Codex previously graded D (blocking) for two security concerns:
1. trust proxy:1 trusts any direct connection as a proxy
2. extractTailscaleIPs reads raw X-Forwarded-For/X-Real-IP headers
Fixes:
- trust proxy changed from '1' to ['loopback', '172.16.0.0/12', '10.0.0.0/8']
- Covers bare-metal (Caddy on localhost) and Docker bridge deployments
- External IPs cannot appear in list → cannot spoof X-Forwarded-For
- extractTailscaleIPs now uses req.ip (resolved by Express trust-proxy chain)
instead of reading raw headers directly
- Codex re-grade: B (no blocking issues)
- All 1775 tests pass
Security verified on test server:
- Sensitive routes: 403 from external ✓
- Public routes: 200 ✓
- Health endpoints: JSON 200 ✓
Documentation tells users to scrape /metrics (the Prometheus convention)
but the route only existed at /api/v1/metrics/prometheus. The root-level
/metrics returned the SPA HTML fallback via Caddy.
- Add GET /metrics to app.js (same output as /api/v1/metrics/prometheus)
- Add /metrics to PUBLIC_ROUTES in middleware.js (no auth required)
- Add /metrics to rate-limiter skip list
- Add 5 tests in metrics-root-endpoint.test.js
- Add Caddy route for /metrics on test server
- All 1775 tests pass
Codex grade: B (no blocking issues)
- Expand from 5 hardcoded languages to all 31 backend-supported languages
- Add searchable dropdown with filter input for quick language finding
- Add scrollable list (max-height: 280px) with thin scrollbar styling
- Display native label + English label for each language option
- Keyboard navigation: Arrow Up/Down to move, Enter/Space to select, Escape to close
- Fix stale filter: reopening the menu now resets all option visibility
- Return focus to trigger button on Escape close
- Add tabindex=-1 on options for keyboard focus management
- Add focus-visible outline styling for keyboard users
Codex grade: B (urn:ump:gzbxn46ebbv2w7offhlim7gwjf45lp5jv4koakojmparztu2cw6q)
- Add 'Stats Polling Interval' (default 30s) field to Health -> Configure ->
Global Settings, alongside the existing 'Polling Interval' which is now
relabeled 'Health Check Polling Interval' with the correct default of 60s.
- Persist/load statsPollingInterval via the health-settings localStorage key
(same mechanism as the other settings).
- Wire the persisted statsPollingInterval into DC.POLL.STATS so the resource
monitor / monitoring widgets honor the configured cadence (seconds -> ms).
- Update the setup wizard disk-safety 'Recommended after setup' list to
mention both polling intervals.
- Rebuild dist bundles (core.js, features.js) and bump service-worker cache.
- Remove duplicate WorkflowEngine instantiation (was created in both app.js
and server.js, causing every periodic workflow to fire twice)
- Fix self-updater _isNewer() crash loop: same-version different-commit was
treated as 'update available', then crashed on undefined tarball path.
Now only triggers on actual version bumps
- Increase container stats interval from 10s to 30s
- Increase health check interval from 30s to 60s
- Add disk cleanup debounce (skip if last cleanup < 30 min ago)
- Remove redundant disk-space-monitor from server.js (already in app.js)
- 69/69 tests pass
- Fixed detectLanguage() to properly parse Accept-Language q-values
(sort by q descending before matching, was returning first-in-list)
- Updated 5 stale test assertions that assumed only 5 languages existed
(zh and ja are now supported after the DC-077 31-language expansion)
- All 1770 tests pass
- Add dedicated 'Disk Usage Note' step to setup wizard, shown after the
configuration summary. Warns that health history, container stats, and
event logs accumulate and links to Settings -> Health for retention limits.
- Repoint the finish button to the new step (summary now has 'Continue ->').
- Remove the now-redundant inline disk tip from the JS-rendered summary.
- Add 'Max Entries Per Service' (default 500) setting to the Health -> Configure
-> Global Settings panel alongside the existing retention-days setting.
