This website requires JavaScript.
18ffd2e519
fix(nesting-guard): export dataDir from src/config/paths; harden fallback to platform-paths (DC-077) [glm-grade=B]
DashCaddy Polish
2026-08-18 17:07:13 -07:00
2fef1c47e5
fix(ca): gate per-service cert/key download behind TOTP+admin scope; require explicit PFX password; add rate limit (DC-076) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 16:40:28 -07:00
e8c5a7a1fb
Merge dc/DC-074-sites-ssrf: DC-074 sites SSRF hardening [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 15:31:14 -07:00
270e8d57e3
fix(sites): SSRF hardening — validate upstream + externalUrl reject private/reserved hosts (DC-074) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 15:31:07 -07:00
7db152499c
Merge dc/DC-073-caddy-upstreams-host-validation: DC-073 phantom-mute hardening [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 15:10:40 -07:00
a9bb4a1835
fix(caddy-upstreams): validate host is known upstream on all 3 mute endpoints (DC-073) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 15:10:36 -07:00
b64f23301b
Merge dc/DC-072-exec-scope: DC-072 exec scope + containerId hardening (glm-grade=A)
DashCaddy Polish Loop
2026-08-18 14:54:06 -07:00
83d7c65bf2
fix(exec): scope-based authorization + tighten containerId charset (DC-072) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 14:53:57 -07:00
1462024944
Merge feature/dc-064-discover-adopt-fetcht: DC-070 caddycode config sanitization [glm-grade=A]
Hermes
2026-08-18 14:17:34 -07:00
297332b0e1
fix(caddycode): validate + escape generation config — block CRLF / " / brace injection in Caddyfile interpolation (DC-070) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 14:16:24 -07:00
384f9c8bdb
Merge remote-tracking branch 'origin/fix/dc-069-caddy-admin-ipv6-origin'
DashCaddy Polish Loop
2026-08-18 13:35:30 -07:00
933606ce3f
fix(caddy-admin): IPv6 loopback origin allowlist + bracket-strip helper (DC-069) [glm-grade=A]
Hermes
2026-08-18 13:34:51 -07:00
5382d832d9
fix(fleet): SSRF hardening — hostname validation + DNS rebinding + probe-by-IP (DC-068) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 13:16:44 -07:00
c6b2f556c2
fix(openclaw): harden proxy — 5 MiB cap, RFC 7230 hop-by-hop strip, open-redirect (Location/Refresh/WWW-Auth) strip, path + status validators (DC-065) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 11:59:58 -07:00
4e75b13e90
Merge feature/dc-064-discover-adopt-fetcht: DC-064 discover-adopt fetchT (glm-grade=A)
DashCaddy Polish Loop
2026-08-18 11:32:14 -07:00
597bbf67c8
fix(discover-adopt): use fetchT + caddy.adminUrl (no hardcoded localhost:2019) (DC-064) [glm-grade=A]
DashCaddy Polish Loop
2026-08-18 11:31:47 -07:00
a2e2a12eb8
fix(routes): convert alias-import + canonical-shape callsites to canonical errorResponse (DC-063) [glm-grade=A]
Hermes
2026-08-18 10:53:29 -07:00
c01a011d47
[glm-grade=A] fix(caddy-upstreams): swap errorResponse arg order to statusCode-first; add type validator (DC-062)
DashCaddy Polish Loop
2026-08-18 09:03:58 -07:00
74fe35d969
Merge feature/dc-061-fix-export: preserve default-export compat for createDashboardWS
Hermes
2026-08-18 08:28:43 -07:00
678a0160c4
[glm-grade=A] fix(websocket): preserve default-export compat for createDashboardWS
Krystie
2026-08-18 08:28:24 -07:00
9779feae70
Merge feature/dc-061-websocket-auth: HMAC-verify dashboard WS auth + listener isolation
Hermes
2026-08-18 08:23:52 -07:00
30d5fdbb2c
[glm-grade=A] fix(websocket): HMAC-verify dashboard WS auth + listener isolation (DC-061)
