[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps

Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls):

P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076.
server.js passed module exports (DependencyManager class, {AutoRestartManager}
namespace, SSLMonitor class) instead of createApp()'s live instances — first
.on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx
exposed in src/app.js; server.js passes all 8 real EventEmitter instances.

P0-2: error.log corrupted since 2026-07-14. errorMiddleware called
logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper —
logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error
object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper +
~74 log.error sites swept to pass real error objects (AST-verified scope-
safe 71/71, 29/29 modules load clean).

P0-3: auth-polling storm (stranded grade=B commit never landed in prod):
401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect
every 2-8s, with misleading direct-probe fallback marking services 'up'.
Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears
_dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes.

Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and
sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors);
dockerode@5/uuid deferred (semver-major, Docker API surface).

Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings;
node --check all changed files; bundles rebuilt + SW cache bumped.

Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial
delegate per operator directive 2026-08-07. Round 1: 98-call mechanical
verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM
(re-auth freeze) — fixed in this commit as prescribed.

dashcaddy-api/routes/apps/deploy.js

@@ -95,7 +95,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
       log.info('deploy', 'DashCA: For full features, copy certificate files to ' + destPath);
       log.info('deploy', 'DashCA: Static site deployment completed successfully');
     } catch (error) {
-      log.error('deploy', 'DashCA deployment error', { error: error.message });
+      log.error('deploy', error, null, { note: 'DashCA deployment error' });
       throw new Error(`DashCA deployment failed: ${error.message}`);
     }
   }
@@ -231,7 +231,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
           await portLockManager.releasePorts(lockId);
           log.info('deploy', 'Port locks released after error', { lockId });
         } catch (releaseError) {
-          log.error('deploy', 'Failed to release port locks', { lockId, error: releaseError.message });
+          log.error('deploy', releaseError, null, { note: 'Failed to release port locks', lockId });
         }
       }
       throw deployError;
@@ -425,7 +425,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
     } catch (error) {
       try { await logError('app-deploy', error, { appId, config }); } catch (_) { /* logError failure should not mask original error */ }
       const msg = error?.message || String(error || 'Unknown error');
-      log.error('deploy', 'Deployment failed', { appId, error: msg });
+      log.error('deploy', error, null, { note: 'Deployment failed', appId });
       const template = ctx.APP_TEMPLATES[appId];
       try { ctx.notification.send('deploymentFailed', 'Deployment Failed', `Failed to deploy **${template?.name || appId}**.\nError: ${msg}`, 'error'); } catch (_) {}
       errorResponse(res, 500, ctx.safeErrorMessage(error));

dashcaddy-api/routes/apps/restore.js

@@ -297,7 +297,7 @@ module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, e
       // P0-5 fix: was `errorResponse(res, 500, err.message)` which leaks internal
       // error details (paths, stack traces, library error codes) to the client.
       // Log the actual error server-side and return a generic message.
-      log.error('apps-revert', 'Revert failed', { error: err.message, stack: err.stack });
+      log.error('apps-revert', err, null, { note: 'Revert failed', stack: err.stack });
       errorResponse(res, 500, 'Revert failed');
     }
   }, 'apps-revert'));

dashcaddy-api/routes/apps/templates.js

@@ -148,7 +148,7 @@ module.exports = function({
       }
     } catch (error) {
       results.caddy = `failed: ${error.message}`;
-      log.error('caddy', 'Caddy update error', { error: error.message });
+      log.error('caddy', error, null, { note: 'Caddy update error' });
     }
 
     try {

dashcaddy-api/routes/arr/helpers.js

@@ -37,7 +37,7 @@ module.exports = function({ docker, credentialManager, fetchT, log }) {
         stream.on('error', () => resolve(null));
       });
     } catch (error) {
-      log.error('docker', 'Failed to get API key', { containerName, error: error.message });
+      log.error('docker', error, null, { note: 'Failed to get API key', containerName });
       return null;
     }
   }
@@ -71,7 +71,7 @@ module.exports = function({ docker, credentialManager, fetchT, log }) {
         stream.on('error', () => resolve(null));
       });
     } catch (error) {
-      log.error('docker', 'Failed to get Plex token', { error: error.message });
+      log.error('docker', error, null, { note: 'Failed to get Plex token' });
       return null;
     }
   }
@@ -123,7 +123,7 @@ module.exports = function({ docker, credentialManager, fetchT, log }) {
       const sessionCookie = setCookie.split(';')[0];
       return { cookie: sessionCookie, plexToken };
     } catch (e) {
-      log.error('arr', 'Could not get Seerr session', { error: e.message });
+      log.error('arr', e, null, { note: 'Could not get Seerr session' });
       return null;
     }
   }

dashcaddy-api/routes/containers.js

@@ -162,7 +162,7 @@ module.exports = function({ docker, log, asyncHandler, workflowEngine }) {
         await newContainer.start();
       } catch (startError) {
         // Clean up the failed container so it doesn't block future attempts
-        log.error('docker', 'Failed to start new container', { containerName, error: startError.message });
+        log.error('docker', startError, null, { note: 'Failed to start new container', containerName });
         if (newContainer) {
           try { await newContainer.remove({ force: true }); } catch (e) { /* already gone */ }
         }

