forEach(y=>{i[y]&&(document.getElementById(`${y}-token-status`).textContent="Verifying...",document.getElementById(`${y}-token-status`).className="token-status")});try{const y=await secureFetch("/api/v1/dns/credentials",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({servers:i})}),S=await m(y,"DNS credential save");if(S.results){const k=Object.keys(i).filter(L=>S.results[L]?.success!==!0);if(k.length){const L=k.map(x=>S.results[x]?.error||`${x} failed`).join("; ");throw new Error(L)}}n.forEach(k=>{t(k,"readonly",document.getElementById(`${k}-readonly-username`).value.trim()),s(k,"readonly",document.getElementById(`${k}-readonly-token`).value.trim()),t(k,"admin",document.getElementById(`${k}-admin-username`).value.trim()),s(k,"admin",document.getElementById(`${k}-admin-token`).value.trim())}),n.forEach(k=>{const L=document.getElementById(`${k}-token-status`);if(!i[k]){L.textContent="";return}const x=S.results?.[k];L.textContent=x?.partial?"\u2713 "+x.partial:"\u2713 Verified & saved",L.className="token-status success"})}catch(y){console.error("Failed to sync DNS credentials to backend:",y),n.forEach(S=>{i[S]&&(document.getElementById(`${S}-token-status`).textContent="\u2717 "+(y.message||"Save failed"),document.getElementById(`${S}-token-status`).className="token-status error")})}}else n.forEach(y=>{document.getElementById(`${y}-token-status`).textContent=""});setTimeout(()=>{
Line truncated
+      `)}function b(){let n=safeSessionGet("dashcaddy-encryption-key");if(n)return n;const d=safeGet("dashcaddy-encryption-key");if(d)return safeSessionSet("dashcaddy-encryption-key",d),safeRemove("dashcaddy-encryption-key"),d;const l=new Uint8Array(32);return crypto.getRandomValues(l),n=Array.from(l,f=>f.toString(16).padStart(2,"0")).join(""),safeSessionSet("dashcaddy-encryption-key",n),n}const g=b();function v(n,d){if(!n)return"";const l=crypto.getRandomValues(new Uint8Array(8)),f=Array.from(l,T=>T.toString(16).padStart(2,"0")).join(""),C=new TextEncoder().encode(d+f);let S="";for(let T=0;T<n.length;T++){const w=n.charCodeAt(T)^C[T%C.length]^l[T%l.length]^T*31+17&255;S+=String.fromCharCode(w)}return f+":"+btoa(S)}function p(n,d){if(!n)return"";try{if(n.indexOf(":")===16){const S=n.substring(0,16),T=new Uint8Array(S.match(/.{2}/g).map(E=>parseInt(E,16))),w=atob(n.substring(17)),L=new TextEncoder().encode(d+S);let A="";for(let E=0;E<w.length;E++){const k=w.charCodeAt(E)^L[E%L.length]^T[E%T.length]^E*31+17&255;A+=String.fromCharCode(k)}return A}const f=atob(n);let C="";for(let S=0;S<f.length;S++){const T=f.charCodeAt(S)^d.charCodeAt(S%d.length);C+=String.fromCharCode(T)}return C}catch{return""}}function c(n,d,l){const f=safeGet(`${n}-${d}-${l}-enc`);return p(f,g)}function s(n,d,l,f){const C=`${n}-${d}-${l}-enc`;f?safeSet(C,v(f,g)):safeRemove(C)}function y(n,d){return c(n,d,"token")}function x(n,d){return c(n,d,"username")}function r(n,d,l){s(n,d,"token",l)}function a(n,d,l){s(n,d,"username",l)}function e(){const n={};for(const d of u())n[d]={readonly:{username:x(d,"readonly"),token:y(d,"readonly")},admin:{username:x(d,"admin"),token:y(d,"admin")}};return n}function t(){u().forEach(n=>{["readonly","admin"].forEach(d=>{["token","username"].forEach(l=>{safeRemove(`${n}-${d}-${l}-enc`)})}),safeRemove(`${n}-token-enc`),safeRemove(`${n}-username-enc`)})}function i(n){const d=y(n,"readonly"),l=x(n,"readonly"),f=y(n,"admin"),C=x(n,"admin"),S=p(safeGet(`${n}-token-enc`),g),T=p(safeGet(`${n}-username-enc`),g);return{username:C||l||T,token:f||d||S,readonlyToken:d||S,readonlyUsername:l||T,adminToken:f||S,adminUsername:C||T}}document.getElementById("manage-tokens")?.addEventListener("click",()=>{h();const n=document.getElementById("token-management-modal"),d=e();u().forEach(l=>{const f=d[l];document.getElementById(`${l}-readonly-username`).value=f.readonly.username,document.getElementById(`${l}-readonly-token`).value=f.readonly.token,document.getElementById(`${l}-admin-username`).value=f.admin.username,document.getElementById(`${l}-admin-token`).value=f.admin.token,document.getElementById(`${l}-token-status`).textContent=""}),n.classList.add("show")}),document.getElementById("token-management-modal")?.addEventListener("click",n=>{const d=n.target.closest(".token-toggle");if(d){const l=d.dataset.target,f=document.getElementById(l);f.type==="password"?(f.type="text",d.textContent="\u{1F648}"):(f.type="password",d.textContent="\u{1F441}");return}n.target.id==="token-management-modal"&&n.target.classList.remove("show")}),document.getElementById("token-save")?.addEventListener("click",async()=>{const n=u(),d={};let l=!1;if(n.forEach(f=>{const C={},S=document.getElementById(`${f}-readonly-username`).value.trim(),T=document.getElementById(`${f}-readonly-token`).value.trim(),w=document.getElementById(`${f}-admin-username`).value.trim(),L=document.getElementById(`${f}-admin-token`).value.trim();S&&T&&(C.readonly={username:S,password:T},l=!0),w&&L&&(C.admin={username:w,password:L},l=!0),Object.keys(C).length>0&&(d[f]=C)}),l){n.forEach(f=>{d[f]&&(document.getElementById(`${f}-token-status`).textContent="Verifying...",document.getElementById(`${f}-token-status`).className="token-status")});try{const f=await secureFetch("/api/v1/dns/credentials",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({servers:d})}),C=await m(f,"DNS credential save");if(C.results){const S=Object.keys(d).filter(T=>C.results[T]?.success!==!0);if(S.length){const T=S.map(w=>C.results[w]?.error||`${w} failed`).join("; ");throw new Error(T)}}n.forEach(S=>{a(S,"readonly",document.getElementById(`${S}-readonly-username`).value.trim()),r(S,"readonly",document.getElementById(`${S}-readonly-token`).value.trim()),a(S,"admin",document.getElementById(`${S}-admin-username`).value.trim()),r(S,"admin",document.getElementById(`${S}-admin-token`).value.trim())}),n.forEach(S=>{const T=document.getElementById(`${S}-token-status`);if(!d[S]){T.textContent="";return}const w=C.results?.[S];T.textContent=w?.partial?"\u2713 "+w.partial:"\u2713 Verified & saved",T.className="token-status success"})}catch(f){console.error("Failed to sync DNS credentials to backend:",f),n.forEach(C=>{d[C]&&(document.getElementById(`${C}-token-status`).textContent="\u2717 "+(f.message||"Save failed"),document.getElementById(`${C}-token-status`).className="token-status error")})}}else n.forEach(f=>{document.getElementById(`${f}-token-status`).textContent=""});setTimeout(()=>{
Line truncated
 
-Current: ${s.currentVersion}
-New: ${s.updateVersion}
+Current: ${r.currentVersion}
+New: ${r.updateVersion}
 
