- Expand from 5 hardcoded languages to all 31 backend-supported languages
- Add searchable dropdown with filter input for quick language finding
- Add scrollable list (max-height: 280px) with thin scrollbar styling
- Display native label + English label for each language option
- Keyboard navigation: Arrow Up/Down to move, Enter/Space to select, Escape to close
- Fix stale filter: reopening the menu now resets all option visibility
- Return focus to trigger button on Escape close
- Add tabindex=-1 on options for keyboard focus management
- Add focus-visible outline styling for keyboard users
Codex grade: B (urn:ump:gzbxn46ebbv2w7offhlim7gwjf45lp5jv4koakojmparztu2cw6q)
- Add 'Stats Polling Interval' (default 30s) field to Health -> Configure ->
Global Settings, alongside the existing 'Polling Interval' which is now
relabeled 'Health Check Polling Interval' with the correct default of 60s.
- Persist/load statsPollingInterval via the health-settings localStorage key
(same mechanism as the other settings).
- Wire the persisted statsPollingInterval into DC.POLL.STATS so the resource
monitor / monitoring widgets honor the configured cadence (seconds -> ms).
- Update the setup wizard disk-safety 'Recommended after setup' list to
mention both polling intervals.
- Rebuild dist bundles (core.js, features.js) and bump service-worker cache.
- Remove duplicate WorkflowEngine instantiation (was created in both app.js
and server.js, causing every periodic workflow to fire twice)
- Fix self-updater _isNewer() crash loop: same-version different-commit was
treated as 'update available', then crashed on undefined tarball path.
Now only triggers on actual version bumps
- Increase container stats interval from 10s to 30s
- Increase health check interval from 30s to 60s
- Add disk cleanup debounce (skip if last cleanup < 30 min ago)
- Remove redundant disk-space-monitor from server.js (already in app.js)
- 69/69 tests pass
- Fixed detectLanguage() to properly parse Accept-Language q-values
(sort by q descending before matching, was returning first-in-list)
- Updated 5 stale test assertions that assumed only 5 languages existed
(zh and ja are now supported after the DC-077 31-language expansion)
- All 1770 tests pass
- Add dedicated 'Disk Usage Note' step to setup wizard, shown after the
configuration summary. Warns that health history, container stats, and
event logs accumulate and links to Settings -> Health for retention limits.
- Repoint the finish button to the new step (summary now has 'Continue ->').
- Remove the now-redundant inline disk tip from the JS-rendered summary.
- Add 'Max Entries Per Service' (default 500) setting to the Health -> Configure
-> Global Settings panel alongside the existing retention-days setting.
Add sensitiveRouteMiddleware that blocks /api/v1/config, /api/v1/tailscale/status,
/api/v1/tailscale/devices, /api/v1/updates/available when TOTP is disabled and
the request comes from a non-Tailscale IP. This prevents infrastructure detail
leaks on internet-exposed deployments.
Verified on test.dashcaddy.net: all 3 routes now return 403.
- New i18n.js module: window.DCI18n.t(key), language dropdown selector
- Supports 5 languages (en, es, fr, de, ar) with RTL for Arabic
- Translations loaded from /api/v1/i18n/translations/:lang
- Language preference persisted in localStorage
- Added to features.js bundle
- Setup wizard summary step: add disk-safety info box warning about
health-check data accumulation and pointing to retention settings
- Setup wizard showSummary(): add dynamic disk-space tip with defaults
- Health Configure tab: add Global Settings section with data retention
(default 30 days), polling interval (default 30s), and disk-usage
warning threshold (default 80%), persisted to localStorage
- Rebuild dist bundles
AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector
TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action
Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch
MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars
i18n:
- Expanded from 6 to 31 languages (no Hebrew per policy)
- Added: pt, ru, ja, ko, hi, tr, it, nl, pl, sv, id, uk, th, vi, fa, cs, ms, ro, el, bn, hu, fi, da, no, ur
- RTL support for ar, fa, ur
- Language selector dropdown wired into dashboard navbar
Disk Safety:
- New backend route /api/v1/disk-settings (GET/POST/cleanup)
- Frontend modal with sliders for health interval, max entries, retention days
- Clean Up Now button triggers immediate cleanup
- Wired into dashboard navbar
Desktop Auto-Updater (from timed-out subagent):
- electron-updater installed and configured
- Checks get.dashcaddy.net/release/ for updates
- Publish config added to package.json
VM Uninstall:
- Wizard calls vmDestroy before regular uninstall
- Cleans up VM/disk sandbox on uninstall
Cleanup:
- Recursive data nesting guard (nesting-guard.js)
- Removed 242MB of data/data/data/ duplicates
- Cleaned 242MB of recursive data/data/data/ nesting
- Added nesting-guard.js: auto-detects and removes recursive duplicates at startup
- Wired VM sandbox cleanup into uninstall wizard (calls vmDestroy before regular uninstall)
- Container stats, health data, and VM disk all cleaned on uninstall
- Add VM provisioning module (vm-provisioner.js) with 3 platform strategies:
* Windows: WSL2 distro with fixed VHDX
* macOS: Lima VM with fixed disk
* Linux: loopback ext4 image
- Add IPC handlers (vm-ipc.js) for Electron wizard integration
- Add disk budget wizard step (disk-budget-step.js) with presets
- Wire VM handlers into main process (index.js)
- Add preload bridges for VM operations
- Update install.sh with --disk-size flag and sandbox functions
- Add disk safety env vars to docker-compose template
- Add memory limits to prevent OOM during startup
Users can now pick a disk budget (10GB/30GB/100GB/custom) and DashCaddy
creates a sandboxed VM that physically cannot exceed that limit.
