CF Scanner v1.1.0

CF Scanner v1.1.0

This release introduces guided Agent enrollment and independent per-node credentials.

Agent enrollment

CF Scanner now provides two onboarding paths that converge on the same long-term Agent protocol:

• Agent-initiated pairing: run a secret-free connect command, open the displayed Web URL, review the node, and approve it.
• Preauthorized automation: create an enrollment from the Web console and use the generated one-time token with join for unattended deployments.

A formal Agent record is created only when an enrollment is claimed, so unused automation enrollments do not create permanently offline placeholder nodes.

Independent credentials

Every newly enrolled Agent receives its own identity and long-term Bearer credential:

• pairing tokens are UUID v4 values, short-lived, single-use, and stored by Center only as SHA-256 hashes;
• long-term secrets are generated locally by the Agent and stored by Center only as hashes;
• credentials are bound to one Agent, so request-body agent_id values cannot impersonate another node;
• the legacy shared token cannot operate or overwrite independently paired Agents;
• new installations disable legacy shared-token authentication by default.

Existing shared-token Agents remain supported during migration.

Agent CLI

New commands:

cfscan-agent connect --server https://agent.example.com
cfscan-agent join --server https://agent.example.com --token-file /run/secrets/cfscan-enrollment-token
cfscan-agent version

Additional behavior:

• saves identity atomically to identity.json with restricted permissions;
• reuses an existing identity after restart;
• supports --token, --token-file, and --token-stdin for automation;
• supports --pair-only for provisioning workflows;
• rejects non-loopback cleartext HTTP unless --allow-insecure-http is explicitly supplied;
• reports the release version correctly in the approval interface.

Docker images pre-create a writable /var/lib/cfscan-agent identity directory for the non-root Agent user.

Management interface

The Agent page now includes:

• pending and approved enrollment requests;
• a guided Add Agent Sheet;
• Agent-initiated and preauthorized deployment choices;
• generated binary and Docker commands;
• a responsive approval route with pending, approved, connected, rejected, and expired states;
• visible distinction between independent credentials and legacy shared authentication.

Pairing routes are excluded from Web access logs, and Center logs redact pairing UUID path segments.

Configuration

New Center settings:

CFSCAN_PUBLIC_WEB_URL
CFSCAN_PUBLIC_AGENT_URL
CFSCAN_AGENT_IMAGE
CFSCAN_AGENT_VERSION
CFSCAN_AGENT_ENROLLMENT_TTL
CFSCAN_AGENT_ENROLLMENT_POLL_INTERVAL

New Agent setting:

CFSCAN_AGENT_IDENTITY_FILE

See docs/agent-enrollment.md and docs/operations.md for the complete workflow and migration guidance.

Upgrade order

1. Back up PostgreSQL.
2. Upgrade Center and Web first.
3. Keep the legacy shared token configured while old Agents are still running.
4. Upgrade each Agent and reconnect it through connect or join.
5. Confirm the Agent uses independent authentication and is sending heartbeats.
6. Disable the legacy shared token after all nodes have migrated.

The schema change is additive. Compatibility testing confirmed that a v1.0.0 Center can still start against a database migrated by v1.1.0.

Validation

• Go vet, unit tests, and race detector;
• frontend UI boundaries, ESLint, TypeScript, Vitest, and production build;
• real PostgreSQL enrollment integration;
• real Agent container pairing, approval, identity persistence, and identity reuse;
• legacy/new authentication isolation;
• desktop and mobile browser regression for enrollment UI;
• CodeQL, Gitleaks, Dependency Review, and GitGuardian;
• Linux amd64/arm64 binary checksums and clean VCS build metadata;
• multi-architecture GHCR images with SBOM and provenance.

Images

ghcr.io/3011/cfscan-server:v1.1.0
ghcr.io/3011/cfscan-agent:v1.1.0
ghcr.io/3011/cfscan-web:v1.1.0

Full changelog: v1.0.0...v1.1.0