-`+(s.updateTitle?`${s.updateTitle}
+`+(r.updateTitle?`${r.updateTitle}
 
 `:"")+`The DNS server will restart during the update.
-Proceed?`)){r.textContent=f,r.disabled=!1,r.title="Update DNS server";return}r.textContent="\u{1F504}",r.title="Updating...";const o=await(await secureFetch(`/api/v1/dns/update?server=${encodeURIComponent(d)}`,{method:"POST"})).json();if(!o.success)throw new Error(o.error||"Update failed");if(o.manualUpdateRequired){r.textContent="\u2B06\uFE0F",r.title=`Update available: ${o.newVersion}`;const u=o.downloadLink?`
-Download: ${o.downloadLink}`:"",n=o.instructionsLink?`
-Instructions: ${o.instructionsLink}`:"";showNotification(`${p.toUpperCase()} update requires manual installation. Current: ${o.previousVersion} \u2192 ${o.newVersion}. Please update manually on the host machine.`,"warning",8e3),r.disabled=!1;return}r.textContent="\u2705",r.title="Updated successfully!",showNotification(`${p.toUpperCase()} updated successfully! ${o.previousVersion} \u2192 ${o.newVersion}. Server is restarting...`,"success"),setTimeout(()=>{r.textContent=f,r.disabled=!1,r.title="Update DNS server",window.refreshAll()},1e4)}catch(w){console.error("DNS update error:",w),r.textContent="\u274C",r.title="Update failed",showNotification(`Failed to update ${p.toUpperCase()}: ${w.message}`,"error"),setTimeout(()=>{r.textContent=f,r.disabled=!1,r.title="Update DNS server"},3e3)}}document.querySelector(".top")?.addEventListener("click",p=>{const d=p.target.closest('[id$="-update"]');if(!d)return;const r=d.id.replace("-update","");SITE.dnsServers[r]&&a(r,SITE.dnsServers[r]?.ip)}),injectModal("dns-settings-modal",`
+Proceed?`)){s.textContent=y,s.disabled=!1,s.title="Update DNS server";return}s.textContent="\u{1F504}",s.title="Updating...";const t=await(await secureFetch(`/api/v1/dns/update?server=${encodeURIComponent(c)}`,{method:"POST"})).json();if(!t.success)throw new Error(t.error||"Update failed");if(t.manualUpdateRequired){s.textContent="\u2B06\uFE0F",s.title=`Update available: ${t.newVersion}`;const i=t.downloadLink?`
+Download: ${t.downloadLink}`:"",n=t.instructionsLink?`
+Instructions: ${t.instructionsLink}`:"";showNotification(`${p.toUpperCase()} update requires manual installation. Current: ${t.previousVersion} \u2192 ${t.newVersion}. Please update manually on the host machine.`,"warning",8e3),s.disabled=!1;return}s.textContent="\u2705",s.title="Updated successfully!",showNotification(`${p.toUpperCase()} updated successfully! ${t.previousVersion} \u2192 ${t.newVersion}. Server is restarting...`,"success"),setTimeout(()=>{s.textContent=y,s.disabled=!1,s.title="Update DNS server",window.refreshAll()},1e4)}catch(x){console.error("DNS update error:",x),s.textContent="\u274C",s.title="Update failed",showNotification(`Failed to update ${p.toUpperCase()}: ${x.message}`,"error"),setTimeout(()=>{s.textContent=y,s.disabled=!1,s.title="Update DNS server"},3e3)}}document.querySelector(".top")?.addEventListener("click",p=>{const c=p.target.closest('[id$="-update"]');if(!c)return;const s=c.id.replace("-update","");SITE.dnsServers[s]&&o(s,SITE.dnsServers[s]?.ip)}),injectModal("dns-settings-modal",`
   <div id="dns-settings-modal" class="weather-modal">
     <div class="weather-modal-content" style="min-width: 420px; max-width: 520px;">
       <h3 id="dns-settings-title">DNS Settings</h3>
@@ -366,7 +366,7 @@ Instructions: ${o.instructionsLink}`:"";showNotification(`${p.toUpperCase()} upd
         <button id="dns-settings-save" class="btn-accent">Save</button>
       </div>
     </div>
-  </div>`);let m=null;function h(p){m=p;const d=SITE.dnsServers[p]||{},r=document.getElementById("dns-settings-modal");document.getElementById("dns-settings-title").textContent=`${(d.name||p).toUpperCase()} Settings`,document.getElementById("dns-edit-ip").value=d.ip||"",document.getElementById("dns-edit-port").value=d.port||DC.DEFAULTS.DNS_PORT,document.getElementById("dns-edit-name").value=d.name||"",r.classList.add("show")}async function b(){if(!m)return;const p=document.getElementById("dns-edit-ip").value.trim(),d=document.getElementById("dns-edit-port").value.trim()||DC.DEFAULTS.DNS_PORT,r=document.getElementById("dns-edit-name").value.trim();if(!p){showNotification("Server IP is required","warning");return}const f={dnsServers:{}};f.dnsServers[m]={ip:p,port:String(d)},r&&(f.dnsServers[m].name=r);try{const s=await(await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(f)})).json();s.success?(SITE.dnsServers[m]=f.dnsServers[m],showNotification(`${m.toUpperCase()} settings saved`,"success"),v(),window.refreshAll()):showNotification(s.error||"Failed to save settings","error")}catch(w){showNotification("Failed to save: "+w.message,"error")}}async function g(){if(m&&confirm(`Remove ${m.toUpperCase()} from dashboard? This won't affect the actual DNS server.`))try{const d=await(await secureFetch("/api/v1/config")).json();d.dnsServers&&delete d.dnsServers[m];const f=await(await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({dnsServers:d.dnsServers||{}})})).json();if(f.success){delete SITE.dnsServers[m];const w=document.querySelector(`.top [data-app="${m}"]`);w&&w.remove(),showNotification(`${m.toUpperCase()} removed from dashboard`,"success"),v()}else showNotification(f.error||"Failed to remove","error")}catch(p){showNotification("Failed to remove: "+p.message,"error")}}function v(){closeModal("dns-settings-modal"),m=null}document.getElementById("dns-settings-cancel")?.addEventListener("click",v),document.getElementById("dns-settings-save")?.addEventListener("click",b),document.getElementById("dns-settings-delete")?.addEventListener("click",g),document.getElementById("dns-settings-modal")?.addEventListener("click",p=>{p.target.id==="dns-settings-modal"&&v()}),document.querySelector(".top")?.addEventListener("click",p=>{const d=p.target.closest('[id$="-settings"]');if(!d)return;const r=d.id.replace("-settings","");SITE.dnsServers[r]&&(p.stopPropagation(),h(r))}),document.getElementById("refresh")?.addEventListener("click",window.refreshAll)})(),(function(){injectModal("logs-modal",`
+  </div>`);let m=null;function h(p){m=p;const c=SITE.dnsServers[p]||{},s=document.getElementById("dns-settings-modal");document.getElementById("dns-settings-title").textContent=`${(c.name||p).toUpperCase()} Settings`,document.getElementById("dns-edit-ip").value=c.ip||"",document.getElementById("dns-edit-port").value=c.port||DC.DEFAULTS.DNS_PORT,document.getElementById("dns-edit-name").value=c.name||"",s.classList.add("show")}async function b(){if(!m)return;const p=document.getElementById("dns-edit-ip").value.trim(),c=document.getElementById("dns-edit-port").value.trim()||DC.DEFAULTS.DNS_PORT,s=document.getElementById("dns-edit-name").value.trim();if(!p){showNotification("Server IP is required","warning");return}const y={dnsServers:{}};y.dnsServers[m]={ip:p,port:String(c)},s&&(y.dnsServers[m].name=s);try{const r=await(await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(y)})).json();r.success?(SITE.dnsServers[m]=y.dnsServers[m],showNotification(`${m.toUpperCase()} settings saved`,"success"),v(),window.refreshAll()):showNotification(r.error||"Failed to save settings","error")}catch(x){showNotification("Failed to save: "+x.message,"error")}}async function g(){if(m&&confirm(`Remove ${m.toUpperCase()} from dashboard? This won't affect the actual DNS server.`))try{const c=await(await secureFetch("/api/v1/config")).json();c.dnsServers&&delete c.dnsServers[m];const y=await(await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({dnsServers:c.dnsServers||{}})})).json();if(y.success){delete SITE.dnsServers[m];const x=document.querySelector(`.top [data-app="${m}"]`);x&&x.remove(),showNotification(`${m.toUpperCase()} removed from dashboard`,"success"),v()}else showNotification(y.error||"Failed to remove","error")}catch(p){showNotification("Failed to remove: "+p.message,"error")}}function v(){closeModal("dns-settings-modal"),m=null}document.getElementById("dns-settings-cancel")?.addEventListener("click",v),document.getElementById("dns-settings-save")?.addEventListener("click",b),document.getElementById("dns-settings-delete")?.addEventListener("click",g),document.getElementById("dns-settings-modal")?.addEventListener("click",p=>{p.target.id==="dns-settings-modal"&&v()}),document.querySelector(".top")?.addEventListener("click",p=>{const c=p.target.closest('[id$="-settings"]');if(!c)return;const s=c.id.replace("-settings","");SITE.dnsServers[s]&&(p.stopPropagation(),h(s))}),document.getElementById("refresh")?.addEventListener("click",window.refreshAll)})(),(function(){injectModal("logs-modal",`
   <div id="logs-modal" class="logs-modal">
     <div class="logs-modal-content" style="min-width: 800px; max-width: 1000px;">
       <div class="logs-header">
@@ -390,66 +390,66 @@ Instructions: ${o.instructionsLink}`:"";showNotification(`${p.toUpperCase()} upd
         </div>
       </div>
     </div>
-  </div>`);let c=null,a=null,m=!1,h=null,b=null,g=!1,v=null,p=null,d=!1,r=null,f=!1;async function w(E,C=25){try{const T=getDnsServerAddr(E),$=await fetch(`/api/v1/dns/logs?server=${T}&limit=${C}`,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,server:I.server}:{error:I.error||"Failed to fetch logs"}}else return $.status===401?{error:"DNS auto-auth failed - check credentials in settings"}:{error:`HTTP ${$.status}`}}catch(T){return console.error("DNS logs fetch failed:",T),{error:T.message}}}function s(E){return{NoError:"var(--ok-fg)",NOERROR:"var(--ok-fg)",NxDomain:"var(--muted)",NXDOMAIN:"var(--muted)",Refused:"var(--bad-fg)",REFUSED:"var(--bad-fg)",ServerFailure:"#f39c12",SERVFAIL:"#f39c12"}[E]||"var(--fg)"}function t(E){const C=document.createElement("div");if(C.className="log-entry",C.style.cssText="display: grid; grid-template-columns: 140px 110px 1fr 70px 80px; gap: 8px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: center;",E.parsed===!1)return C.style.gridTemplateColumns="1fr",C.innerHTML=`<span style="color: var(--muted); font-family: monospace; font-size: 0.75rem;">${escapeHtml(E.raw)}</span>`,C;const T=s(E.rcode),$=E.rcode==="Refused"||E.rcode==="REFUSED";return C.innerHTML=`
+  </div>`);let u=null,o=null,m=!1,h=null,b=null,g=!1,v=null,p=null,c=!1,s=null,y=!1;async function x(E,k=25){try{const B=getDnsServerAddr(E),$=await fetch(`/api/v1/dns/logs?server=${B}&limit=${k}`,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,server:I.server}:{error:I.error||"Failed to fetch logs"}}else return $.status===401?{error:"DNS auto-auth failed - check credentials in settings"}:{error:`HTTP ${$.status}`}}catch(B){return console.error("DNS logs fetch failed:",B),{error:B.message}}}function r(E){return{NoError:"var(--ok-fg)",NOERROR:"var(--ok-fg)",NxDomain:"var(--muted)",NXDOMAIN:"var(--muted)",Refused:"var(--bad-fg)",REFUSED:"var(--bad-fg)",ServerFailure:"#f39c12",SERVFAIL:"#f39c12"}[E]||"var(--fg)"}function a(E){const k=document.createElement("div");if(k.className="log-entry",k.style.cssText="display: grid; grid-template-columns: 140px 110px 1fr 70px 80px; gap: 8px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: center;",E.parsed===!1)return k.style.gridTemplateColumns="1fr",k.innerHTML=`<span style="color: var(--muted); font-family: monospace; font-size: 0.75rem;">${escapeHtml(E.raw)}</span>`,k;const B=r(E.rcode),$=E.rcode==="Refused"||E.rcode==="REFUSED";return k.innerHTML=`
       <span style="color: var(--muted); font-size: 0.75rem;">${escapeHtml(E.timestamp)}</span>
       <span style="color: var(--accent); font-size: 0.75rem;" title="${escapeHtml(E.client)}">${escapeHtml(E.client)}</span>
       <span style="font-weight: 500; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; ${$?"text-decoration: line-through; opacity: 0.6;":""}" title="${escapeHtml(E.domain)}">${escapeHtml(E.domain)}</span>
       <span style="color: var(--muted); font-size: 0.75rem;">${escapeHtml(E.type)}</span>
-      <span style="color: ${T}; font-weight: 500; font-size: 0.75rem;">${escapeHtml(E.rcode)}</span>
-    `,C}async function e(){if(d){await B();return}if(g){await S();return}if(m||!c)return;const E=parseInt(document.getElementById("log-lines").value),C=document.getElementById("logs-content");try{const T=await w(c,E);if(T.error){C.innerHTML=`
+      <span style="color: ${B}; font-weight: 500; font-size: 0.75rem;">${escapeHtml(E.rcode)}</span>
+    `,k}async function e(){if(c){await L();return}if(g){await C();return}if(m||!u)return;const E=parseInt(document.getElementById("log-lines").value),k=document.getElementById("logs-content");try{const B=await x(u,E);if(B.error){k.innerHTML=`
           <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
             <div style="font-size: 1.2rem; margin-bottom: 8px;">\u26A0\uFE0F Error</div>
-            <div>${escapeHtml(T.error)}</div>
-          </div>`;return}C.innerHTML=`
+            <div>${escapeHtml(B.error)}</div>
+          </div>`;return}k.innerHTML=`
         <div style="display: grid; grid-template-columns: 140px 110px 1fr 70px 80px; gap: 8px; padding: 8px 10px; background: var(--card-base); border-bottom: 2px solid var(--border); font-size: 0.75rem; font-weight: 600; color: var(--muted); position: sticky; top: 0;">
           <span>Time</span>
           <span>Client</span>
           <span>Domain</span>
           <span>Type</span>
           <span>Status</span>
-        </div>`,T.logs&&T.logs.length>0?T.logs.forEach($=>{const I=t($);C.appendChild(I)}):C.innerHTML+=`
+        </div>`,B.logs&&B.logs.length>0?B.logs.forEach($=>{const I=a($);k.appendChild(I)}):k.innerHTML+=`
           <div style="padding: 20px; text-align: center; color: var(--muted);">
             No DNS queries logged yet
-          </div>`}catch(T){C.innerHTML=`
+          </div>`}catch(B){k.innerHTML=`
         <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
-          Failed to fetch logs: ${escapeHtml(T.message)}
-        </div>`}}function o(E){c=E,m=!1,g=!1;const C=document.getElementById("logs-modal"),T=document.getElementById("logs-title"),$=document.getElementById("logs-pause"),I=document.getElementById("logs-stream");T.textContent=`${E.toUpperCase()} DNS Logs`,$.textContent="\u23F8\uFE0F Pause",$.classList.remove("paused"),I&&(I.style.display="none"),C.classList.add("show"),e(),a=setInterval(e,DC.POLL.LOGS)}function u(){document.getElementById("logs-modal").classList.remove("show"),a&&(clearInterval(a),a=null),i(),c=null,g=!1,h=null,b=null,d=!1,v=null,p=null,m=!1}function n(E){r&&i();const C=document.getElementById("logs-stream"),T=document.getElementById("logs-pause"),$=document.getElementById("logs-content");a&&(clearInterval(a),a=null);try{r=new EventSource(`/api/v1/logs/stream/${E}`),f=!0,C.classList.add("active"),C.textContent="\u{1F534} Live",C.title="Streaming - click to stop",T.style.display="none";const I=document.getElementById("logs-title");I.textContent.includes("\u{1F534}")||(I.innerHTML=I.textContent.replace("\u{1F4CB}","\u{1F4CB} \u{1F534}")),r.onmessage=P=>{try{const D=JSON.parse(P.data);if(D.error){console.error("Stream error:",D.error),i();return}const O=document.createElement("div");O.className="log-entry",O.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const _=(D.stream||"stdout")==="stderr",R=_?"var(--bad-fg)":"var(--fg)",M=`<span style="background: ${_?"var(--bad-bg)":"var(--ok-bg)"}; color: ${R}; padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600; min-width: 50px; text-align: center;">${_?"STDERR":"STDOUT"}</span>`;for(O.innerHTML=`
-            <div style="flex-shrink: 0;">${M}</div>
-            <div style="flex: 1; color: ${R}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(D.text)}</div>
-          `,$.appendChild(O),$.scrollTop=$.scrollHeight;$.children.length>500;)$.removeChild($.firstChild)}catch(D){console.error("Error parsing stream data:",D)}},r.onerror=P=>{console.error("EventSource error:",P),i()}}catch(I){console.error("Failed to start streaming:",I),i()}}function i(){r&&(r.close(),r=null),f=!1;const E=document.getElementById("logs-stream"),C=document.getElementById("logs-pause"),T=document.getElementById("logs-title");E&&(E.classList.remove("active"),E.textContent="\u{1F4E1} Live",E.title="Enable real-time streaming"),C&&(C.style.display=""),T&&(T.textContent=T.textContent.replace(" \u{1F534}","")),g&&h&&!a&&(a=setInterval(S,DC.POLL.LOGS))}async function l(E,C=100){try{const T=`/api/v1/logs/container/${E}?tail=${C}&timestamps=true`,$=await fetch(T,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,containerName:I.containerName,containerId:I.containerId}:{error:I.error||"Failed to fetch container logs"}}else return{error:`HTTP ${$.status}: ${$.statusText}`}}catch(T){return console.error("Container logs fetch failed:",T),{error:T.message}}}function y(E){const C=document.createElement("div");C.className="log-entry",C.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const T=E.stream==="stderr"?"var(--bad-fg)":"var(--fg)",$=E.stream==="stderr"?'<span style="background: var(--bad-bg); color: var(--bad-fg); padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600;">STDERR</span>':'<span style="background: var(--ok-bg); color: var(--ok-fg); padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600;">STDOUT</span>';return C.innerHTML=`
+          Failed to fetch logs: ${escapeHtml(B.message)}
+        </div>`}}function t(E){u=E,m=!1,g=!1;const k=document.getElementById("logs-modal"),B=document.getElementById("logs-title"),$=document.getElementById("logs-pause"),I=document.getElementById("logs-stream");B.textContent=`${E.toUpperCase()} DNS Logs`,$.textContent="\u23F8\uFE0F Pause",$.classList.remove("paused"),I&&(I.style.display="none"),k.classList.add("show"),e(),o=setInterval(e,DC.POLL.LOGS)}function i(){document.getElementById("logs-modal").classList.remove("show"),o&&(clearInterval(o),o=null),d(),u=null,g=!1,h=null,b=null,c=!1,v=null,p=null,m=!1}function n(E){s&&d();const k=document.getElementById("logs-stream"),B=document.getElementById("logs-pause"),$=document.getElementById("logs-content");o&&(clearInterval(o),o=null);try{s=new EventSource(`/api/v1/logs/stream/${E}`),y=!0,k.classList.add("active"),k.textContent="\u{1F534} Live",k.title="Streaming - click to stop",B.style.display="none";const I=document.getElementById("logs-title");I.textContent.includes("\u{1F534}")||(I.innerHTML=I.textContent.replace("\u{1F4CB}","\u{1F4CB} \u{1F534}")),s.onmessage=P=>{try{const D=JSON.parse(P.data);if(D.error){console.error("Stream error:",D.error),d();return}const O=document.createElement("div");O.className="log-entry",O.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const N=(D.stream||"stdout")==="stderr",_=N?"var(--bad-fg)":"var(--fg)",U=`<span style="background: ${N?"var(--bad-bg)":"var(--ok-bg)"}; color: ${_}; padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600; min-width: 50px; text-align: center;">${N?"STDERR":"STDOUT"}</span>`;for(O.innerHTML=`
+            <div style="flex-shrink: 0;">${U}</div>
+            <div style="flex: 1; color: ${_}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(D.text)}</div>
+          `,$.appendChild(O),$.scrollTop=$.scrollHeight;$.children.length>500;)$.removeChild($.firstChild)}catch(D){console.error("Error parsing stream data:",D)}},s.onerror=P=>{console.error("EventSource error:",P),d()}}catch(I){console.error("Failed to start streaming:",I),d()}}function d(){s&&(s.close(),s=null),y=!1;const E=document.getElementById("logs-stream"),k=document.getElementById("logs-pause"),B=document.getElementById("logs-title");E&&(E.classList.remove("active"),E.textContent="\u{1F4E1} Live",E.title="Enable real-time streaming"),k&&(k.style.display=""),B&&(B.textContent=B.textContent.replace(" \u{1F534}","")),g&&h&&!o&&(o=setInterval(C,DC.POLL.LOGS))}async function l(E,k=100){try{const B=`/api/v1/logs/container/${E}?tail=${k}&timestamps=true`,$=await fetch(B,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,containerName:I.containerName,containerId:I.containerId}:{error:I.error||"Failed to fetch container logs"}}else return{error:`HTTP ${$.status}: ${$.statusText}`}}catch(B){return console.error("Container logs fetch failed:",B),{error:B.message}}}function f(E){const k=document.createElement("div");k.className="log-entry",k.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const B=E.stream==="stderr"?"var(--bad-fg)":"var(--fg)",$=E.stream==="stderr"?'<span style="background: var(--bad-bg); color: var(--bad-fg); padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600;">STDERR</span>':'<span style="background: var(--ok-bg); color: var(--ok-fg); padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600;">STDOUT</span>';return k.innerHTML=`
       <div style="flex-shrink: 0;">${$}</div>
-      <div style="flex: 1; color: ${T}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(E.text)}</div>
-    `,C}async function S(){if(m||!h||!g)return;const E=parseInt(document.getElementById("log-lines").value),C=document.getElementById("logs-content");try{const T=await l(h,E);if(T.error){C.innerHTML=`
+      <div style="flex: 1; color: ${B}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(E.text)}</div>
+    `,k}async function C(){if(m||!h||!g)return;const E=parseInt(document.getElementById("log-lines").value),k=document.getElementById("logs-content");try{const B=await l(h,E);if(B.error){k.innerHTML=`
           <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
             <div style="font-size: 1.2rem; margin-bottom: 8px;">\u26A0\uFE0F Error</div>
-            <div>${escapeHtml(T.error)}</div>
-          </div>`;return}C.innerHTML=`
+            <div>${escapeHtml(B.error)}</div>
+          </div>`;return}k.innerHTML=`
         <div style="display: flex; gap: 12px; padding: 8px 10px; background: var(--card-base); border-bottom: 2px solid var(--border); font-size: 0.75rem; font-weight: 600; color: var(--muted); position: sticky; top: 0;">
           <span style="flex-shrink: 0; width: 80px;">Stream</span>
           <span style="flex: 1;">Log Output</span>
-        </div>`,T.logs&&T.logs.length>0?(T.logs.forEach($=>{const I=y($);C.appendChild(I)}),C.scrollTop=C.scrollHeight):C.innerHTML+=`
+        </div>`,B.logs&&B.logs.length>0?(B.logs.forEach($=>{const I=f($);k.appendChild(I)}),k.scrollTop=k.scrollHeight):k.innerHTML+=`
           <div style="padding: 20px; text-align: center; color: var(--muted);">
             No logs available for this container
-          </div>`}catch(T){C.innerHTML=`
+          </div>`}catch(B){k.innerHTML=`
         <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
-          Failed to fetch logs: ${escapeHtml(T.message)}
-        </div>`}}function k(E,C){h=E,b=C,g=!0,d=!1,m=!1,i();const T=document.getElementById("logs-modal"),$=document.getElementById("logs-title"),I=document.getElementById("logs-pause"),P=document.getElementById("logs-stream");$.textContent=`\u{1F4CB} ${C} - Container Logs`,I.textContent="\u23F8\uFE0F Pause",I.classList.remove("paused"),P&&(P.style.display=""),T.classList.add("show"),S(),a=setInterval(S,DC.POLL.LOGS)}async function L(E,C=100){try{const T=`/api/v1/logs/file?path=${encodeURIComponent(E)}&tail=${C}`,$=await fetch(T,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,logPath:I.logPath,totalLines:I.totalLines}:{error:I.error||"Failed to fetch file logs"}}else return{error:(await $.json().catch(()=>({}))).error||`HTTP ${$.status}`}}catch(T){return console.error("File logs fetch failed:",T),{error:T.message}}}function x(E){const C=document.createElement("div");C.className="log-entry",C.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const T=E.text;let $="INFO",I="var(--fg)";T.match(/ERROR|FATAL|CRITICAL/i)?($="ERROR",I="var(--bad-fg)"):T.match(/WARN|WARNING/i)?($="WARN",I="#f39c12"):T.match(/DEBUG/i)&&($="DEBUG",I="var(--muted)");const D=`<span style="background: ${I==="var(--bad-fg)"?"var(--bad-bg)":"var(--ok-bg)"}; color: ${I}; padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600; min-width: 50px; text-align: center;">${$}</span>`;return C.innerHTML=`
+          Failed to fetch logs: ${escapeHtml(B.message)}
+        </div>`}}function S(E,k){h=E,b=k,g=!0,c=!1,m=!1,d();const B=document.getElementById("logs-modal"),$=document.getElementById("logs-title"),I=document.getElementById("logs-pause"),P=document.getElementById("logs-stream");$.textContent=`\u{1F4CB} ${k} - Container Logs`,I.textContent="\u23F8\uFE0F Pause",I.classList.remove("paused"),P&&(P.style.display=""),B.classList.add("show"),C(),o=setInterval(C,DC.POLL.LOGS)}async function T(E,k=100){try{const B=`/api/v1/logs/file?path=${encodeURIComponent(E)}&tail=${k}`,$=await fetch(B,{cache:"no-store",headers:{Accept:"application/json","Cache-Control":"no-cache"}});if($.ok){const I=await $.json();return I.success&&I.logs?{logs:I.logs,count:I.count,logPath:I.logPath,totalLines:I.totalLines}:{error:I.error||"Failed to fetch file logs"}}else return{error:(await $.json().catch(()=>({}))).error||`HTTP ${$.status}`}}catch(B){return console.error("File logs fetch failed:",B),{error:B.message}}}function w(E){const k=document.createElement("div");k.className="log-entry",k.style.cssText="display: flex; gap: 12px; padding: 6px 10px; border-bottom: 1px solid var(--border); font-size: 0.8rem; align-items: flex-start; font-family: monospace;";const B=E.text;let $="INFO",I="var(--fg)";B.match(/ERROR|FATAL|CRITICAL/i)?($="ERROR",I="var(--bad-fg)"):B.match(/WARN|WARNING/i)?($="WARN",I="#f39c12"):B.match(/DEBUG/i)&&($="DEBUG",I="var(--muted)");const D=`<span style="background: ${I==="var(--bad-fg)"?"var(--bad-bg)":"var(--ok-bg)"}; color: ${I}; padding: 2px 6px; border-radius: 4px; font-size: 0.7rem; font-weight: 600; min-width: 50px; text-align: center;">${$}</span>`;return k.innerHTML=`
       <div style="flex-shrink: 0;">${D}</div>
-      <div style="flex: 1; color: ${I}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(T)}</div>
-    `,C}async function B(){if(m||!v||!d)return;const E=parseInt(document.getElementById("log-lines").value),C=document.getElementById("logs-content");try{const T=await L(v,E);if(T.error){C.innerHTML=`
+      <div style="flex: 1; color: ${I}; word-break: break-all; white-space: pre-wrap;">${escapeHtml(B)}</div>
+    `,k}async function L(){if(m||!v||!c)return;const E=parseInt(document.getElementById("log-lines").value),k=document.getElementById("logs-content");try{const B=await T(v,E);if(B.error){k.innerHTML=`
           <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
             <div style="font-size: 1.2rem; margin-bottom: 8px;">\u26A0\uFE0F Error</div>
-            <div>${escapeHtml(T.error)}</div>
-          </div>`;return}C.innerHTML=`
+            <div>${escapeHtml(B.error)}</div>
+          </div>`;return}k.innerHTML=`
         <div style="display: flex; gap: 12px; padding: 8px 10px; background: var(--card-base); border-bottom: 2px solid var(--border); font-size: 0.75rem; font-weight: 600; color: var(--muted); position: sticky; top: 0;">
-          <span style="flex: 1;">Log Output (${T.count} of ${T.totalLines} lines)</span>
-        </div>`,T.logs&&T.logs.length>0?(T.logs.forEach($=>{const I=x($);C.appendChild(I)}),C.scrollTop=C.scrollHeight):C.innerHTML+=`
+          <span style="flex: 1;">Log Output (${B.count} of ${B.totalLines} lines)</span>
+        </div>`,B.logs&&B.logs.length>0?(B.logs.forEach($=>{const I=w($);k.appendChild(I)}),k.scrollTop=k.scrollHeight):k.innerHTML+=`
           <div style="padding: 20px; text-align: center; color: var(--muted);">
             No logs available in this file
-          </div>`}catch(T){C.innerHTML=`
+          </div>`}catch(B){k.innerHTML=`
         <div style="padding: 20px; text-align: center; color: var(--bad-fg);">
-          Failed to fetch logs: ${escapeHtml(T.message)}
-        </div>`}}function A(E,C){v=E,p=C,d=!0,g=!1,m=!1;const T=document.getElementById("logs-modal"),$=document.getElementById("logs-title"),I=document.getElementById("logs-pause"),P=document.getElementById("logs-stream");$.textContent=`\u{1F4CB} ${C} - Application Logs`,I.textContent="\u23F8\uFE0F Pause",I.classList.remove("paused"),P&&(P.style.display="none"),T.classList.add("show"),B(),a=setInterval(B,DC.POLL.LOGS)}document.querySelector(".top")?.addEventListener("click",E=>{const C=E.target.closest('[id$="-logs"]');if(!C)return;const T=C.id.replace("-logs","");SITE.dnsServers[T]&&o(T)}),document.getElementById("logs-close")?.addEventListener("click",u),document.getElementById("logs-pause")?.addEventListener("click",()=>{m=!m;const E=document.getElementById("logs-pause");m?(E.textContent="\u25B6\uFE0F Resume",E.classList.add("paused")):(E.textContent="\u23F8\uFE0F Pause",E.classList.remove("paused"),e())}),document.getElementById("log-lines")?.addEventListener("change",()=>{m||e()}),document.getElementById("logs-stream")?.addEventListener("click",()=>{!g||!h||(f?i():n(h))}),document.getElementById("logs-modal")?.addEventListener("click",E=>{E.target.id==="logs-modal"&&u()}),document.addEventListener("keydown",E=>{E.key==="Escape"&&document.getElementById("logs-modal")?.classList.contains("show")&&u()}),window.openContainerLogsModal=k,window.openFileLogsModal=A,window.openLogsModal=o})(),(function(){injectModal("service-edit-modal",`
+          Failed to fetch logs: ${escapeHtml(B.message)}
+        </div>`}}function A(E,k){v=E,p=k,c=!0,g=!1,m=!1;const B=document.getElementById("logs-modal"),$=document.getElementById("logs-title"),I=document.getElementById("logs-pause"),P=document.getElementById("logs-stream");$.textContent=`\u{1F4CB} ${k} - Application Logs`,I.textContent="\u23F8\uFE0F Pause",I.classList.remove("paused"),P&&(P.style.display="none"),B.classList.add("show"),L(),o=setInterval(L,DC.POLL.LOGS)}document.querySelector(".top")?.addEventListener("click",E=>{const k=E.target.closest('[id$="-logs"]');if(!k)return;const B=k.id.replace("-logs","");SITE.dnsServers[B]&&t(B)}),document.getElementById("logs-close")?.addEventListener("click",i),document.getElementById("logs-pause")?.addEventListener("click",()=>{m=!m;const E=document.getElementById("logs-pause");m?(E.textContent="\u25B6\uFE0F Resume",E.classList.add("paused")):(E.textContent="\u23F8\uFE0F Pause",E.classList.remove("paused"),e())}),document.getElementById("log-lines")?.addEventListener("change",()=>{m||e()}),document.getElementById("logs-stream")?.addEventListener("click",()=>{!g||!h||(y?d():n(h))}),document.getElementById("logs-modal")?.addEventListener("click",E=>{E.target.id==="logs-modal"&&i()}),document.addEventListener("keydown",E=>{E.key==="Escape"&&document.getElementById("logs-modal")?.classList.contains("show")&&i()}),window.openContainerLogsModal=S,window.openFileLogsModal=A,window.openLogsModal=t})(),(function(){injectModal("service-edit-modal",`
   <div id="service-edit-modal" class="weather-modal">
     <div class="weather-modal-content" style="min-width: 500px; max-width: 600px;">
       <h3 id="service-edit-title">Edit Service</h3>
@@ -604,36 +604,53 @@ Instructions: ${o.instructionsLink}`:"";showNotification(`${p.toUpperCase()} upd
 
