3 Commits

Include renames

Author	SHA1	Message	Date
Krystie	e99413150e	[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps ... Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls): P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076. server.js passed module exports (DependencyManager class, {AutoRestartManager} namespace, SSLMonitor class) instead of createApp()'s live instances — first .on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx exposed in src/app.js; server.js passes all 8 real EventEmitter instances. P0-2: error.log corrupted since 2026-07-14. errorMiddleware called logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper — logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper + ~74 log.error sites swept to pass real error objects (AST-verified scope- safe 71/71, 29/29 modules load clean). P0-3: auth-polling storm (stranded grade=B commit never landed in prod): 401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect every 2-8s, with misleading direct-probe fallback marking services 'up'. Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears _dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes. Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors); dockerode@5/uuid deferred (semver-major, Docker API surface). Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings; node --check all changed files; bundles rebuilt + SW cache bumped. Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial delegate per operator directive 2026-08-07. Round 1: 98-call mechanical verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM (re-auth freeze) — fixed in this commit as prescribed.	2026-08-16 04:18:07 -07:00
Krystie	5d404f5733	cleanup: wrap console.log calls behind window.DASHCADDY_DEBUG flag ... Wrapped 22 console.log calls across 6 files with a debug() helper that only logs when window.DASHCADDY_DEBUG is true in the browser console. Files: - tour-manager.js: 10 calls - theme-adapter.js: 4 calls - keyboard-shortcuts.js: 4 calls - tooltip-definitions.js: 2 calls - progress-tracker.js: 1 call - live-events.js: 1 call console.error and console.warn calls preserved — those indicate real issues worth seeing in production.	2026-05-14 00:48:51 -07:00
SamiandClaude Opus 4.6	bdf3f247b1	feat: add 7 new features — exec shell, SSE events, compose import, docker resources, resource limits, email notifications, auto-updates ... - Container exec/shell via WebSocket + xterm.js (subtle >_ button on cards) - Live dashboard updates via SSE (resource alerts, health changes, update notices) - Docker Compose import with YAML parsing, preview, and dependency-ordered deploy - Volume & network management modal with disk usage overview - CPU/memory resource limits on deploy and live update - Email SMTP notifications (nodemailer) alongside Discord/Telegram/ntfy - Scheduled auto-update scheduler with maintenance windows (daily/weekly/monthly) New deps: ws, js-yaml, nodemailer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-05 16:15:14 -07:00