The meta CSP (no unsafe-inline/unsafe-hashes) blocks ALL inline event
handlers; 19 controls were silently dead in every modern browser.
Revived:
- Disk Safety: toolbar button, injected modal Close/Save/Clean Up, and
the 5 settings sliders (oninput -> input listeners; value labels
never updated)
- AI chat FAB click; hover scale moved to a #ai-chat-fab:hover rule
- TOTP/login logo broken-image fallbacks: capture-phase error
delegation + WeakSet + complete/naturalWidth race guard in
totp-auth.js; updateTotpLogo never resurrects a broken logo
(6 onerror attrs stripped from index.html + auth-gate.js templates)
- favicon-preview data-URI fallback (same race guard)
- app-selector folder-chip remove buttons (data-remove-folder)
- premium upsells in backup-restore + workflows (data-upgrade-msg) —
their old onclick also called scrollToSection('license'), a function
that has never existed anywhere in the codebase; now opens the real
license UI via window.openLicenseModal (license.js)
- health-check Edit/Delete dispatch the same CustomEvents via
data-health-action/data-service-id
- smart-arr Test button via data-smart-test
Verified: zero inline handler attributes remain across index.html +
hand-written js (grep); node --check clean x12; status suite 68/68;
dist rebuilt (SW dashcaddy-shell-36d9aa3364, CSP hash unchanged).
r1 grade C (missed sliders + logo onerror) -> r2 grade A:
urn:ump:mptri3qhywc2e47f2ba4qjafhwm3olzvrvt5vphxoyhea3vgt32a /
urn:ump:josd2g7kqv476vux6euigmygdkijya2s4tsbyivtobw5ftzuf6ba
- New src/config/disk-settings-loader.js runs once at boot (require'd into
src/app.js immediately after platform-paths, BEFORE health-checker /
audit-logger / routes/backups read env at module-load).
- Routes the persisted values from <dataDir>/disk-settings.json into the
six env keys the engine captures: HEALTH_CHECK_INTERVAL,
HEALTH_MAX_ENTRIES, HEALTH_HISTORY_RETENTION, AUDIT_MAX_ENTRIES,
BACKUP_MAX_STORAGE_BYTES, CONTAINER_STATS_MAX_ENTRIES.
- Explicit process.env values WIN over persisted file (operator override).
- Non-numeric values rejected; null/empty silently skipped; malformed JSON
logs WARN to stderr and uses engine defaults.
- Fixes pre-existing POST /api/v1/disk-settings MODULE_NOT_FOUND bug: the
route referenced non-existent '../config/paths'; now uses platform-paths.
- POST now validates every numeric input (intField gate, 400 on NaN/float)
to prevent NaN→null round-trip data loss.
- Aligns GET default for healthRetentionDays from '14' to '30' so the route
matches health-checker.js:34 (engine) and the modal's ||30 fallback.
- 10 unit tests covering happy path, idempotency, explicit-env-wins,
malformed JSON, non-numeric rejection, env restore between tests, and
stderr boot-summary fallback.
GLM-5.3 round 1: B (route MODULE_NOT_FOUND + MEDIUM POST NaN→null + boot log LOW).
GLM-5.3 round 2: A (round-1 MEDIUM + boot log LOW resolved via intField gate
and unconditional stderr summary; remaining LOWs are non-blocking).
Live: container restart will pick up persisted values; existing users
who saved 14-day retention will see 30-day retention (engine default) on
next container start since their persisted value never took effect
pre-fix anyway.
C-grade round-1 blockers fixed:
- [HIGH] retention default 14d → 30d to match engine (health-checker.js:34)
- [MEDIUM] phantom 'Settings → Disk Safety' path removed
- [MEDIUM] dangling 'stats polling interval' bullet (no such control in modal)
- [LOW] exaggerated 'hundreds of MB' → 'tens of MB'
- [LOW] button label mismatch (real button is '💾 Disk')
GLM round 2 verified all 5 fixes landed; no new regressions; HTML balanced.
Pre-existing follow-up parked: disk-settings.json saved values not reloaded by engine on container restart (out of scope for this commit).
i18n:
- Expanded from 6 to 31 languages (no Hebrew per policy)
- Added: pt, ru, ja, ko, hi, tr, it, nl, pl, sv, id, uk, th, vi, fa, cs, ms, ro, el, bn, hu, fi, da, no, ur
- RTL support for ar, fa, ur
- Language selector dropdown wired into dashboard navbar
Disk Safety:
- New backend route /api/v1/disk-settings (GET/POST/cleanup)
- Frontend modal with sliders for health interval, max entries, retention days
- Clean Up Now button triggers immediate cleanup
- Wired into dashboard navbar
Desktop Auto-Updater (from timed-out subagent):
- electron-updater installed and configured
- Checks get.dashcaddy.net/release/ for updates
- Publish config added to package.json
VM Uninstall:
- Wizard calls vmDestroy before regular uninstall
- Cleans up VM/disk sandbox on uninstall
Cleanup:
- Recursive data nesting guard (nesting-guard.js)
- Removed 242MB of data/data/data/ duplicates
Hermes