         <div class="grid-2col">
           <div>
-            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
-            <input type="number" id="service-port-input" placeholder="e.g., 8096" style="font-size: 1rem;" />
+            <label for="service-subdomain-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Subdomain</label>
+            <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" required />
           </div>
           <div>
-            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">IP Address</label>
-            <input type="text" id="service-ip-input" placeholder="Auto-detected" style="font-size: 1rem;" />
-            <div class="quick-ip-buttons" style="display: flex; gap: 4px; margin-top: 4px; flex-wrap: wrap;">
-              <button type="button" class="quick-ip-btn" data-ip="127.0.0.1" title="Localhost" style="font-size: 0.7rem; padding: 2px 6px;">localhost</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-lan" title="LAN IP" style="font-size: 0.7rem; padding: 2px 6px;">LAN</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-tailscale" title="Tailscale IP" style="font-size: 0.7rem; padding: 2px 6px;">Tailscale</button>
-            </div>
+            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
+            <input type="number" id="service-port-input" placeholder="e.g., 8096" min="1" max="65535" required style="font-size: 1rem;" />
           </div>
         </div>
 
+        <div>
+          <label for="service-source-url" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Source URL</label>
+          <input type="url" id="service-source-url" placeholder="https://github.com/owner/repo" required style="font-size: 1rem;" />
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-sha256-input">Sha256 pin (optional)</label>
+            <input type="text" id="service-sha256-input" maxlength="64" autocomplete="off" placeholder="64 lowercase hex characters" />
+          </div>
+          <div>
+            <label for="service-git-token">Token (optional)</label>
+            <input type="password" id="service-git-token" maxlength="512" autocomplete="off" placeholder="Private repositories" />
+          </div>
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Deployed Host / IP</label>
+            <input type="text" id="service-ip-input" value="localhost" placeholder="localhost" style="font-size: 1rem;" />
+          </div>
+          <div>
+            <label for="service-logo-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Logo URL</label>
+            <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
+          </div>
+        </div>
+
+        <details id="shipdeckfile-preview">
+          <summary id="shipdeckfile-toggle" style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Show Shipdeckfile</summary>
+          <pre id="shipdeckfile-content" style="white-space: pre-wrap; max-height: 220px; overflow: auto; font-size: 0.72rem; background: var(--card-bg); padding: 10px; border-radius: 6px;">Deploy the service to render its immutable Shipdeckfile.</pre>
+        </details>
+        <div id="shipdeck-deploy-status" aria-live="polite" style="font-size: 0.78rem; color: var(--accent); min-height: 1.2em;"></div>
+
         <!-- Options (collapsed by default) -->
         <details id="local-advanced-options">
           <summary style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Options</summary>
           <div style="margin-top: 10px; display: grid; gap: 10px; font-size: 0.8rem;">
 