Krystie
2026-08-18 08:22:29 -07:00
71d20ceef3
[glm-grade=A] fix(auto-restart): await async servicesStateManager.read() so handleContainerDown actually fires (DC-060)
Hermes
2026-08-18 05:52:32 -07:00
87f76aef66
[glm-grade=B] fix(disk-space): enforce monotonic threshold ordering (DC-059)
Hermes
2026-08-18 04:18:19 -07:00
8105bed3fb
[glm-grade=A] fix(csrf): tag browser auto-retry as [CSRF-debug], keep [CSRF] for real probes (DC-058)
DashCaddy Loop
2026-08-18 04:15:48 -07:00
2f76b83565
Merge feature/dc-057-backups-route-cleanup: remove dead-shadow /backups/schedule route
Krystie
2026-08-18 03:33:35 -07:00
0714bf2334
[glm-grade=A] fix(backups): remove dead-shadow POST /backups/schedule handler (DC-057)
Hermes
2026-08-18 03:32:54 -07:00
23922923a5
Merge feature/dc-056-aggregate-error-diagnostics: surface AggregateError causes in error.log
Krystie
2026-08-18 01:59:43 -07:00
3137d4c16d
[glm-grade=B] fix(logging): surface AggregateError causes + .cause chains in error.log (DC-056)
Hermes
2026-08-18 01:59:14 -07:00
ab87c10355
Merge feature/dc-055-journald-viewer: host journald log viewer
Hermes
2026-08-18 01:29:45 -07:00
3a74cc423a
[glm-grade=B] feat(monitoring): host journald log viewer (DC-055)
Hermes
2026-08-18 01:27:57 -07:00
901df8608b
[glm-grade=B] fix(monitoring): restore dead-detection for verified loopback upstreams (DC-054)
Krystie
2026-08-18 00:13:58 -07:00
71e04d0a86
[glm-grade=B] fix(monitoring): remap loopback upstream probes to host gateway (DC-053)
Hermes
2026-08-17 22:46:32 -07:00
72c82713b5
DC-052: error-log filter + pagination
Krystie
2026-08-17 20:53:21 -07:00
60852ee1ef
[glm-grade=A] feat(api): error-log filter + pagination + distinct-contexts (DC-052)
DashCaddy Polish Loop
2026-08-17 20:53:13 -07:00
d79d19b769
chore(start): mount /etc/caddy/sites into container for upstream watcher (DC-049 fixup)
DashCaddy-Polish
2026-08-17 19:54:31 -07:00
d9286b3be7
fix(http): auto-inject Origin header for Caddy admin API requests (DC-051) [glm-grade=A]
Hermes
2026-08-17 19:51:59 -07:00
99bb3f6db8
feat(logs): error-log parser fix + dedicated /logs page (DC-051) [UNJUDGED]
Hermes
2026-08-17 19:10:44 -07:00
5f95fdcf70
feat(api): audit-log viewer route + UI enhancements (DC-050) [glm-grade=A]
Hermes
2026-08-17 18:19:41 -07:00
45cfa83bad
feat(monitoring): dead-upstream surfacing + mute toggle (DC-049) [mm-grade=B+]
Sami Ahmed
2026-08-17 17:11:27 -07:00
6d875e4631
fix(api): rehydrate process.env from disk-settings.json on boot (DC-048) [glm-grade=A]
Hermes
2026-08-17 16:04:18 -07:00
4555d829ac
[glm-grade=A] feat: add disk-safety warning to setup wizard + health retention settings
Hermes
2026-08-13 17:31:16 -07:00
e99413150e
[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps
Krystie
2026-08-16 04:18:07 -07:00
295c63ce94
ops: lock-caddyfile.sh — chattr +i guard that respects the container bind mount
Krystie
2026-08-15 00:01:17 -07:00
ef685e515e
[glm-grade=B+] feat(i18n): complete card/filter/action translation keys for 31 languages
Krystie
2026-08-15 00:01:17 -07:00
bd40fb1c17
[glm-grade=A-] refactor: extract /api/v1/version into routes/version.js + npm ci build
Krystie
2026-08-15 00:01:16 -07:00
86cc21c7a4
[glm-grade=B+] ops: self-healing watchdog for DNS2 (container, port 3001, Caddyfile, caddy)
Krystie
2026-08-14 23:59:50 -07:00
ff92706f8a
[glm-grade=A-] fix: drift test walker recognizes buildRouter() object exports (routes/version.js)
Krystie
2026-08-14 23:46:23 -07:00
e8ab0e09a0
[mm-grade=A] DC-058: Stripe license + invoice email automation