Add sensitiveRouteMiddleware that blocks /api/v1/config, /api/v1/tailscale/status,
/api/v1/tailscale/devices, /api/v1/updates/available when TOTP is disabled and
the request comes from a non-Tailscale IP. This prevents infrastructure detail
leaks on internet-exposed deployments.
Verified on test.dashcaddy.net: all 3 routes now return 403.
- New i18n.js module: window.DCI18n.t(key), language dropdown selector
- Supports 5 languages (en, es, fr, de, ar) with RTL for Arabic
- Translations loaded from /api/v1/i18n/translations/:lang
- Language preference persisted in localStorage
- Added to features.js bundle
- Setup wizard summary step: add disk-safety info box warning about
health-check data accumulation and pointing to retention settings
- Setup wizard showSummary(): add dynamic disk-space tip with defaults
- Health Configure tab: add Global Settings section with data retention
(default 30 days), polling interval (default 30s), and disk-usage
warning threshold (default 80%), persisted to localStorage
- Rebuild dist bundles
AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector
TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action
Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch
MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars
i18n:
- Expanded from 6 to 31 languages (no Hebrew per policy)
- Added: pt, ru, ja, ko, hi, tr, it, nl, pl, sv, id, uk, th, vi, fa, cs, ms, ro, el, bn, hu, fi, da, no, ur
- RTL support for ar, fa, ur
- Language selector dropdown wired into dashboard navbar
Disk Safety:
- New backend route /api/v1/disk-settings (GET/POST/cleanup)
- Frontend modal with sliders for health interval, max entries, retention days
- Clean Up Now button triggers immediate cleanup
- Wired into dashboard navbar
Desktop Auto-Updater (from timed-out subagent):
- electron-updater installed and configured
- Checks get.dashcaddy.net/release/ for updates
- Publish config added to package.json
VM Uninstall:
- Wizard calls vmDestroy before regular uninstall
- Cleans up VM/disk sandbox on uninstall
Cleanup:
- Recursive data nesting guard (nesting-guard.js)
- Removed 242MB of data/data/data/ duplicates
- Cleaned 242MB of recursive data/data/data/ nesting
- Added nesting-guard.js: auto-detects and removes recursive duplicates at startup
- Wired VM sandbox cleanup into uninstall wizard (calls vmDestroy before regular uninstall)
- Container stats, health data, and VM disk all cleaned on uninstall
- Add VM provisioning module (vm-provisioner.js) with 3 platform strategies:
* Windows: WSL2 distro with fixed VHDX
* macOS: Lima VM with fixed disk
* Linux: loopback ext4 image
- Add IPC handlers (vm-ipc.js) for Electron wizard integration
- Add disk budget wizard step (disk-budget-step.js) with presets
- Wire VM handlers into main process (index.js)
- Add preload bridges for VM operations
- Update install.sh with --disk-size flag and sandbox functions
- Add disk safety env vars to docker-compose template
- Add memory limits to prevent OOM during startup
Users can now pick a disk budget (10GB/30GB/100GB/custom) and DashCaddy
creates a sandboxed VM that physically cannot exceed that limit.
Uninstall cleanly removes the entire VM/disk with zero leakage.
ARCHITECTURE:
- Windows: dedicated WSL2 distro with fixed VHDX, Docker inside
- macOS: Lima VM with fixed disk, Docker inside
- Linux: sparse ext4 loopback image, Docker data-root inside
NEW FILES:
- vm-provisioner.js: core provisioning engine (create/start/destroy/export)
- Disk presets: Minimal(10GB), Balanced(30GB), Power(100GB), Custom
- Sparse images that grow on demand (start at ~0 bytes)
- Full lifecycle: provision → deploy DashCaddy → destroy (clean removal)
- Data export before uninstall for users who want to migrate
- vm-ipc.js: Electron IPC handlers connecting wizard to provisioner
- vm:provision, vm:destroy, vm:get-status, vm:export-data, vm:get-presets
- disk-budget-step.js: wizard UI step with preset cards + custom slider
- Real-time free space check against selected disk size
- Plain English description of what each tier handles
UPDATED:
- caddyfile-generator.js: docker-compose now includes disk safety env vars
(health retention, stats caps, memory limits) as defense-in-depth
even inside the VM sandbox
GUARANTEE: DashCaddy physically cannot exceed the storage budget.