-            <div class="grid-2col">
-              <div>
-                <label for="service-subdomain-input">Subdomain:</label>
-                <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" />
-              </div>
-              <div>
-                <label for="service-logo-input">Logo URL:</label>
-                <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
-              </div>
-            </div>
-
             <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 8px; align-items: start;">
               <label style="display: flex; align-items: center; gap: 6px; cursor: pointer;">
                 <input type="checkbox" id="create-dns-record" checked />
@@ -805,45 +822,45 @@ Instructions: ${o.instructionsLink}`:"";showNotification(`${p.toUpperCase()} upd
         <button id="add-service-create" class="btn-accent">Create Service</button>
       </div>
     </div>
-  </div>`)})(),(function(){async function c(g){try{const v=await fetch(`/api/v1/caddy/cas?caddyfilePath=${encodeURIComponent(g)}`);if(!v.ok)throw new Error(`Failed to load CAs: ${v.status}`);const p=await v.json();if(p.success){const d=document.getElementById("existing-ca-select");return d.innerHTML="",p.cas.length===0?d.innerHTML='<option value="">No CAs found in Caddyfile</option>':(d.innerHTML='<option value="">Select existing CA...</option>',p.cas.forEach(r=>{const f=document.createElement("option");typeof r=="object"?(f.value=r.id,f.textContent=r.displayName||r.name):(f.value=r,f.textContent=r),d.appendChild(f)})),p.data.cas}else throw new Error(p.message)}catch(v){console.error("Error loading CAs:",v);const p=document.getElementById("existing-ca-select");return p.innerHTML='<option value="">Error loading CAs</option>',[]}}function a(g){const{subdomain:v,port:p,ip:d,sslType:r,caName:f,existingCa:w,enableAuth:s,enableCors:t,customHeaders:e,upstreamPath:o,healthCheck:u,timeout:n,tailscaleOnly:i}=g;let l=`${buildDomain(v)} {
-`;switch(i&&(l+=`  @blocked not remote_ip 100.64.0.0/10
+  </div>`)})(),(function(){async function u(g){try{const v=await fetch(`/api/v1/caddy/cas?caddyfilePath=${encodeURIComponent(g)}`);if(!v.ok)throw new Error(`Failed to load CAs: ${v.status}`);const p=await v.json();if(p.success){const c=document.getElementById("existing-ca-select");return c.innerHTML="",p.cas.length===0?c.innerHTML='<option value="">No CAs found in Caddyfile</option>':(c.innerHTML='<option value="">Select existing CA...</option>',p.cas.forEach(s=>{const y=document.createElement("option");typeof s=="object"?(y.value=s.id,y.textContent=s.displayName||s.name):(y.value=s,y.textContent=s),c.appendChild(y)})),p.data.cas}else throw new Error(p.message)}catch(v){console.error("Error loading CAs:",v);const p=document.getElementById("existing-ca-select");return p.innerHTML='<option value="">Error loading CAs</option>',[]}}function o(g){const{subdomain:v,port:p,ip:c,sslType:s,caName:y,existingCa:x,enableAuth:r,enableCors:a,customHeaders:e,upstreamPath:t,healthCheck:i,timeout:n,tailscaleOnly:d}=g;let l=`${buildDomain(v)} {
+`;switch(d&&(l+=`  @blocked not remote_ip 100.64.0.0/10
 `,l+=`  respond @blocked "Access denied. Tailscale connection required." 403
-`),r){case"letsencrypt":break;case"caddy-managed":l+=`  tls internal
-`;break;case"existing-ca":w&&(l+=`  tls {
-    ca ${w}
+`),s){case"letsencrypt":break;case"caddy-managed":l+=`  tls internal
+`;break;case"existing-ca":x&&(l+=`  tls {
+    ca ${x}
   }
-`);break;case"custom-ca":f&&(l+=`  tls {
-    ca ${f}
+`);break;case"custom-ca":y&&(l+=`  tls {
+    ca ${y}
   }
-`);break}if(s&&(l+=`  basicauth {
+`);break}if(r&&(l+=`  basicauth {
     admin $2a$14$hashed_password_here
   }
-`),t&&(l+=`  header {
+`),a&&(l+=`  header {
 `,l+=`    Access-Control-Allow-Origin "*"
 `,l+=`    Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
 `,l+=`    Access-Control-Allow-Headers "Content-Type, Authorization"
 `,l+=`  }
-`),e)try{const y=JSON.parse(e);l+=`  header {
-`,Object.entries(y).forEach(([S,k])=>{l+=`    ${S} "${k}"
+`),e)try{const f=JSON.parse(e);l+=`  header {
+`,Object.entries(f).forEach(([C,S])=>{l+=`    ${C} "${S}"
 `}),l+=`  }
-`}catch{console.warn("Invalid JSON in custom headers")}return u&&(l+=`  health_uri ${u}
-`),l+=`  reverse_proxy ${d}:${p} {
-`,o&&o!=="/"&&(l+=`    rewrite ${o}
+`}catch{console.warn("Invalid JSON in custom headers")}return i&&(l+=`  health_uri ${i}
+`),l+=`  reverse_proxy ${c}:${p} {
+`,t&&t!=="/"&&(l+=`    rewrite ${t}
 `),n&&n!==30&&(l+=`    transport http {
 `,l+=`      dial_timeout ${n}s
 `,l+=`      response_header_timeout ${n}s
 `,l+=`    }
 `),l+=`  }
 `,l+=`}
-`,l}async function m(g,v,p=DC.DEFAULTS.TTL){const d=window.getToken(getPrimaryDnsId(),"admin");if(!d)throw new Error("DNS admin token not configured. Please set it in the Tokens menu.");const r=buildDomain(g),f=await secureFetch("/api/v1/dns/record",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:r,ip:v,ttl:p,token:d,server:SITE.dnsIp})});if(!f.ok){const s=await f.text();throw new Error(`DNS API Error: ${f.status} - ${s}`)}const w=await f.json();if(!w.success)throw new Error(`DNS Error: ${w.error||"Unknown error"}`);return w}async function h(g){const v={id:g.subdomain,name:g.name,logo:g.logo||`/assets/${g.subdomain}.png`};g.category&&(v.category=g.category),g.containerId&&(v.containerId=g.containerId);try{const p=await secureFetch("/api/v1/services",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(v)});if(!p.ok){const d=await p.json();throw new Error(d.error||"Failed to save service")}return await window.loadServices(),window.buildGrid(),v}catch(p){throw console.error("Failed to add service to config:",p),p}}async function b(g){const v=document.getElementById("service-subdomain-input").value.trim(),p=document.getElementById("service-ip-input").value.trim()||"localhost",d=document.getElementById("service-port-input").value.trim()||"80",r=await secureFetch("/api/v1/site",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:buildDomain(v),upstream:`${p}:${d}`,config:g})}),f=await r.json();if(!r.ok||!f.success)throw new Error(f.error||`Caddy API Error: ${r.status}`);return f}window.loadExistingCAs=c,window.generateCaddyConfig=a,window.createDnsRecord=m,window.addServiceToConfig=h,window.addToCaddyfile=b})(),(function(){let c=null;function a(p){c=p;const d=document.getElementById("service-edit-modal");document.getElementById("service-edit-title").textContent=`Edit ${p.name}`,document.getElementById("edit-service-name").value=p.name,document.getElementById("edit-service-url-display").textContent=p.url||buildServiceUrl(p.id),document.getElementById("edit-service-logo-preview").src=p.logo||`/assets/${p.id}.png`,document.getElementById("edit-subdomain").value=p.id,document.getElementById("edit-port").value=p.port||"",document.getElementById("edit-ip").value=p.ip||"localhost",document.getElementById("edit-tailscale-only").checked=p.tailscaleOnly||!1,document.getElementById("edit-logo-url").value=p.logo||"";const r=document.getElementById("edit-service-category");r&&(r.dataset.current=p.category||"",typeof window.populateCategorySelects=="function"&&window.populateCategorySelects()),d.classList.add("show")}function m(){closeModal("service-edit-modal"),c=null}async function h(){if(!c)return;const p=document.getElementById("edit-subdomain").value.trim().toLowerCase(),d=document.getElementById("edit-service-name").value.trim(),r=document.getElementById("edit-port").value.trim(),f=document.getElementById("edit-ip").value.trim()||"localhost",w=document.getElementById("edit-tailscale-only").checked,s=document.getElementById("edit-logo-url").value.trim(),t=document.getElementById("edit-service-category")?.value||"";if(!p){showNotification("Subdomain is required","warning");return}const e=c.id,o=[];if(p!==e&&o.push("subdomain"),d&&d!==c.name&&o.push("name"),r&&r!==String(c.port)&&o.push("port"),f!==c.ip&&o.push("ip"),w!==(c.tailscaleOnly||!1)&&o.push("tailscale"),s&&s!==c.logo&&o.push("logo"),t!==(c.category||"")&&o.push("category"),o.length===0){m();return}const u=document.getElementById("service-edit-save");u.textContent="Saving...",u.disabled=!0;try{const i=await(await secureFetch("/api/v1/services/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({oldSubdomain:e,newSubdomain:p,name:d||c.name,port:r||c.port,ip:f,tailscaleOnly:w,logo:s||void 0,category:t})})).json();if(!i.success)throw new Error(i.error||"Failed to update service");const l=window.APPS.findIndex(y=>y.id===e);l!==-1&&(window.APPS[l]={...window.APPS[l],id:p,name:d||window.APPS[l].name,port:r||window.APPS[l].port,ip:f,tailscaleOnly:w,logo:s||window.APPS[l].logo,category:t||void 0}),m(),window.buildGrid(),window.refreshAll()}catch(n){console.error("Error saving service changes:",n),showNotification(`Error saving changes: ${n.message}`,"error")}finally{u.textContent="Save Changes",u.disabled=!1}}document.getElementById("edit-logo-file")?.addEventListener("change",async p=>{const d=p.target.files[0];if(!d)return;if(!d.type.startsWith("image/")){showNotification("Please select an image file","warning");return}const r=new FileReader;r.onload=async f=>{const w=f.target.result;if(document.getElementById("edit-service-logo-preview").src=w,document.getElementById("edit-logo-url").value=w,c)try{const t=await(await secureFetch("/api/v1/assets/upload",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({filename:`${c.id}.png`,data:w})})).json();t.success&&t.path&&(document.getElementById("edit-logo-url").val
Line truncated
+`,l}async function m(g,v,p=DC.DEFAULTS.TTL){const c=window.getToken(getPrimaryDnsId(),"admin");if(!c)throw new Error("DNS admin token not configured. Please set it in the Tokens menu.");const s=buildDomain(g),y=await secureFetch("/api/v1/dns/record",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:s,ip:v,ttl:p,token:c,server:SITE.dnsIp})});if(!y.ok){const r=await y.text();throw new Error(`DNS API Error: ${y.status} - ${r}`)}const x=await y.json();if(!x.success)throw new Error(`DNS Error: ${x.error||"Unknown error"}`);return x}async function h(g){const v={id:g.subdomain,name:g.name,logo:g.logo||`/assets/${g.subdomain}.png`};g.category&&(v.category=g.category),g.containerId&&(v.containerId=g.containerId);try{const p=await secureFetch("/api/v1/services",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(v)});if(!p.ok){const c=await p.json();throw new Error(c.error||"Failed to save service")}return await window.loadServices(),window.buildGrid(),v}catch(p){throw console.error("Failed to add service to config:",p),p}}async function b(g){const v=document.getElementById("service-subdomain-input").value.trim(),p=document.getElementById("service-ip-input").value.trim()||"localhost",c=document.getElementById("service-port-input").value.trim()||"80",s=await secureFetch("/api/v1/site",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:buildDomain(v),upstream:`${p}:${c}`,config:g})}),y=await s.json();if(!s.ok||!y.success)throw new Error(y.error||`Caddy API Error: ${s.status}`);return y}window.loadExistingCAs=u,window.generateCaddyConfig=o,window.createDnsRecord=m,window.addServiceToConfig=h,window.addToCaddyfile=b})(),(function(){let u=null;function o(p){u=p;const c=document.getElementById("service-edit-modal");document.getElementById("service-edit-title").textContent=`Edit ${p.name}`,document.getElementById("edit-service-name").value=p.name,document.getElementById("edit-service-url-display").textContent=p.url||buildServiceUrl(p.id),document.getElementById("edit-service-logo-preview").src=p.logo||`/assets/${p.id}.png`,document.getElementById("edit-subdomain").value=p.id,document.getElementById("edit-port").value=p.port||"",document.getElementById("edit-ip").value=p.ip||"localhost",document.getElementById("edit-tailscale-only").checked=p.tailscaleOnly||!1,document.getElementById("edit-logo-url").value=p.logo||"";const s=document.getElementById("edit-service-category");s&&(s.dataset.current=p.category||"",typeof window.populateCategorySelects=="function"&&window.populateCategorySelects()),c.classList.add("show")}function m(){closeModal("service-edit-modal"),u=null}async function h(){if(!u)return;const p=document.getElementById("edit-subdomain").value.trim().toLowerCase(),c=document.getElementById("edit-service-name").value.trim(),s=document.getElementById("edit-port").value.trim(),y=document.getElementById("edit-ip").value.trim()||"localhost",x=document.getElementById("edit-tailscale-only").checked,r=document.getElementById("edit-logo-url").value.trim(),a=document.getElementById("edit-service-category")?.value||"";if(!p){showNotification("Subdomain is required","warning");return}const e=u.id,t=[];if(p!==e&&t.push("subdomain"),c&&c!==u.name&&t.push("name"),s&&s!==String(u.port)&&t.push("port"),y!==u.ip&&t.push("ip"),x!==(u.tailscaleOnly||!1)&&t.push("tailscale"),r&&r!==u.logo&&t.push("logo"),a!==(u.category||"")&&t.push("category"),t.length===0){m();return}const i=document.getElementById("service-edit-save");i.textContent="Saving...",i.disabled=!0;try{const d=await(await secureFetch("/api/v1/services/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({oldSubdomain:e,newSubdomain:p,name:c||u.name,port:s||u.port,ip:y,tailscaleOnly:x,logo:r||void 0,category:a})})).json();if(!d.success)throw new Error(d.error||"Failed to update service");const l=window.APPS.findIndex(f=>f.id===e);l!==-1&&(window.APPS[l]={...window.APPS[l],id:p,name:c||window.APPS[l].name,port:s||window.APPS[l].port,ip:y,tailscaleOnly:x,logo:r||window.APPS[l].logo,category:a||void 0}),m(),window.buildGrid(),window.refreshAll()}catch(n){console.error("Error saving service changes:",n),showNotification(`Error saving changes: ${n.message}`,"error")}finally{i.textContent="Save Changes",i.disabled=!1}}document.getElementById("edit-logo-file")?.addEventListener("change",async p=>{const c=p.target.files[0];if(!c)return;if(!c.type.startsWith("image/")){showNotification("Please select an image file","warning");return}const s=new FileReader;s.onload=async y=>{const x=y.target.result;if(document.getElementById("edit-service-logo-preview").src=x,document.getElementById("edit-logo-url").value=x,u)try{const a=await(await secureFetch("/api/v1/assets/upload",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({filename:`${u.id}.png`,data:x})})).json();a.success&&a.path&&(document.getElementById("edit-logo-url").val
Line truncated
 
 This will:
 1. Pull the latest image
 2. Stop the container
 3. Recreate with same settings
 