Hermes
2026-08-14 21:58:07 -07:00
b5e23d8e3f
[grade=B] fix: i18n detectLanguage RFC 7231 q-value compliance + stale test fixes
Krystie
2026-08-13 16:30:20 -07:00
87054e55d9
[grade=B] feat: add Vintage Stereo radio app template
Hermes Agent
2026-08-13 14:29:10 -07:00
ec96060b2e
[grade=A] deploy: rebuild dist with 31-language i18n + disk safety wizard + health settings
Krystie
2026-08-13 13:55:51 -07:00
e6ec9c901b
feat: Jellyfin/Emby recommendations + piracy disclaimer + TOTP fix + AI chat
Krystie
2026-08-13 03:38:46 -07:00
3da8463cef
feat: AI intent router live + TOTP repeat-auth fix
Krystie
2026-08-13 03:33:28 -07:00
d25343000f
feat: 31 languages + disk safety panel + electron auto-updater + VM uninstall
Krystie
2026-08-13 03:04:48 -07:00
8ac1937784
fix: recursive data nesting guard + VM destroy in uninstall wizard
Krystie
2026-08-13 02:49:25 -07:00
2ff6c05a45
cleanup: remove stale SAMI Caddy files + add download landing page
Krystie
2026-08-13 01:32:07 -07:00
4894e07469
wire disk budget step + VM provisioning into installer wizard
Krystie
2026-08-13 01:27:43 -07:00
2a5b1736b8
feat: VM disk sandboxing with full VM isolation
Krystie
2026-08-12 23:47:22 -07:00
cd3d0cd8ff
feat: VM disk sandboxing — bounded virtual disk per platform
Krystie
2026-08-12 23:02:51 -07:00
7ebb1b1a01
feat: Log Insights panel — plain English activity summary + safe log disposal
Krystie
2026-08-12 20:44:59 -07:00
ae54927210
Merge: 92 app templates + Authelia deployment on test server
Krystie
2026-08-12 18:07:13 -07:00
9a1998288e
Merge latest main (87dd2712
Krystie
2026-08-12 17:37:17 -07:00
503de258b8
[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work
Krystie
2026-08-12 17:34:10 -07:00
87dd2712a0
[grade=A] AI Intent Router — natural language → structured actions
Hermes
2026-08-12 16:32:44 -07:00
8f4883bfcd
[grade=A] DashCaddy MCP Server — AI-native self-hosting control plane
Hermes
2026-08-12 16:30:17 -07:00
77a94d55d2
DC-083: mark license-manager.js done in backlog
Hermes
2026-08-12 16:11:26 -07:00
a468e0f480
[grade=B] DC-083: comprehensive license-manager.js test coverage (77 tests, revenue path)
Hermes
2026-08-12 16:11:15 -07:00
43d9c0e1d0
DC-083: claim license-manager.js coverage for Hermes
Hermes
2026-08-12 15:56:53 -07:00
96a6e8ac6a
DC-106: auto-claim (autonomous build pick tick)
Hermes
2026-08-12 15:24:45 -07:00
fa6c4c6b20
Add i18n route tests (5 tests for language listing + translations)
Hermes
2026-08-12 13:13:44 -07:00
6fe1af28ae
Add tests for DC-100 discover + DC-107 disaster recovery endpoints
Hermes
2026-08-12 13:12:38 -07:00
82f14ba663
Update CHANGELOG with all P3-P5 features (DC-076 through DC-108)
Hermes
2026-08-12 13:11:07 -07:00
0d21cbb93b
Fix: Catalog handles APP_TEMPLATES as object map (not just array)
Hermes
2026-08-12 13:06:07 -07:00
842097df8f
Fix: Destructure APP_TEMPLATES from app-templates module export
Hermes
2026-08-12 13:02:24 -07:00
671a6cc93c
Add tests for DC-105/106/108 endpoints + fleet env fix
Hermes
2026-08-12 13:00:14 -07:00
2e07053dca
[grade=B] DC-108: Multi-host fleet management foundation
Hermes
2026-08-12 12:55:59 -07:00
7f831510bd
[grade=B] DC-106: Caddyfile-as-code — visual reverse proxy builder API
Hermes
2026-08-12 12:54:17 -07:00
2966a19aef
Mark DC-103/104/105/107 as done in backlog
Hermes
2026-08-12 12:52:39 -07:00
184ec2e49f
[grade=B] DC-107: Disaster recovery — one-click full backup + restore
Hermes
2026-08-12 12:52:16 -07:00
0cda298651
[grade=B] DC-105: Smart defaults wizard — 'What do you want to self-host?'