The OS enforces the limit at the disk/image level, not our code.
- New route /api/v1/log-insights: analyzes audit logs + security events
- Shows top IPs with request counts, failures, and top actions
- Plain English insights (heavy users, auth failures, security alerts)
- Summary stats: total requests, unique IPs, failed actions
- Storage info showing log file sizes and entry counts
- New route POST /api/v1/log-insights/dispose: preview-then-confirm cleanup
- First call shows what would be deleted (preview mode)
- Second call with confirm:true actually deletes
- Configurable retention period (default 30 days)
- Frontend panel with modal UI showing insights as cards
- Period selector (1h, 6h, 24h, 7d)
- Top visitors table with IP, requests, failures, actions, last seen
- Storage info footer
- Clean Old Logs button with preview confirmation dialog
- Wired into app.js and dashboard navbar (🔍 Insights button)
- Addresses QA issue: users need to see who is accessing before cleanup
DashCaddy is now controllable by ANY AI agent via Model Context Protocol.
17 MCP tools exposed:
- Service management: list, get, health check
- Container management: list, start/stop/restart/remove
- Deployment: deploy app, wizard recommendations, catalog search, discovery
- System: health, metrics, diagnostics
- Infrastructure: DNS listing, Caddyfile generation
- Backup & Recovery: create backup, status
- Fleet: list hosts
Protocol: JSON-RPC 2.0 over stdio
Connection: DASHCADDY_URL + DASHCADDY_API_KEY env vars
Any MCP-compatible agent (Claude Desktop, Hermes, GPT) can now:
'I want to stream movies' → wizard recommends Plex/Sonarr/Radarr
'Deploy Plex' → container + Caddyfile + DNS + health check
'Why is Plex down?' → diagnostics with structured findings
'Back up everything' → full snapshot
14 tests, 1752 total pass.
5 endpoints:
- GET /api/v1/fleet/hosts — list registered hosts
- POST /api/v1/fleet/hosts — register host (name, hostname, apiKey, tags)
- DELETE /api/v1/fleet/hosts/:hostId — deregister
- GET /api/v1/fleet/status — fleet-wide health check (parallel probes)
- POST /api/v1/fleet/deploy — generate multi-host deployment plan
Host state persisted in fleet-hosts.json. API keys stored as SHA-256 hashes.
Status endpoint probes each host's /api/v1/system/health in parallel with 3s timeout.
THIS COMPLETES THE ENTIRE 46-ITEM BACKLOG! 1633 tests pass.
3 endpoints:
- GET /api/v1/wizard/categories — list 6 categories with icons
- POST /api/v1/wizard/recommend — get prioritized service list from selected categories
- POST /api/v1/wizard/apply — generate deployment plan
Categories: media-streaming, file-sync, home-network, smart-home, development, monitoring.
Hardware profiles: minimal (3 svcs), medium (6), powerful (12).
Cross-category dedup with priority sorting. 1633 tests pass.
POST /api/v1/discover/adopt — takes a discovered container and creates:
1. DashCaddy service entry (with subdomain, domain, URL)
2. Caddyfile reverse_proxy route via admin API
3. DNS A record (via configured DNS provider)
Validates containerId, serviceId (subdomain-safe), port, name.
Prevents duplicate service IDs. 1633 tests pass.
Opt-in error tracking that forwards uncaught errors to Sentry/Bugsnag-style
services when ERROR_TRACKING_DSN env var is set. Without DSN, disabled.
Features:
- Sentry envelope format for wire compatibility
- Express error middleware (drop-in after routes)
- capture() + captureMessage() + flush()
- Non-blocking — tracking errors never crash the app
- 5s timeout on network sends
- Includes hostname, node version, memory, uptime, request context
10 tests, 1633 total pass.
Hermes