-The service will be briefly unavailable.`))try{f&&(f.textContent="\u{1F504}",f.disabled=!0,f.title="Updating...");const t=await(await secureFetch(`/api/v1/containers/${p}/update`,{method:"POST"})).json();if(t.success){const e=window.APPS.find(o=>o.id===r);e&&t.newContainerId&&(e.containerId=t.newContainerId),f&&(f.textContent="\u2705",f.title="Updated successfully!",setTimeout(()=>{f.textContent=w,f.disabled=!1,f.title="Update container to latest version"},3e3)),setTimeout(()=>window.refreshAll(),2e3),showNotification(`${d} updated successfully!`,"success")}else throw new Error(t.error||"Update failed")}catch(s){console.error("Update error:",s),f&&(f.textContent="\u274C",f.title="Update failed",setTimeout(()=>{f.textContent=w,f.disabled=!1,f.title="Update container to latest version"},3e3)),showNotification(`Failed to update ${d}: ${s.message}`,"error")}}async function v(p,d){const r=window.APPS.find(l=>l.id===p),f=r?buildDomain(r.id):null,w=r?.containerId,s=await b(d||p,w,r?.containerId);if(s===null)return;let t={dashboard:!1,container:null,dns:null,caddy:null,service:null};if(s&&w)try{const l=new URLSearchParams({containerId:r.containerId,subdomain:r.id,ip:r.ip||"localhost",deleteContainer:"true"}),S=await(await secureFetch(`/api/v1/apps/${encodeURIComponent(r.id)}?${l.toString()}`,{method:"DELETE"})).json();S.success?t={...t,...S.results,dashboard:!1}:console.error("App removal failed:",S.error)}catch(l){console.error("App removal error:",l)}else if(s&&f){try{const l=r?.ip||"localhost",S=await(await secureFetch(`/api/v1/dns/record?domain=${encodeURIComponent(f)}&type=A&ipAddress=${encodeURIComponent(l)}&server=${SITE.dnsIp}`,{method:"DELETE"})).json();t.dns=S.success?"deleted":S.error||"failed"}catch(l){t.dns=l.message}try{const y=await(await secureFetch(`/api/v1/site/${encodeURIComponent(f)}`,{method:"DELETE"})).json();t.caddy=y.success||y.error&&y.error.includes("not found")?"removed":y.error||"failed"}catch(l){t.caddy=l.message}}const e=window.APPS.findIndex(l=>l.id===p);e>-1&&(window.APPS.splice(e,1),t.dashboard=!0);try{const l=safeGetJSON("custom-apps",[]),y=l.findIndex(S=>S.id===p);y>-1&&(l.splice(y,1),safeSet("custom-apps",JSON.stringify(l)))}catch{}try{const y=await(await secureFetch(`/api/v1/services/${encodeURIComponent(p)}`,{method:"DELETE"})).json();t.service=y.success?"removed":y.error||"failed"}catch(l){t.service=l.message}window.buildGrid(),window.refreshAll();let o=!1,u=[];t.dashboard||(o=!0,u.push("\u2717 Failed to remove from dashboard"));const n=["removed","already removed","not found","deleted","kept (user choice)","skipped","no such record","does not exist"],i=l=>!l||n.some(y=>l.toLowerCase().includes(y.toLowerCase()));t.container&&!i(t.container)&&(o=!0,u.push(`\u26A0 Container: ${t.container}`)),t.dns&&!i(t.dns)&&(o=!0,u.push(`\u26A0 DNS Record: ${t.dns}`)),t.caddy&&!i(t.caddy)&&(o=!0,u.push(`\u26A0 Caddy Config: ${t.caddy}`)),t.service&&!i(t.service)&&(o=!0,u.push(`\u26A0 Service File: ${t.service}`)),o&&showNotification(`Error deleting "${d||p}": ${u.join(", ")}`,"error",6e3)}window.openServiceEditModal=a,window.showDeleteModal=b,window.updateContainer=g,window.deleteService=v})(),(function(){function c(t){return t.toLowerCase().replace(/\s+/g,"-").replace(/[^a-z0-9-]/g,"").replace(/-+/g,"-").replace(/^-|-$/g,"")}function a(){return SITE.defaults?.sslType||(SITE.configurationType==="public"?"letsencrypt":"caddy-managed")}function m(){const t=document.getElementById("service-subdomain-input").value||"subdomain",e=document.getElementById("service-ip-input").value||h.lan||"localhost",o=document.getElementById("service-port-input").value||DC.DEFAULTS.SERVICE_PORT,u=document.getElementById("ssl-type-select").value,n=document.getElementById("ca-name-input").value||"sami-ca",i=document.getElementById("existing-ca-select").value,l=document.getElementById("enable-auth").checked,y=document.getElementById("enable-cors").checked,S=document.getElementById("custom-headers-input").value,k=document.getElementById("upstream-path-input").value||"/",L=document.getElementById("health-check-input").value,x=document.getElementById("timeout-input").value||30,B=document.getElementById("dns-preview");B&&(B.textContent=`${buildDomain(t)} \u2192 ${e}`);const A=document.getElementById("url-preview");A&&(A.textContent=buildServiceUrl(t));const E={subdomain:t,port:o,ip:e,sslType:u,caName:n,existingCa:i,enableAuth:l,enableCors:y,customHeaders:S,upstreamPath:k,healthCheck:L,timeout:x},C=window.generateCaddyConfig(E),T=document.getElementById("caddy-config-preview");T&&(T.value=C)}const h={localhost:"127.0.0.1",lan:"",tailscale:""};async function b(){try{const u=await fetch("/api/v1/network/ips",{signal:AbortSignal.timeout(2e3)});if(u.ok){const n=await u.json();n.lan&&(h.lan=n.lan),n.tailscale&&(h.tailscale=n.tailscale)}}catch{}const t=document.getElementById("quick-ip-lan"),e=document.getElementById("quick-ip-tailscale");t&&(h.lan?(t.dataset.ip=h.lan,t.textContent=`LAN (${h.lan})`,t.title=`LAN IP: ${h.lan}`):t
Line truncated
+The service will be briefly unavailable.`))try{y&&(y.textContent="\u{1F504}",y.disabled=!0,y.title="Updating...");const a=await(await secureFetch(`/api/v1/containers/${p}/update`,{method:"POST"})).json();if(a.success){const e=window.APPS.find(t=>t.id===s);e&&a.newContainerId&&(e.containerId=a.newContainerId),y&&(y.textContent="\u2705",y.title="Updated successfully!",setTimeout(()=>{y.textContent=x,y.disabled=!1,y.title="Update container to latest version"},3e3)),setTimeout(()=>window.refreshAll(),2e3),showNotification(`${c} updated successfully!`,"success")}else throw new Error(a.error||"Update failed")}catch(r){console.error("Update error:",r),y&&(y.textContent="\u274C",y.title="Update failed",setTimeout(()=>{y.textContent=x,y.disabled=!1,y.title="Update container to latest version"},3e3)),showNotification(`Failed to update ${c}: ${r.message}`,"error")}}async function v(p,c){const s=window.APPS.find(l=>l.id===p),y=s?buildDomain(s.id):null,x=s?.containerId,r=await b(c||p,x,s?.containerId);if(r===null)return;let a={dashboard:!1,container:null,dns:null,caddy:null,service:null};if(r&&x)try{const l=new URLSearchParams({containerId:s.containerId,subdomain:s.id,ip:s.ip||"localhost",deleteContainer:"true"}),C=await(await secureFetch(`/api/v1/apps/${encodeURIComponent(s.id)}?${l.toString()}`,{method:"DELETE"})).json();C.success?a={...a,...C.results,dashboard:!1}:console.error("App removal failed:",C.error)}catch(l){console.error("App removal error:",l)}else if(r&&y){try{const l=s?.ip||"localhost",C=await(await secureFetch(`/api/v1/dns/record?domain=${encodeURIComponent(y)}&type=A&ipAddress=${encodeURIComponent(l)}&server=${SITE.dnsIp}`,{method:"DELETE"})).json();a.dns=C.success?"deleted":C.error||"failed"}catch(l){a.dns=l.message}try{const f=await(await secureFetch(`/api/v1/site/${encodeURIComponent(y)}`,{method:"DELETE"})).json();a.caddy=f.success||f.error&&f.error.includes("not found")?"removed":f.error||"failed"}catch(l){a.caddy=l.message}}const e=window.APPS.findIndex(l=>l.id===p);e>-1&&(window.APPS.splice(e,1),a.dashboard=!0);try{const l=safeGetJSON("custom-apps",[]),f=l.findIndex(C=>C.id===p);f>-1&&(l.splice(f,1),safeSet("custom-apps",JSON.stringify(l)))}catch{}try{const f=await(await secureFetch(`/api/v1/services/${encodeURIComponent(p)}`,{method:"DELETE"})).json();a.service=f.success?"removed":f.error||"failed"}catch(l){a.service=l.message}window.buildGrid(),window.refreshAll();let t=!1,i=[];a.dashboard||(t=!0,i.push("\u2717 Failed to remove from dashboard"));const n=["removed","already removed","not found","deleted","kept (user choice)","skipped","no such record","does not exist"],d=l=>!l||n.some(f=>l.toLowerCase().includes(f.toLowerCase()));a.container&&!d(a.container)&&(t=!0,i.push(`\u26A0 Container: ${a.container}`)),a.dns&&!d(a.dns)&&(t=!0,i.push(`\u26A0 DNS Record: ${a.dns}`)),a.caddy&&!d(a.caddy)&&(t=!0,i.push(`\u26A0 Caddy Config: ${a.caddy}`)),a.service&&!d(a.service)&&(t=!0,i.push(`\u26A0 Service File: ${a.service}`)),t&&showNotification(`Error deleting "${c||p}": ${i.join(", ")}`,"error",6e3)}window.openServiceEditModal=o,window.showDeleteModal=b,window.updateContainer=g,window.deleteService=v})(),(function(){function u(e){return e.toLowerCase().replace(/\s+/g,"-").replace(/[^a-z0-9-]/g,"").replace(/-+/g,"-").replace(/^-|-$/g,"")}function o(){return SITE.defaults?.sslType||(SITE.configurationType==="public"?"letsencrypt":"caddy-managed")}function m(){const e=document.getElementById("service-subdomain-input").value||"subdomain",t=document.getElementById("service-ip-input").value||h.lan||"localhost",i=document.getElementById("service-port-input").value||DC.DEFAULTS.SERVICE_PORT,n=document.getElementById("ssl-type-select").value,d=document.getElementById("ca-name-input").value||"sami-ca",l=document.getElementById("existing-ca-select").value,f=document.getElementById("enable-auth").checked,C=document.getElementById("enable-cors").checked,S=document.getElementById("custom-headers-input").value,T=document.getElementById("upstream-path-input").value||"/",w=document.getElementById("health-check-input").value,L=document.getElementById("timeout-input").value||30,A=document.getElementById("dns-preview");A&&(A.textContent=`${buildDomain(e)} \u2192 ${t}`);const E=document.getElementById("url-preview");E&&(E.textContent=buildServiceUrl(e));const k={subdomain:e,port:i,ip:t,sslType:n,caName:d,existingCa:l,enableAuth:f,enableCors:C,customHeaders:S,upstreamPath:T,healthCheck:w,timeout:L},B=window.generateCaddyConfig(k),$=document.getElementById("caddy-config-preview");$&&($.value=B)}const h={localhost:"127.0.0.1",lan:"",tailscale:""};async function b(){try{const n=await fetch("/api/v1/network/ips",{signal:AbortSignal.timeout(2e3)});if(n.ok){const d=await n.json();d.lan&&(h.lan=d.lan),d.tailscale&&(h.tailscale=d.tailscale)}}catch{}const e=document.getElementById("quick-ip-lan"),t=document.getElementById("quick-ip-tailscale");e&&(h.lan?(e.dataset.ip=h.lan,e.textContent=`LAN (${h.lan})`,e.title=`LAN IP: ${h.lan}`):e
Line truncated
           <span style="color: #4caf50;">\u2713 Connected</span>
-          <span style="color: var(--muted); margin-left: 6px;">${y.self?.hostname} (${y.self?.ip})</span>
-        `,i.disabled=!1):y.installed?(n.innerHTML='<span style="color: #ff9800;">\u26A0 Not connected</span>',i.disabled=!0):(n.innerHTML='<span style="color: var(--muted);">Not available</span>',i.disabled=!0)}catch{n.innerHTML='<span style="color: var(--muted);">Could not check</span>',i.disabled=!0}i.checked=!1,m()}function p(){const t=document.getElementById("service-type-local"),e=document.getElementById("service-type-external"),o=document.getElementById("local-service-config"),u=document.getElementById("external-service-config"),n=document.getElementById("tab-local"),i=document.getElementById("tab-external");function l(){t.checked?(o.style.display="grid",u.style.display="none",n&&(n.style.background="var(--accent)",n.style.color="var(--bg)"),i&&(i.style.background="transparent",i.style.color="var(--muted)")):(o.style.display="none",u.style.display="block",i&&(i.style.background="var(--accent)",i.style.color="var(--bg)"),n&&(n.style.background="transparent",n.style.color="var(--muted)"))}t?.addEventListener("change",l),e?.addEventListener("change",l)}function d(){const t=document.getElementById("service-name-input"),e=document.getElementById("service-subdomain-input"),o=document.getElementById("subdomain-preview");let u=!1;t?.addEventListener("input",()=>{const k=c(t.value);!u&&e&&(e.value=k),o&&(o.textContent=k?`\u2192 ${buildDomain(k)}`:""),m()}),e?.addEventListener("input",()=>{u=e.value!==c(t?.value||"");const k=e.value.trim()||c(t?.value||"");o&&(o.textContent=k?`\u2192 ${buildDomain(k)}`:""),m()});const n=document.getElementById("external-service-name"),i=document.getElementById("external-service-subdomain"),l=document.getElementById("external-subdomain-preview"),y=document.getElementById("external-domain-preview");let S=!1;n?.addEventListener("input",()=>{const k=c(n.value);!S&&i&&(i.value=k);const L=i?.value||k;l&&(l.textContent=L?`\u2192 ${buildDomain(L)}`:""),y&&(y.textContent=L?buildDomain(L):"")}),i?.addEventListener("input",()=>{S=i.value!==c(n?.value||"");const k=i.value.trim()||c(n?.value||"");l&&(l.textContent=k?`\u2192 ${buildDomain(k)}`:""),y&&(y.textContent=k?buildDomain(k):"")})}async function r(){const t=document.getElementById("external-service-name").value.trim(),e=document.getElementById("external-service-url").value.trim(),o=(document.getElementById("external-service-subdomain").value.trim()||c(t)).toLowerCase(),u=document.getElementById("external-service-logo").value.trim(),n=document.getElementById("external-service-icon").value.trim(),i=document.getElementById("external-create-dns").checked,l=document.getElementById("external-create-caddy").checked,y=document.getElementById("external-proxy-ip").value.trim()||SITE.dnsIp||"localhost",S=document.getElementById("external-preserve-host").checked,k=document.getElementById("external-follow-redirects").checked,L=document.getElementById("external-service-category")?.value||"";if(!t||!e){showNotification("Please fill in Name and External URL","warning");return}if(!o){showNotification("Could not derive subdomain from name. Please set one in Options.","warning");return}if(!e.startsWith("http://")&&!e.startsWith("https://")){showNotification("External URL must start with http:// or https://","warning");return}const x=buildDomain(o);try{const B={dns:null,caddy:null,dashboard:!1};if(i)if(window.getToken(getPrimaryDnsId(),"admin"))try{const P=await(await secureFetch("/api/v1/dns/record",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:x,ip:y,ttl:DC.DEFAULTS.TTL,server:SITE.dnsIp})})).json();B.dns=P.success?"created":P.error||"failed"}catch(I){B.dns=I.message}else B.dns="no admin token (configure in \u{1F511} Tokens)";if(l)try{const $={subdomain:o,externalUrl:e,preserveHost:S,followRedirects:k,sslType:"caddy-managed",caddyfilePath:DC.DEFAULTS.CADDYFILE,reloadCaddy:!0},P=await(await secureFetch("/api/v1/site/external",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify($)})).json();B.caddy=P.success?"created":P.error||"failed"}catch($){B.caddy=$.message}const A={id:o,name:t,url:`https://${x}`,externalUrl:e,logo:u||n||"\u{1F310}",isExternal:!0,isCustom:!0};L&&(A.category=L),window.APPS.push(A),B.dashboard=!0;const E=["plex","router","chat","sync","torrent","radarr","sonarr","prowlarr","portainer","requests","jellyfin","emby"],C=window.APPS.filter($=>!E.includes($.id));safeSet("custom-services",JSON.stringify(C));try{await secureFetch("/api/v1/services",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(window.APPS)})}catch($){console.warn("Failed to save to services.json:",$)}window.buildGrid(),window.refreshAll(),f();const T=[`External service "${t}" added!`];i&&T.push(`DNS: ${B.dns==="created"?"\u2713":"\u26A0 "+B.dns}`),l&&T.push(`Caddy: ${B.caddy==="created"?"\u2713":"\u26A0 "+B.caddy}`),T.push(`Access at: https://${x}`),showNotification(T.join(" | "),"success",6e3)}catch(B){console.error("Failed to create external service:",B),showNotification(`F
Line truncated