dashcaddy-api/routes/dns.js

@@ -110,7 +110,7 @@ module.exports = function({
         ...(result.instructions ? { manual: true, instructions: result.instructions } : {})
       });
     } catch (error) {
-      log.error('dns', 'Universal DNS record creation error', { error: error.message });
+      log.error('dns', error, null, { note: 'Universal DNS record creation error' });
       errorResponse(res, safeErrorMessage(error), 500);
     }
   }, 'dns-universal-create'));
@@ -136,7 +136,7 @@ module.exports = function({
         ...(result.instructions ? { manual: true, instructions: result.instructions } : {})
       });
     } catch (error) {
-      log.error('dns', 'Universal DNS record deletion error', { error: error.message });
+      log.error('dns', error, null, { note: 'Universal DNS record deletion error' });
       errorResponse(res, safeErrorMessage(error), 500);
     }
   }, 'dns-universal-delete'));
@@ -167,7 +167,7 @@ module.exports = function({
         throw new NotFoundError('No records found for domain');
       }
     } catch (error) {
-      log.error('dns', 'Universal DNS resolve error', { error: error.message });
+      log.error('dns', error, null, { note: 'Universal DNS resolve error' });
       errorResponse(res, safeErrorMessage(error), error.statusCode || 500);
     }
   }, 'dns-universal-resolve'));
@@ -283,7 +283,7 @@ module.exports = function({
         // Error handled by middleware
       }
     } catch (error) {
-      log.error('dns', 'DNS record creation error', { error: error.message });
+      log.error('dns', error, null, { note: 'DNS record creation error' });
       errorResponse(res, safeErrorMessage(error), 500, { details: error.cause?.code || 'fetch failed' });
     }
   }, 'dns-create-record'));
@@ -328,7 +328,7 @@ module.exports = function({
         // Error handled by middleware
       }
     } catch (error) {
-      log.error('dns', 'DNS resolve error', { error: error.message });
+      log.error('dns', error, null, { note: 'DNS resolve error' });
       // Error handled by middleware
     }
   }, 'dns-resolve'));
@@ -465,7 +465,7 @@ module.exports = function({
       });
 
     } catch (error) {
-      log.error('dns', 'DNS logs proxy error', { error: error.message });
+      log.error('dns', error, null, { note: 'DNS logs proxy error' });
       // Error handled by middleware
     }
   }, 'dns-logs'));
@@ -723,7 +723,7 @@ module.exports = function({
         // Error handled by middleware
       }
     } catch (error) {
-      log.error('dns', 'DNS update check error', { error: error.message });
+      log.error('dns', error, null, { note: 'DNS update check error' });
       // Error handled by middleware
     }
   }, 'dns-check-update'));
@@ -791,7 +791,7 @@ module.exports = function({
         manualUpdateRequired: true
       });
     } catch (error) {
-      log.error('dns', 'DNS update error', { error: error.message });
+      log.error('dns', error, null, { note: 'DNS update error' });
       // Error handled by middleware
     }
   }, 'dns-update'));

dashcaddy-api/routes/exec.js

@@ -165,7 +165,7 @@ async function handleExec(ws, containerId, log, auth) {
     });
 
   } catch (err) {
-    log.error('exec', 'Failed to start exec session', { containerId, error: err.message });
+    log.error('exec', err, null, { note: 'Failed to start exec session', containerId });
     if (ws.readyState === ws.OPEN) {
       ws.send(JSON.stringify({ type: 'error', message: err.message }));
       ws.close();

dashcaddy-api/routes/recipes/deploy.js

@@ -149,7 +149,7 @@ module.exports = function({ docker, credentialManager: _credentialManager, servi
 
       ok(res, response);
     } catch (error) {
-      log.error('recipe', 'Recipe deployment failed', { recipeId, error: error.message });
+      log.error('recipe', error, null, { note: 'Recipe deployment failed', recipeId });
 
       // Cleanup: remove partially deployed containers
       for (const deployed of deployedComponents) {

dashcaddy-api/routes/services.js

@@ -421,7 +421,7 @@ module.exports = function({
       resyncHealthChecker?.().catch(() => {});
       success(res, { message: `Service "${name}" added to dashboard` });
     } catch (error) {
-      log.error('deploy', 'Error adding service', { error: error.message });
+      log.error('deploy', error, null, { note: 'Error adding service' });
       if (error.message.includes('already exists')) {
         errorResponse(res, safeErrorMessage(error), 409);
       } else {

dashcaddy-api/routes/sites.js

@@ -46,7 +46,7 @@ module.exports = function({ asyncHandler, ok, caddy, dns, fetchT, buildDomain, a
 
     if (!response.ok) {
       const errorText = await response.text();
-      log.error('caddy', 'Caddy reload failed', { error: errorText });
+      log.error('caddy', new Error(`Caddy reload failed: ${errorText.slice(0, 500)}`));
       throw new Error('Caddy reload failed. Check server logs for details.');
     }
 

dashcaddy-api/routes/themes.js

@@ -31,7 +31,7 @@ module.exports = function({ asyncHandler, log }) {
         themes[slug] = data;
       }
     } catch (e) {
-      log.error('themes', 'Failed to read themes', { error: e.message });
+      log.error('themes', e, null, { note: 'Failed to read themes' });
     }
     return themes;
   }