Uninstall cleanly removes the entire VM/disk with zero leakage.
ARCHITECTURE:
- Windows: dedicated WSL2 distro with fixed VHDX, Docker inside
- macOS: Lima VM with fixed disk, Docker inside
- Linux: sparse ext4 loopback image, Docker data-root inside
NEW FILES:
- vm-provisioner.js: core provisioning engine (create/start/destroy/export)
- Disk presets: Minimal(10GB), Balanced(30GB), Power(100GB), Custom
- Sparse images that grow on demand (start at ~0 bytes)
- Full lifecycle: provision → deploy DashCaddy → destroy (clean removal)
- Data export before uninstall for users who want to migrate
- vm-ipc.js: Electron IPC handlers connecting wizard to provisioner
- vm:provision, vm:destroy, vm:get-status, vm:export-data, vm:get-presets
- disk-budget-step.js: wizard UI step with preset cards + custom slider
- Real-time free space check against selected disk size
- Plain English description of what each tier handles
UPDATED:
- caddyfile-generator.js: docker-compose now includes disk safety env vars
(health retention, stats caps, memory limits) as defense-in-depth
even inside the VM sandbox
GUARANTEE: DashCaddy physically cannot exceed the storage budget.
The OS enforces the limit at the disk/image level, not our code.
- New route /api/v1/log-insights: analyzes audit logs + security events
- Shows top IPs with request counts, failures, and top actions
- Plain English insights (heavy users, auth failures, security alerts)
- Summary stats: total requests, unique IPs, failed actions
- Storage info showing log file sizes and entry counts
- New route POST /api/v1/log-insights/dispose: preview-then-confirm cleanup
- First call shows what would be deleted (preview mode)
- Second call with confirm:true actually deletes
- Configurable retention period (default 30 days)
- Frontend panel with modal UI showing insights as cards
- Period selector (1h, 6h, 24h, 7d)
- Top visitors table with IP, requests, failures, actions, last seen
- Storage info footer
- Clean Old Logs button with preview confirmation dialog
- Wired into app.js and dashboard navbar (🔍 Insights button)
- Addresses QA issue: users need to see who is accessing before cleanup
DashCaddy is now controllable by ANY AI agent via Model Context Protocol.
17 MCP tools exposed:
- Service management: list, get, health check
- Container management: list, start/stop/restart/remove
- Deployment: deploy app, wizard recommendations, catalog search, discovery
- System: health, metrics, diagnostics
- Infrastructure: DNS listing, Caddyfile generation
- Backup & Recovery: create backup, status
- Fleet: list hosts
Protocol: JSON-RPC 2.0 over stdio
Connection: DASHCADDY_URL + DASHCADDY_API_KEY env vars
Any MCP-compatible agent (Claude Desktop, Hermes, GPT) can now:
'I want to stream movies' → wizard recommends Plex/Sonarr/Radarr
'Deploy Plex' → container + Caddyfile + DNS + health check
'Why is Plex down?' → diagnostics with structured findings
'Back up everything' → full snapshot
14 tests, 1752 total pass.
5 endpoints:
- GET /api/v1/fleet/hosts — list registered hosts
- POST /api/v1/fleet/hosts — register host (name, hostname, apiKey, tags)
- DELETE /api/v1/fleet/hosts/:hostId — deregister
- GET /api/v1/fleet/status — fleet-wide health check (parallel probes)
- POST /api/v1/fleet/deploy — generate multi-host deployment plan
Host state persisted in fleet-hosts.json. API keys stored as SHA-256 hashes.
Status endpoint probes each host's /api/v1/system/health in parallel with 3s timeout.
THIS COMPLETES THE ENTIRE 46-ITEM BACKLOG! 1633 tests pass.
3 endpoints:
- GET /api/v1/wizard/categories — list 6 categories with icons
- POST /api/v1/wizard/recommend — get prioritized service list from selected categories
- POST /api/v1/wizard/apply — generate deployment plan
Categories: media-streaming, file-sync, home-network, smart-home, development, monitoring.
Hardware profiles: minimal (3 svcs), medium (6), powerful (12).
Cross-category dedup with priority sorting. 1633 tests pass.
POST /api/v1/discover/adopt — takes a discovered container and creates:
1. DashCaddy service entry (with subdomain, domain, URL)
2. Caddyfile reverse_proxy route via admin API
3. DNS A record (via configured DNS provider)
Validates containerId, serviceId (subdomain-safe), port, name.
Prevents duplicate service IDs. 1633 tests pass.
Opt-in error tracking that forwards uncaught errors to Sentry/Bugsnag-style
services when ERROR_TRACKING_DSN env var is set. Without DSN, disabled.
Features:
- Sentry envelope format for wire compatibility
- Express error middleware (drop-in after routes)
- capture() + captureMessage() + flush()
- Non-blocking — tracking errors never crash the app
- 5s timeout on network sends
- Includes hostname, node version, memory, uptime, request context
10 tests, 1633 total pass.
GET /api/v1/discover scans running Docker containers, matches images
against 20 known patterns (Plex, Jellyfin, Sonarr, Radarr, qBittorrent,
Gitea, Nextcloud, Redis, Postgres, etc.), and returns suggested service
configs. Marks services already in the dashboard as 'existing'.
Returns: container ID, name, image, suggested type/name/port/protocol,
port mappings, labels, and existing flag. 5 tests, 1623 total pass.
Hermes