-//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiPHN0ZGluPiJdLAogICJzb3VyY2VzQ29udGVudCI6IFsiLyoqXG4gKiBFcnJvciBIYW5kbGVyXG4gKiBIYW5kbGVzIGVycm9ycyBncmFjZWZ1bGx5IHdpdGhvdXQgYnJlYWtpbmcgdGhlIG9uYm9hcmRpbmcgdG91clxuICovXG5cbihmdW5jdGlvbih3aW5kb3cpIHtcbiAgJ3VzZSBzdHJpY3QnO1xuXG4gIGNsYXNzIEVycm9ySGFuZGxlciB7XG4gICAgY29uc3RydWN0b3IoKSB7XG4gICAgICB0aGlzLmVycm9ycyA9IFtdO1xuICAgICAgdGhpcy5tYXhFcnJvcnMgPSA1MDsgLy8gS2VlcCBsYXN0IDUwIGVycm9yc1xuICAgIH1cblxuICAgIC8qKlxuICAgICAqIExvZyBhbiBlcnJvciB3aXRob3V0IGJyZWFraW5nIHRoZSB0b3VyXG4gICAgICogQHBhcmFtIHtzdHJpbmd9IGNvbnRleHQgLSBDb250ZXh0IHdoZXJlIGVycm9yIG9jY3VycmVkXG4gICAgICogQHBhcmFtIHtFcnJvcnxzdHJpbmd9IGVycm9yIC0gVGhlIGVycm9yIG9iamVjdCBvciBtZXNzYWdlXG4gICAgICogQHBhcmFtIHtPYmplY3R9IG1ldGFkYXRhIC0gQWRkaXRpb25hbCBtZXRhZGF0YVxuICAgICAqL1xuICAgIGxvZ0Vycm9yKGNvbnRleHQsIGVycm9yLCBtZXRhZGF0YSA9IHt9KSB7XG4gICAgICBjb25zdCBlcnJvckVudHJ5ID0ge1xuICAgICAgICB0aW1lc3RhbXA6IG5ldyBEYXRlKCkudG9JU09TdHJpbmcoKSxcbiAgICAgICAgY29udGV4dCxcbiAgICAgICAgbWVzc2FnZTogZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IGVycm9yLm1lc3NhZ2UgOiBlcnJvcixcbiAgICAgICAgc3RhY2s6IGVycm9yIGluc3RhbmNlb2YgRXJyb3IgPyBlcnJvci5zdGFjayA6IG51bGwsXG4gICAgICAgIG1ldGFkYXRhXG4gICAgICB9O1xuXG4gICAgICAvLyBBZGQgdG8gZXJyb3JzIGFycmF5XG4gICAgICB0aGlzLmVycm9ycy5wdXNoKGVycm9yRW50cnkpO1xuXG4gICAgICAvLyBLZWVwIG9ubHkgbGFzdCBtYXhFcnJvcnNcbiAgICAgIGlmICh0aGlzLmVycm9ycy5sZW5ndGggPiB0aGlzLm1heEVycm9ycykge1xuICAgICAgICB0aGlzLmVycm9ycy5zaGlmdCgpO1xuICAgICAgfVxuXG4gICAgICAvLyBMb2cgdG8gY29uc29sZVxuICAgICAgY29uc29sZS5lcnJvcihgW09uYm9hcmRpbmcgRXJyb3JdICR7Y29udGV4dH06YCwgZXJyb3IsIG1ldGFkYXRhKTtcblxuICAgICAgLy8gT3B0aW9uYWxseSBzZW5kIHRvIGVycm9yIHRyYWNraW5nIHNlcnZpY2VcbiAgICAgIC8vIHRoaXMuc2VuZFRvRXJyb3JUcmFja2luZyhlcnJvckVudHJ5KTtcbiAgICB9XG5cbiAgICAvKipcbiAgICAgKiBBdHRlbXB0IHRvIHJlY292ZXIgZnJvbSBhbiBlcnJvciBhbmQgY29udGludWUgdG91clxuICAgICAqIEBwYXJhbSB7RXJyb3J9IGVycm9yIC0gVGhlIGVycm9yIG9iamVjdFxuICAgICAqIEBwYXJhbSB7bnVtYmVyfSBjdXJyZW50U3RlcCAtIEN1cnJlbnQgc3RlcCBpbmRleFxuICAgICAqIEByZXR1cm5zIHtPYmplY3R9IFJlY292ZXJ5IGFjdGlvblxuICAgICAqL1xuICAgIHJlY292ZXJGcm9tRXJyb3IoZXJyb3IsIGN1cnJlbnRTdGVwKSB7XG4gICAgICBjb25zdCBlcnJvclR5cGUgPSB0aGlzLmNsYXNzaWZ5RXJyb3IoZXJyb3IpO1xuXG4gICAgICBzd2l0Y2ggKGVycm9yVHlwZSkge1xuICAgICAgICBjYXNlICdFTEVNRU5UX05PVF9GT1VORCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignRWxlbWVudCBOb3QgRm91bmQnLCBlcnJvciwgeyBjdXJyZW50U3RlcCB9KTtcbiAgICAgICAgICByZXR1cm4geyBcbiAgICAgICAgICAgIGFjdGlvbjogJ1NLSVBfU1RFUCcsIFxuICAgICAgICAgICAgbmV4dFN0ZXA6IGN1cnJlbnRTdGVwICsgMSxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdUYXJnZXQgZWxlbWVudCBub3QgZm91bmQsIHNraXBwaW5nIHRvIG5leHQgc3RlcCdcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGNhc2UgJ1NUT1JBR0VfVU5BVkFJTEFCTEUnOlxuICAgICAgICAgIHRoaXMubG9nRXJyb3IoJ1N0b3JhZ2UgVW5hdmFpbGFibGUnLCBlcnJvcik7XG4gICAgICAgICAgcmV0dXJuIHsgXG4gICAgICAgICAgICBhY3Rpb246ICdVU0VfTUVNT1JZX1NUT1JBR0UnLFxuICAgICAgICAgICAgbWVzc2FnZTogJ0xvY2FsIHN0b3JhZ2UgdW5hdmFpbGFibGUsIHVzaW5nIGluLW1lbW9yeSBzdG9yYWdlJ1xuICAgICAgICAgIH07XG5cbiAgICAgICAgY2FzZSAnRFJJVkVSX05PVF9MT0FERUQnOlxuICAgICAgICAgIHRoaXMubG9nRXJyb3IoJ0RyaXZlci5qcyBOb3QgTG9hZGVkJywgZXJyb3IpO1xuICAgICAgICAgIHJldHVybiB7XG4gICAgICAgICAgICBhY3Rpb246ICdBQk9SVF9UT1VSJyxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdEcml2ZXIuanMgbGlicmFyeSBub3QgbG9hZGVkLCBjYW5ub3Qgc3RhcnQgdG91cidcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGNhc2UgJ0lOVkFMSURfVE9PTFRJUCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignSW52YWxpZCBUb29sdGlwIENvbmZpZ3VyYXRpb24nLCBlcnJvciwgeyBjdXJyZW50U3RlcCB9KTtcbiAgICAgICAgICByZXR1cm4ge1xuICAgICAgICAgICAgYWN0aW9uOiAnU0tJUF9TVEVQJyxcbiAgICAgICAgICAgIG5leHRTdGVwOiBjdXJyZW50U3RlcCArIDEsXG4gICAgICAgICAgICBtZXNzYWdlOiAnSW52YWxpZCB0b29sdGlwIGNvbmZpZ3VyYXRpb24sIHNraXBwaW5nJ1xuICAgICAgICAgIH07XG5cbiAgICAgICAgY2FzZSAnVEhFTUVfREVURUNUSU9OX0ZBSUxFRCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignVGhlbWUgRGV0ZWN0aW9uIEZhaWxlZCcsIGVycm9yKTtcbiAgICAgICAgICByZXR1cm4ge1xuICAgICAgICAgICAgYWN0aW9uOiAnVVNFX0RFRkFVTFRfVEhFTUUnLFxuICAgICAgICAgICAgbWVzc2FnZTogJ1VzaW5nIGRlZmF1bHQgZGFyayB0aGVtZSdcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGRlZmF1bHQ6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignVW5rbm93biBFcnJvcicsIGVycm9yLCB7IGN1cnJlbnRTdGVwIH0pO1xuICAgICAgICAgIHJldHVybiB7XG4gICAgICAgICAgICBhY3Rpb246ICdBQk9SVF9UT1VSJyxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdVbmV4cGVjdGVkIGVycm9yIG9jY3VycmVkLCBhYm9ydGluZyB0b3VyJ1xuICAgICAgICAgIH07XG4gICAgICB9XG4gICAgfVxuXG4gICAgLyoqXG4gICAgICogQ2xhc3NpZnkgZXJyb3IgdHlwZVxuICAgICAqIEBwcml2YXRlXG4gICAgICogQHBhcmFtIHtFcnJvcn0gZXJyb3IgLSBUaGUgZXJyb3Igb2JqZWN0XG4gICAgICogQHJldHVybnMge3N0cmluZ30gRXJyb3IgdHlwZVxuICAgICAqL1xuICAgIGNsYXNzaWZ5RXJyb3IoZXJyb3IpIHtcbiAgICAgIGNvbnN0IG1lc3NhZ2UgPSBlcnJvci5tZXNzYWdlIHx8IGVycm9yLnRvU3RyaW5nKCk7XG5cbiAgICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdlbGVtZW50JykgJiYgbWVzc2FnZS5pbmNsdWRlcygnbm90IGZvdW5kJykpIHtcbiAgICAgICAgcmV0dXJuICdFTEVNRU5UX05PVF9GT1VORCc7XG4gICAgICB9XG4gICAgICBpZiAobWVzc2FnZS5pbmNsdWRlcygnc3RvcmFnZScpIHx8IG1lc3NhZ2UuaW5jbHVkZXMoJ3F1b3RhJykpIHtcbiAgICAgICAgcmV0dXJuICdTVE9SQUdFX1VOQVZBSUxBQkxFJztcbiAgICAgIH1cbiAgICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdkcml2ZXInKSB8fCBtZXNzYWdlLmluY2x1ZGVzKCd1bmRlZmluZWQnKSkge1xuICAgI
Line truncated
+          <span style="color: var(--muted); margin-left: 6px;">${S.self?.hostname} (${S.self?.ip})</span>
+        `,f.disabled=!1):S.installed?(l.innerHTML='<span style="color: #ff9800;">\u26A0 Not connected</span>',f.disabled=!0):(l.innerHTML='<span style="color: var(--muted);">Not available</span>',f.disabled=!0)}catch{l.innerHTML='<span style="color: var(--muted);">Could not check</span>',f.disabled=!0}f.checked=!1,m()}function p(){const e=document.getElementById("service-type-local"),t=document.getElementById("service-type-external"),i=document.getElementById("local-service-config"),n=document.getElementById("external-service-config"),d=document.getElementById("tab-local"),l=document.getElementById("tab-external");function f(){const C=document.getElementById("add-service-create");e.checked?(i.style.display="grid",n.style.display="none",C&&(C.textContent="Deploy with Shipdeck"),d&&(d.style.background="var(--accent)",d.style.color="var(--bg)"),l&&(l.style.background="transparent",l.style.color="var(--muted)")):(i.style.display="none",n.style.display="block",C&&(C.textContent="Create Service"),l&&(l.style.background="var(--accent)",l.style.color="var(--bg)"),d&&(d.style.background="transparent",d.style.color="var(--muted)"))}e?.addEventListener("change",f),t?.addEventListener("change",f)}function c(){const e=document.getElementById("service-name-input"),t=document.getElementById("service-subdomain-input"),i=document.getElementById("subdomain-preview");let n=!1;e?.addEventListener("input",()=>{const T=u(e.value);!n&&t&&(t.value=T),i&&(i.textContent=T?`\u2192 ${buildDomain(T)}`:""),m()}),t?.addEventListener("input",()=>{n=t.value!==u(e?.value||"");const T=t.value.trim()||u(e?.value||"");i&&(i.textContent=T?`\u2192 ${buildDomain(T)}`:""),m()});const d=document.getElementById("external-service-name"),l=document.getElementById("external-service-subdomain"),f=document.getElementById("external-subdomain-preview"),C=document.getElementById("external-domain-preview");let S=!1;d?.addEventListener("input",()=>{const T=u(d.value);!S&&l&&(l.value=T);const w=l?.value||T;f&&(f.textContent=w?`\u2192 ${buildDomain(w)}`:""),C&&(C.textContent=w?buildDomain(w):"")}),l?.addEventListener("input",()=>{S=l.value!==u(d?.value||"");const T=l.value.trim()||u(d?.value||"");f&&(f.textContent=T?`\u2192 ${buildDomain(T)}`:""),C&&(C.textContent=T?buildDomain(T):"")})}async function s(){const e=document.getElementById("external-service-name").value.trim(),t=document.getElementById("external-service-url").value.trim(),i=(document.getElementById("external-service-subdomain").value.trim()||u(e)).toLowerCase(),n=document.getElementById("external-service-logo").value.trim(),d=document.getElementById("external-service-icon").value.trim(),l=document.getElementById("external-create-dns").checked,f=document.getElementById("external-create-caddy").checked,C=document.getElementById("external-proxy-ip").value.trim()||SITE.dnsIp||"localhost",S=document.getElementById("external-preserve-host").checked,T=document.getElementById("external-follow-redirects").checked,w=document.getElementById("external-service-category")?.value||"";if(!e||!t){showNotification("Please fill in Name and External URL","warning");return}if(!i){showNotification("Could not derive subdomain from name. Please set one in Options.","warning");return}if(!t.startsWith("http://")&&!t.startsWith("https://")){showNotification("External URL must start with http:// or https://","warning");return}const L=buildDomain(i);try{const A={dns:null,caddy:null,dashboard:!1};if(l)if(window.getToken(getPrimaryDnsId(),"admin"))try{const D=await(await secureFetch("/api/v1/dns/record",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:L,ip:C,ttl:DC.DEFAULTS.TTL,server:SITE.dnsIp})})).json();A.dns=D.success?"created":D.error||"failed"}catch(P){A.dns=P.message}else A.dns="no admin token (configure in \u{1F511} Tokens)";if(f)try{const I={subdomain:i,externalUrl:t,preserveHost:S,followRedirects:T,sslType:"caddy-managed",caddyfilePath:DC.DEFAULTS.CADDYFILE,reloadCaddy:!0},D=await(await secureFetch("/api/v1/site/external",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(I)})).json();A.caddy=D.success?"created":D.error||"failed"}catch(I){A.caddy=I.message}const E={id:i,name:e,url:`https://${L}`,externalUrl:t,logo:n||d||"\u{1F310}",isExternal:!0,isCustom:!0};w&&(E.category=w),window.APPS.push(E),A.dashboard=!0;const k=["plex","router","chat","sync","torrent","radarr","sonarr","prowlarr","portainer","requests","jellyfin","emby"],B=window.APPS.filter(I=>!k.includes(I.id));safeSet("custom-services",JSON.stringify(B));try{await secureFetch("/api/v1/services",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(window.APPS)})}catch(I){console.warn("Failed to save to services.json:",I)}window.buildGrid(),window.refreshAll(),y();const $=[`External service "${e}" added!`];l&&$.push(`DNS: ${A.dns==="created"?"\u2713":"\u26A0 "+A.dns}`),f&&$.push(`Caddy: ${A.caddy==="created"?"\u2713":"\u26A0 "+A.caddy}`),$.push(`Access at: https://${L
Line truncated
+//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiPHN0ZGluPiJdLAogICJzb3VyY2VzQ29udGVudCI6IFsiLyoqXG4gKiBFcnJvciBIYW5kbGVyXG4gKiBIYW5kbGVzIGVycm9ycyBncmFjZWZ1bGx5IHdpdGhvdXQgYnJlYWtpbmcgdGhlIG9uYm9hcmRpbmcgdG91clxuICovXG5cbihmdW5jdGlvbih3aW5kb3cpIHtcbiAgJ3VzZSBzdHJpY3QnO1xuXG4gIGNsYXNzIEVycm9ySGFuZGxlciB7XG4gICAgY29uc3RydWN0b3IoKSB7XG4gICAgICB0aGlzLmVycm9ycyA9IFtdO1xuICAgICAgdGhpcy5tYXhFcnJvcnMgPSA1MDsgLy8gS2VlcCBsYXN0IDUwIGVycm9yc1xuICAgIH1cblxuICAgIC8qKlxuICAgICAqIExvZyBhbiBlcnJvciB3aXRob3V0IGJyZWFraW5nIHRoZSB0b3VyXG4gICAgICogQHBhcmFtIHtzdHJpbmd9IGNvbnRleHQgLSBDb250ZXh0IHdoZXJlIGVycm9yIG9jY3VycmVkXG4gICAgICogQHBhcmFtIHtFcnJvcnxzdHJpbmd9IGVycm9yIC0gVGhlIGVycm9yIG9iamVjdCBvciBtZXNzYWdlXG4gICAgICogQHBhcmFtIHtPYmplY3R9IG1ldGFkYXRhIC0gQWRkaXRpb25hbCBtZXRhZGF0YVxuICAgICAqL1xuICAgIGxvZ0Vycm9yKGNvbnRleHQsIGVycm9yLCBtZXRhZGF0YSA9IHt9KSB7XG4gICAgICBjb25zdCBlcnJvckVudHJ5ID0ge1xuICAgICAgICB0aW1lc3RhbXA6IG5ldyBEYXRlKCkudG9JU09TdHJpbmcoKSxcbiAgICAgICAgY29udGV4dCxcbiAgICAgICAgbWVzc2FnZTogZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IGVycm9yLm1lc3NhZ2UgOiBlcnJvcixcbiAgICAgICAgc3RhY2s6IGVycm9yIGluc3RhbmNlb2YgRXJyb3IgPyBlcnJvci5zdGFjayA6IG51bGwsXG4gICAgICAgIG1ldGFkYXRhXG4gICAgICB9O1xuXG4gICAgICAvLyBBZGQgdG8gZXJyb3JzIGFycmF5XG4gICAgICB0aGlzLmVycm9ycy5wdXNoKGVycm9yRW50cnkpO1xuXG4gICAgICAvLyBLZWVwIG9ubHkgbGFzdCBtYXhFcnJvcnNcbiAgICAgIGlmICh0aGlzLmVycm9ycy5sZW5ndGggPiB0aGlzLm1heEVycm9ycykge1xuICAgICAgICB0aGlzLmVycm9ycy5zaGlmdCgpO1xuICAgICAgfVxuXG4gICAgICAvLyBMb2cgdG8gY29uc29sZVxuICAgICAgY29uc29sZS5lcnJvcihgW09uYm9hcmRpbmcgRXJyb3JdICR7Y29udGV4dH06YCwgZXJyb3IsIG1ldGFkYXRhKTtcblxuICAgICAgLy8gT3B0aW9uYWxseSBzZW5kIHRvIGVycm9yIHRyYWNraW5nIHNlcnZpY2VcbiAgICAgIC8vIHRoaXMuc2VuZFRvRXJyb3JUcmFja2luZyhlcnJvckVudHJ5KTtcbiAgICB9XG5cbiAgICAvKipcbiAgICAgKiBBdHRlbXB0IHRvIHJlY292ZXIgZnJvbSBhbiBlcnJvciBhbmQgY29udGludWUgdG91clxuICAgICAqIEBwYXJhbSB7RXJyb3J9IGVycm9yIC0gVGhlIGVycm9yIG9iamVjdFxuICAgICAqIEBwYXJhbSB7bnVtYmVyfSBjdXJyZW50U3RlcCAtIEN1cnJlbnQgc3RlcCBpbmRleFxuICAgICAqIEByZXR1cm5zIHtPYmplY3R9IFJlY292ZXJ5IGFjdGlvblxuICAgICAqL1xuICAgIHJlY292ZXJGcm9tRXJyb3IoZXJyb3IsIGN1cnJlbnRTdGVwKSB7XG4gICAgICBjb25zdCBlcnJvclR5cGUgPSB0aGlzLmNsYXNzaWZ5RXJyb3IoZXJyb3IpO1xuXG4gICAgICBzd2l0Y2ggKGVycm9yVHlwZSkge1xuICAgICAgICBjYXNlICdFTEVNRU5UX05PVF9GT1VORCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignRWxlbWVudCBOb3QgRm91bmQnLCBlcnJvciwgeyBjdXJyZW50U3RlcCB9KTtcbiAgICAgICAgICByZXR1cm4geyBcbiAgICAgICAgICAgIGFjdGlvbjogJ1NLSVBfU1RFUCcsIFxuICAgICAgICAgICAgbmV4dFN0ZXA6IGN1cnJlbnRTdGVwICsgMSxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdUYXJnZXQgZWxlbWVudCBub3QgZm91bmQsIHNraXBwaW5nIHRvIG5leHQgc3RlcCdcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGNhc2UgJ1NUT1JBR0VfVU5BVkFJTEFCTEUnOlxuICAgICAgICAgIHRoaXMubG9nRXJyb3IoJ1N0b3JhZ2UgVW5hdmFpbGFibGUnLCBlcnJvcik7XG4gICAgICAgICAgcmV0dXJuIHsgXG4gICAgICAgICAgICBhY3Rpb246ICdVU0VfTUVNT1JZX1NUT1JBR0UnLFxuICAgICAgICAgICAgbWVzc2FnZTogJ0xvY2FsIHN0b3JhZ2UgdW5hdmFpbGFibGUsIHVzaW5nIGluLW1lbW9yeSBzdG9yYWdlJ1xuICAgICAgICAgIH07XG5cbiAgICAgICAgY2FzZSAnRFJJVkVSX05PVF9MT0FERUQnOlxuICAgICAgICAgIHRoaXMubG9nRXJyb3IoJ0RyaXZlci5qcyBOb3QgTG9hZGVkJywgZXJyb3IpO1xuICAgICAgICAgIHJldHVybiB7XG4gICAgICAgICAgICBhY3Rpb246ICdBQk9SVF9UT1VSJyxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdEcml2ZXIuanMgbGlicmFyeSBub3QgbG9hZGVkLCBjYW5ub3Qgc3RhcnQgdG91cidcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGNhc2UgJ0lOVkFMSURfVE9PTFRJUCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignSW52YWxpZCBUb29sdGlwIENvbmZpZ3VyYXRpb24nLCBlcnJvciwgeyBjdXJyZW50U3RlcCB9KTtcbiAgICAgICAgICByZXR1cm4ge1xuICAgICAgICAgICAgYWN0aW9uOiAnU0tJUF9TVEVQJyxcbiAgICAgICAgICAgIG5leHRTdGVwOiBjdXJyZW50U3RlcCArIDEsXG4gICAgICAgICAgICBtZXNzYWdlOiAnSW52YWxpZCB0b29sdGlwIGNvbmZpZ3VyYXRpb24sIHNraXBwaW5nJ1xuICAgICAgICAgIH07XG5cbiAgICAgICAgY2FzZSAnVEhFTUVfREVURUNUSU9OX0ZBSUxFRCc6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignVGhlbWUgRGV0ZWN0aW9uIEZhaWxlZCcsIGVycm9yKTtcbiAgICAgICAgICByZXR1cm4ge1xuICAgICAgICAgICAgYWN0aW9uOiAnVVNFX0RFRkFVTFRfVEhFTUUnLFxuICAgICAgICAgICAgbWVzc2FnZTogJ1VzaW5nIGRlZmF1bHQgZGFyayB0aGVtZSdcbiAgICAgICAgICB9O1xuXG4gICAgICAgIGRlZmF1bHQ6XG4gICAgICAgICAgdGhpcy5sb2dFcnJvcignVW5rbm93biBFcnJvcicsIGVycm9yLCB7IGN1cnJlbnRTdGVwIH0pO1xuICAgICAgICAgIHJldHVybiB7XG4gICAgICAgICAgICBhY3Rpb246ICdBQk9SVF9UT1VSJyxcbiAgICAgICAgICAgIG1lc3NhZ2U6ICdVbmV4cGVjdGVkIGVycm9yIG9jY3VycmVkLCBhYm9ydGluZyB0b3VyJ1xuICAgICAgICAgIH07XG4gICAgICB9XG4gICAgfVxuXG4gICAgLyoqXG4gICAgICogQ2xhc3NpZnkgZXJyb3IgdHlwZVxuICAgICAqIEBwcml2YXRlXG4gICAgICogQHBhcmFtIHtFcnJvcn0gZXJyb3IgLSBUaGUgZXJyb3Igb2JqZWN0XG4gICAgICogQHJldHVybnMge3N0cmluZ30gRXJyb3IgdHlwZVxuICAgICAqL1xuICAgIGNsYXNzaWZ5RXJyb3IoZXJyb3IpIHtcbiAgICAgIGNvbnN0IG1lc3NhZ2UgPSBlcnJvci5tZXNzYWdlIHx8IGVycm9yLnRvU3RyaW5nKCk7XG5cbiAgICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdlbGVtZW50JykgJiYgbWVzc2FnZS5pbmNsdWRlcygnbm90IGZvdW5kJykpIHtcbiAgICAgICAgcmV0dXJuICdFTEVNRU5UX05PVF9GT1VORCc7XG4gICAgICB9XG4gICAgICBpZiAobWVzc2FnZS5pbmNsdWRlcygnc3RvcmFnZScpIHx8IG1lc3NhZ2UuaW5jbHVkZXMoJ3F1b3RhJykpIHtcbiAgICAgICAgcmV0dXJuICdTVE9SQUdFX1VOQVZBSUxBQkxFJztcbiAgICAgIH1cbiAgICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdkcml2ZXInKSB8fCBtZXNzYWdlLmluY2x1ZGVzKCd1bmRlZmluZWQnKSkge1xuICAgI
Line truncated

