lens 2026.11.12.2

fix(web): sync Flag Tier A button, icon-action, and hidden contracts (#92)

Summary

• Syncs vendored Flag stylesheets
  (static/design-system/components/components.css and
  shadcn-parity.css) to ElcanoTek/flag 5a2257b (ElcanoTek/flag#28)
  via ./scripts/flag-sync.sh sync, replacing the earlier local
  static/styles.css override per Codex review.
• Restores .btn label centering and underline suppression,
  .icon-action { padding: 0 }, [hidden]:not([hidden="until-found"]) { display: none !important }, and prose-only a:where(:not(.btn, .icon-action, ...)) link styling (preserving anchor button/icon-action
  foregrounds and .btn-link hover underlines) directly from upstream
  Flag.
• Adds
  TestVendoredFlagComponentsPreserveAnchorButtonAndIconActionContracts
  in internal/web/server_test.go.

Verification

• make stack-check fmt-check build vet lint test-race shellcheck

What's Changed

• fix(web): sync Flag Tier A button, icon-action, and hidden contracts by @bradflaugher in #92

Full Changelog: v2026.11.12.1...v2026.11.12.2

lens 2026.11.12.1

feat(web): migrate UI onto vendored Flag component stylesheets (#91)

Summary

• Vendor Flag's canonical Tier A component stylesheets
  (components/components.css and components/shadcn-parity.css) into
  static/design-system/components/ and sync flag.lock (6f47d991fc74)
  via scripts/flag-sync.sh.
• Document the vendored component stylesheets in NOTICE (Section 5)
  and AGENTS.md.
• Link design-system/components/components.css and
  design-system/components/shadcn-parity.css after design-tokens.css
  and before styles.css in templates/index.html and
  templates/signed_out.html.
• Migrate dashboard & signed-out markup, scripts (static/main.js,
  static/custom-categories.js), and styles onto Flag's shared classes
  (.ds-app-header*, .icon-action, .icon-inline, .theme-toggle*,
  .btn* + .btn-sm, .field, .select-wrap*, .file-upload-dropzone

• .dropzone-*, .ds-radio, .search-compact, .badge + .badge-*,
  .table-wrap + table, dialog.modal + .modal__*, .toast-region +
  .toast*, .alert + .alert--*, .card, and core-icons.svg sprite
  symbols).

• Remove duplicated component rules and unused legacy CSS from
  static/styles.css (1,701 → 979 lines, -722 lines / -42.4%),
  keeping only Lens-specific layout and composition/progress rules backed
  purely by Flag design tokens.
• Bump go.mod (and CONTRIBUTING.md) from go 1.27.3 to go 1.27.4
  for stdlib advisory GO-2026-6859 (net/http).

Validation

• make ci passes with 0 errors/warnings:
  • stack-check (flag-sync lock check + Tier A frontend standard v2)
• fmt-check, build, go vet ./..., golangci-lint run (0 issues)
• go test -race ./... (all 30 packages pass, including all CSP,
  asset/icon version, tabular-nums, and en/es/pt localization tests)
  • govulncheck (No vulnerabilities found on Go 1.27.4)
  • shellcheck

What's Changed

• feat(web): migrate UI onto vendored Flag component stylesheets by @bradflaugher in #91

Full Changelog: v2026.11.11.3...v2026.11.12.1

lens 2026.11.11.3

fix: keep language through central sign-in callbacks (#90)

When preference storage is unavailable, central sign-in from a Spanish
or Portuguese signed-out page returned to an English dashboard and
callback errors lost the selected language. Keep the explicit language
in the vetted, signed return path and recover callback error
presentation only from a signed, unexpired transaction with matching
state and complete nonce/PKCE metadata. Credential validation still
receives the original request and repeats its existing checks.

Preserve unrelated return-query bytes, including semicolons, opaque
percent sequences, duplicate fields and fragments, when adding language.
Existing redirect validation and return-path size limits remain
enforced.