Hermes
2026-08-12 12:50:39 -07:00
2595b6a456
DC-087: Refactor SDK to compact spec-table pattern (326 lines, 39 methods)
Hermes
2026-08-12 12:49:10 -07:00
677fb41f97
[grade=B] DC-104: App catalog API — browse 38 curated templates
Hermes
2026-08-12 12:47:50 -07:00
f68a5afe73
[grade=B] DC-103: One-click adopt — auto-generate Caddy route + DNS + service
Hermes
2026-08-12 12:40:21 -07:00
29831ad0b2
Update backlog: 40 items marked done/partial from sprint session
Hermes
2026-08-12 12:38:21 -07:00
6b3f6ebeb6
[grade=A] DC-068: Fix all 3 ESLint errors + auto-fix warnings
Hermes
2026-08-12 12:35:58 -07:00
ccaa923a5a
[grade=B] DC-071: Error tracking integration framework (Sentry-compatible)
Hermes
2026-08-12 12:30:57 -07:00
d45dc8d3b7
[grade=B] DC-100: Service discovery — auto-detect running containers
Hermes
2026-08-12 12:27:57 -07:00
a38d1350eb
[grade=B] DC-080: Plugin/extension system framework
Hermes
2026-08-12 12:25:26 -07:00
78bfc13cf0
[grade=B] DC-077: i18n framework with 5 languages (en/es/fr/de/ar)
Hermes
2026-08-12 12:23:34 -07:00
5e5b572199
[grade=B] DC-086: Structured error code system (framework + 80 codes)
Hermes
2026-08-12 12:17:17 -07:00
aaea3bd5d4
[grade=B] DC-076: WebSocket server for real-time dashboard updates
Hermes
2026-08-12 12:15:17 -07:00
2feeff7d12
DC-063: auto-claim (autonomous build pick tick)
Hermes
2026-08-12 11:24:30 -07:00
1528fd1a35
DC-067: [WIP] jest failing at grade time
Hermes
2026-08-12 07:24:29 -07:00
df37b95ff7
DC-062: auto-claim (autonomous build pick tick)
Hermes
2026-08-12 07:23:54 -07:00
388a1fe487
[grade=B] DC-081: Input validation for 20 highest-risk mutating routes
Hermes
2026-08-12 06:20:48 -07:00
37b2630525
[grade=B] Fix DC-064: Bump Docker memory limit from 512m to 1g
Hermes
2026-08-12 06:16:37 -07:00
306aff5ccf
[grade=A] Fix DC production crash-loop: await listen()+close() in startup-validator port check
Hermes
2026-08-12 06:13:38 -07:00
a21e06bf5b
[grade=B] DC-098: Update CHANGELOG with production-grade hardening sprint
Hermes
2026-08-12 05:52:48 -07:00
95d4b3f4bc
[grade=A] DC-066: End-to-end billing integration test
Hermes
2026-08-12 05:47:27 -07:00
DashCaddy Polish