status/js/core/service-create.js

@@ -121,6 +121,8 @@
     if (modalContent) modalContent.scrollTop = 0;
 
     document.body.style.overflow = 'hidden';
+    const createButton = document.getElementById('add-service-create');
+    if (createButton) { createButton.textContent = 'Deploy with Shipdeck'; createButton.disabled = false; }
 
     // Set smart SSL default
     const sslSelect = document.getElementById('ssl-type-select');
@@ -170,14 +172,17 @@
     const tabExternal = document.getElementById('tab-external');
 
     function switchServiceType() {
+      const createButton = document.getElementById('add-service-create');
       if (localRadio.checked) {
         localConfig.style.display = 'grid';
         externalConfig.style.display = 'none';
+        if (createButton) createButton.textContent = 'Deploy with Shipdeck';
         if (tabLocal) { tabLocal.style.background = 'var(--accent)'; tabLocal.style.color = 'var(--bg)'; }
         if (tabExternal) { tabExternal.style.background = 'transparent'; tabExternal.style.color = 'var(--muted)'; }
       } else {
         localConfig.style.display = 'none';
         externalConfig.style.display = 'block';
+        if (createButton) createButton.textContent = 'Create Service';
         if (tabExternal) { tabExternal.style.background = 'var(--accent)'; tabExternal.style.color = 'var(--bg)'; }
         if (tabLocal) { tabLocal.style.background = 'transparent'; tabLocal.style.color = 'var(--muted)'; }
       }
@@ -389,8 +394,17 @@
     document.getElementById('service-name-input').value = '';
     document.getElementById('service-subdomain-input').value = '';
     document.getElementById('service-port-input').value = '';
-    document.getElementById('service-ip-input').value = QUICK_IPS.lan || '';
+    document.getElementById('service-ip-input').value = 'localhost';
     document.getElementById('service-logo-input').value = '';
+    document.getElementById('service-source-url').value = '';
+    document.getElementById('service-sha256-input').value = '';
+    document.getElementById('service-git-token').value = '';
+    const deployStatus = document.getElementById('shipdeck-deploy-status');
+    if (deployStatus) deployStatus.textContent = '';
+    const shipdeckPreview = document.getElementById('shipdeckfile-preview');
+    if (shipdeckPreview) shipdeckPreview.removeAttribute('open');
+    const shipdeckContent = document.getElementById('shipdeckfile-content');
+    if (shipdeckContent) shipdeckContent.textContent = 'Deploy the service to render its immutable Shipdeckfile.';
     document.getElementById('dns-ttl-input').value = DC.DEFAULTS.TTL;
     document.getElementById('ssl-type-select').value = getSmartSslDefault();
     document.getElementById('ca-name-input').value = '';
@@ -438,124 +452,88 @@
     if (tabExternal) { tabExternal.style.background = 'transparent'; tabExternal.style.color = 'var(--muted)'; }
   }
 
-  // ===== CREATE NEW SERVICE =====
+  // ===== DEPLOY LOCAL SOURCE WITH SHIPDECK =====
+
+  async function loadShipdeckfile(name) {
+    const content = document.getElementById('shipdeckfile-content');
+    if (!name) {
+      if (content) content.textContent = 'Enter a service name, then deploy to render its immutable Shipdeckfile.';
+      return;
+    }
+    if (content) content.textContent = 'Loading Shipdeckfile\u2026';
+    try {
+      const response = await secureFetch(`/api/v1/fleet/shipdeckfile?id=${encodeURIComponent(name)}`);
+      const result = await response.json();
+      if (!response.ok || !result.success) throw new Error(result.error || 'Shipdeckfile is not available yet');
+      if (content) content.textContent = result.shipdeckfile;
+    } catch (error) {
+      if (content) content.textContent = error.message;
+    }
+  }
 
   async function createNewService() {
-    const name = document.getElementById('service-name-input').value.trim();
-    const subdomain = (document.getElementById('service-subdomain-input').value.trim() || deriveSubdomain(name)).toLowerCase();
-    const port = document.getElementById('service-port-input').value.trim();
-    const ip = document.getElementById('service-ip-input').value.trim();
+    const nameLabel = document.getElementById('service-name-input').value.trim();
+    const name = deriveSubdomain(nameLabel);
+    const subdomain = document.getElementById('service-subdomain-input').value.trim().toLowerCase();
+    const port = Number(document.getElementById('service-port-input').value);
+    const repoUrl = document.getElementById('service-source-url').value.trim();
+    const sha256 = document.getElementById('service-sha256-input').value.trim().toLowerCase();
+    const token = document.getElementById('service-git-token').value;
+    const ip = document.getElementById('service-ip-input').value.trim() || 'localhost';
     const logo = document.getElementById('service-logo-input').value.trim();
-    const createDns = document.getElementById('create-dns-record').checked;
-    const ttl = parseInt(document.getElementById('dns-ttl-input').value) || DC.DEFAULTS.TTL;
-    const tailscaleOnly = document.getElementById('manual-tailscale-only')?.checked || false;
+    const button = document.getElementById('add-service-create');
+    const status = document.getElementById('shipdeck-deploy-status');
 
-    const sslType = document.getElementById('ssl-type-select')?.value || 'caddy-managed';
-    const caName = document.getElementById('ca-name-input')?.value || '';
-    const existingCa = document.getElementById('existing-ca-select')?.value || '';
-    const enableAuth = document.getElementById('enable-auth')?.checked || false;
-    const enableCors = document.getElementById('enable-cors')?.checked || false;
-    const customHeaders = document.getElementById('custom-headers-input')?.value || '';
-    const upstreamPath = document.getElementById('upstream-path-input')?.value || '/';
-    const healthCheck = document.getElementById('health-check-input')?.value || '';
-    const timeout = document.getElementById('timeout-input')?.value || 30;
-
-    // Category is optional — pulled from either local or external select by the
-    // openAddServiceModal reset. If user doesn't choose one, it stays undefined
-    // and we don't send it (so the backend keeps the existing behavior).
-    const categoryEl = document.getElementById('service-category-input')
-      || document.getElementById('external-service-category');
-    const category = categoryEl?.value || '';
-
-    const dnsToken = window.getToken(getPrimaryDnsId(), 'admin');
-
-    if (!name || !port || !ip) {
-      showNotification('Please fill in Name, Port, and IP Address', 'warning');
+    if (!nameLabel || !name || !subdomain || !Number.isInteger(port) || port < 1 || port > 65535 || !repoUrl) {
+      showNotification('Name, Subdomain, Port, and Source URL are required.', 'warning');
+      return;
+    }
+    if (!/^https:\/\/[A-Za-z0-9.-]+(?::\d{1,5})?\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?\/?$/.test(repoUrl)) {
+      showNotification('Source URL must be a GitHub, Gitea, or Git HTTPS URL.', 'warning');
+      return;
+    }
+    if (sha256 && !/^[a-f0-9]{64}$/.test(sha256)) {
+      showNotification('Sha256 pin must be 64 lowercase hex characters.', 'warning');
       return;
     }
 
-    if (!subdomain) {
-      showNotification('Could not derive subdomain from name. Please set one in Options.', 'warning');
-      return;
-    }
-
-    if (createDns && !dnsToken) {
-      showNotification('DNS Admin token required. Configure it in the Tokens menu first.', 'warning');
-      return;
-    }
-
-    const results = { dns: null, caddy: null, dashboard: false };
-
+    const original = button.textContent;
+    let deployed = false;
+    button.disabled = true;
+    button.textContent = 'Building\u2026';
+    if (status) status.textContent = 'Building';
     try {
-      if (createDns) {
-        try {
-          await window.createDnsRecord(subdomain, ip, ttl);
-          results.dns = 'created';
-        } catch (error) {
-          console.error('DNS creation failed:', error);
-          results.dns = error.message;
-          throw new Error(`DNS creation failed: ${error.message}`);
-        }
-      } else {
-        results.dns = 'skipped';
-      }
-
-      const caddyConfig = window.generateCaddyConfig({
-        subdomain, port, ip, sslType, caName, existingCa,
-        enableAuth, enableCors, customHeaders, upstreamPath, healthCheck, timeout, tailscaleOnly
+      const payload = { repo_url: repoUrl, name, subdomain, port };
+      if (sha256) payload.sha256 = sha256;
+      if (token) payload.token = token;
+      const response = await secureFetch('/api/v1/fleet/from-git', {
+        method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload)
       });
-
-      try {
-        const caddyResponse = await secureFetch('/api/v1/site', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            domain: buildDomain(subdomain),
-            upstream: `${ip}:${port}`,
-            config: caddyConfig
-          })
-        });
-
-        const caddyResult = await caddyResponse.json();
-        if (caddyResult.success) {
-          results.caddy = 'added & reloaded';
-        } else {
-          console.error('Caddy configuration failed:', caddyResult.error);
-          results.caddy = caddyResult.error || 'failed';
-          throw new Error(`Caddy configuration failed: ${caddyResult.error}`);
-        }
-      } catch (error) {
-        console.error('Caddy API error:', error);
-        results.caddy = error.message;
-        throw new Error(`Caddy API error: ${error.message}`);
-      }
-
-      const serviceConfig = {
-        name, subdomain, port, ip,
-        logo: logo || `/assets/${subdomain}.png`,
-        tailscaleOnly: tailscaleOnly || false
-      };
-      // Only include category if user actually picked one
-      if (category) serviceConfig.category = category;
-
-      await window.addServiceToConfig(serviceConfig);
-      results.dashboard = true;
-
-      const statusParts = [
-        `DNS: ${results.dns === 'created' ? '\u2713' : results.dns === 'skipped' ? '\u25CB' : '\u2717'}`,
-        `Caddy: ${results.caddy === 'added & reloaded' ? '\u2713' : '\u2717'}`,
-        `Dashboard: ${results.dashboard ? '\u2713' : '\u2717'}`
-      ];
-      showNotification(`Service "${name}" created! ${statusParts.join(' | ')} \u2014 ${buildServiceUrl(subdomain)}${tailscaleOnly ? ' (Tailscale)' : ''}`, 'success', 6000);
-
-      closeAddServiceModal();
-
+      button.textContent = 'Deploying\u2026';
+      if (status) status.textContent = 'Building \u2192 Deploying';
+      const result = await response.json();
+      if (!response.ok || !result.success) throw new Error(result.error || 'Shipdeck deployment failed');
+      const service = { ...result.service, name: nameLabel, ip, logo: logo || result.service.logo };
+      // /fleet/from-git has already committed this card through the API's
+      // servicesStateManager. Only mirror it in this page's in-memory model;
+      // a second /services write here would race and could overwrite peers.
+      const existing = window.APPS.findIndex(app => app.id === service.id);
+      if (existing >= 0) window.APPS[existing] = { ...window.APPS[existing], ...service };
+      else window.APPS.push(service);
+      await loadShipdeckfile(name);
+      if (status) status.textContent = `Building \u2192 Deploying \u2192 Live \u00b7 journal ${result.journal_row_id || 'recorded'}`;
+      button.textContent = 'Live';
+      deployed = true;
       window.buildGrid();
       window.refreshAll();
-
+      showNotification(`Service "${nameLabel}" is live at ${buildServiceUrl(subdomain)} \u00b7 journal ${result.journal_row_id || 'recorded'}`, 'success', 7000);
     } catch (error) {
-      console.error('Error creating service:', error);
-      showNotification(`Error creating "${name}": ${error.message}`, 'error', 6000);
+      if (status) status.textContent = `Deployment failed: ${error.message}`;
+      showNotification(`Shipdeck deployment failed: ${error.message}`, 'error', 7000);
+    } finally {
+      document.getElementById('service-git-token').value = '';
+      button.disabled = deployed;
+      if (button.textContent !== 'Live') button.textContent = original;
     }
   }
 
@@ -571,6 +549,11 @@
       createNewService();
     }
   });
+  document.getElementById('shipdeckfile-preview')?.addEventListener('toggle', (event) => {
+    if (event.target.open) {
+      loadShipdeckfile(deriveSubdomain(document.getElementById('service-name-input')?.value || ''));
+    }
+  });
 
   setupServiceTypeSwitching();
   setupAutoSubdomain();

status/js/core/service-modals.js

@@ -162,36 +162,53 @@
 
         <div class="grid-2col">
           <div>
-            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
-            <input type="number" id="service-port-input" placeholder="e.g., 8096" style="font-size: 1rem;" />
+            <label for="service-subdomain-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Subdomain</label>
+            <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" required />
           </div>
           <div>
-            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">IP Address</label>
-            <input type="text" id="service-ip-input" placeholder="Auto-detected" style="font-size: 1rem;" />
-            <div class="quick-ip-buttons" style="display: flex; gap: 4px; margin-top: 4px; flex-wrap: wrap;">
-              <button type="button" class="quick-ip-btn" data-ip="127.0.0.1" title="Localhost" style="font-size: 0.7rem; padding: 2px 6px;">localhost</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-lan" title="LAN IP" style="font-size: 0.7rem; padding: 2px 6px;">LAN</button>
-              <button type="button" class="quick-ip-btn" data-ip="" id="quick-ip-tailscale" title="Tailscale IP" style="font-size: 0.7rem; padding: 2px 6px;">Tailscale</button>
-            </div>
+            <label for="service-port-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Port</label>
+            <input type="number" id="service-port-input" placeholder="e.g., 8096" min="1" max="65535" required style="font-size: 1rem;" />
           </div>
         </div>
 
+        <div>
+          <label for="service-source-url" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Source URL</label>
+          <input type="url" id="service-source-url" placeholder="https://github.com/owner/repo" required style="font-size: 1rem;" />
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-sha256-input">Sha256 pin (optional)</label>
+            <input type="text" id="service-sha256-input" maxlength="64" autocomplete="off" placeholder="64 lowercase hex characters" />
+          </div>
+          <div>
+            <label for="service-git-token">Token (optional)</label>
+            <input type="password" id="service-git-token" maxlength="512" autocomplete="off" placeholder="Private repositories" />
+          </div>
+        </div>
+
+        <div class="grid-2col">
+          <div>
+            <label for="service-ip-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Deployed Host / IP</label>
+            <input type="text" id="service-ip-input" value="localhost" placeholder="localhost" style="font-size: 1rem;" />
+          </div>
+          <div>
+            <label for="service-logo-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Logo URL</label>
+            <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
+          </div>
+        </div>
+
+        <details id="shipdeckfile-preview">
+          <summary id="shipdeckfile-toggle" style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Show Shipdeckfile</summary>
+          <pre id="shipdeckfile-content" style="white-space: pre-wrap; max-height: 220px; overflow: auto; font-size: 0.72rem; background: var(--card-bg); padding: 10px; border-radius: 6px;">Deploy the service to render its immutable Shipdeckfile.</pre>
+        </details>
+        <div id="shipdeck-deploy-status" aria-live="polite" style="font-size: 0.78rem; color: var(--accent); min-height: 1.2em;"></div>
+
         <!-- Options (collapsed by default) -->
         <details id="local-advanced-options">
           <summary style="cursor: pointer; color: var(--accent); font-size: 0.8rem; user-select: none;">Options</summary>
           <div style="margin-top: 10px; display: grid; gap: 10px; font-size: 0.8rem;">
 
-            <div class="grid-2col">
-              <div>
-                <label for="service-subdomain-input">Subdomain:</label>
-                <input type="text" id="service-subdomain-input" placeholder="auto-derived from name" />
-              </div>
-              <div>
-                <label for="service-logo-input">Logo URL:</label>
-                <input type="text" id="service-logo-input" placeholder="/assets/name.png" />
-              </div>
-            </div>
-
             <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 8px; align-items: start;">
               <label style="display: flex; align-items: center; gap: 6px; cursor: pointer;">
                 <input type="checkbox" id="create-dns-record" checked />

status/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'dashcaddy-shell-31798d1d47';
+const CACHE = 'dashcaddy-shell-81f570ab9f';
 const PRECACHE = [
   '/',
   '/index.html',

status/tests/shipdeck-manual-add.test.js

@@ -0,0 +1,29 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const modal = fs.readFileSync(path.join(__dirname, '../js/core/service-modals.js'), 'utf8');
+const flow = fs.readFileSync(path.join(__dirname, '../js/core/service-create.js'), 'utf8');
+const bundle = fs.readFileSync(path.join(__dirname, '../dist/core.js'), 'utf8');
+
+test('Add Service keeps Local and External tabs and adds Shipdeck fields', () => {
+  for (const id of ['service-type-local', 'service-type-external', 'service-name-input', 'service-subdomain-input', 'service-port-input', 'service-source-url', 'service-sha256-input', 'service-git-token', 'service-ip-input', 'service-logo-input', 'shipdeckfile-preview']) {
+    assert.match(modal, new RegExp(`id=["']${id}["']`), id);
+  }
+  assert.match(modal, /id="service-git-token"[^>]*type="password"|type="password"[^>]*id="service-git-token"/);
+});
+
+test('Local deployment calls fleet route and renders lifecycle status', () => {
+  assert.match(flow, /secureFetch\('\/api\/v1\/fleet\/from-git'/);
+  assert.match(flow, /\/api\/v1\/fleet\/shipdeckfile\?id=/);
+  assert.match(flow, /Building.*Deploying.*Live/s);
+  assert.match(flow, /service-git-token'\)\.value = ''/);
+});
+
+test('External service flow remains present and unchanged in the bundle', () => {
+  assert.match(flow, /async function createExternalService/);
+  assert.match(flow, /\/api\/v1\/site\/external/);
+  assert.match(bundle, /\/api\/v1\/fleet\/from-git/);
+  assert.match(bundle, /\/api\/v1\/site\/external/);
+});