Validation:

• Full make ci: stack/Flag checks, formatting, build, vet, lint, all
  race tests, vulnerability scan and shellcheck pass.
• Actual server tests cover ES/PT signed-out-link success, fixed
  callback URI and S256 exchange, return-query preservation, 28
  error/invalid-transaction cases, and redirect/size bounds.
• Eight Chromium cases pass for ES/PT success, missing code, denied
  sign-in and invalid state with localStorage disabled, all preference
  cookies discarded and English browser language; only local fake Auth
  endpoints were used.
• Independent read-only security review found no changes to state,
  nonce, PKCE, token exchange or session validation.

What's Changed

• fix: keep language through central sign-in callbacks by @obsessixnv in #90

Full Changelog: v2026.11.11.2...v2026.11.11.3

lens 2026.11.11.2

Preserve language through authenticated sign-in and sign-out (#89)

What

When preference storage is blocked, signing out from a Spanish or
Portuguese dashboard and visiting Login while already signed in could
fall back to English. Carry the normalized language in the rendered
logout form action and the authenticated Login redirect, so both paths
retain the current language without cookies or localStorage.

Regression tests follow both Login aliases to the final dashboard,
submit the rendered logout form, reject malicious language/return
values, and verify central logout still rejects missing/invalid CSRF
tokens and revokes the session after valid submission. The Login
redirect has a narrowly documented G710 suppression: its path is the
literal /, language resolves only to en/es/pt, and the query is
encoded. No destination comes from request input.

Validation

• All repository gates passed: stack/format, deployable build and
  all-package compile, vet, golangci-lint v2.14, full Go race suite (30
  tested packages), govulncheck, and ShellCheck.
• 24 real Chromium cases passed: legacy and central auth ×
  English/Spanish/Portuguese × 390px/1440px × JavaScript
  confirmation/native no-script form. Browser language was English,
  localStorage threw, and a local proxy stripped every preference cookie.
  Both Login aliases retained the selected dashboard language; logout
  reached local mock Auth with the selected language and cleared the
  central session cookie. Confirmation cancellation remained on the
  dashboard.
• Browser results: /tmp/lens-navigation-browser-results.json in the
  implementation workspace. No live classification/API calls were used.
• Auth's corresponding fixed local logout landing now preserves the
  language in merged Auth
  #134.

Checklist

• make fmt-check && make vet && make lint pass
• make test-race passes, hermetically (no key, no network)
• make shellcheck passes
• No new settings; configuration examples and deployment docs remain
  accurate
• Localization docs updated where behavior changed
• Existing source files retain their SPDX headers
• No secrets, real customer data, or internal hostnames in the diff

Screenshots

No visual layout changes; the existing controls were exercised at
desktop and mobile widths in all three languages.

What's Changed

• Preserve language through authenticated sign-in and sign-out by @obsessixnv in #89

Full Changelog: v2026.11.11.1...v2026.11.11.2

lens 2026.11.11.1

Localize Lens in English, Spanish and Portuguese (#88)

Lens now supports English, Spanish and Portuguese throughout the
dashboard, file actions, run monitor, custom-category editor, sign-out
page and browser errors. A native language selector remembers the choice
using the shared Elcano preference contract; explicit regional language
links override saved/browser preferences. Dates, counts, costs and
model-price labels use the selected locale.

Sign-in and logout carry the display language to Auth while preserving
callback destinations, state, nonce, PKCE, session revocation and CSRF
checks. User file names, category questions/options, model IDs, logs,
persisted job/progress data and machine API fields retain their original
values. Mobile grids accommodate longer text; upload control semantics
and primary-button contrast are corrected.

Validation:

• Full repository stack/format/build/vet/race checks, golangci-lint,
  ShellCheck, govulncheck and secret scan passed.
• New tests cover both 261-message catalogs, argument preservation,
  locale precedence/cookies, browser-runtime escaping, translated
  page/form responses, unchanged persisted data, and complete login/logout
  transactions with CSRF rejection.
• Chromium reviewed all three languages on desktop/mobile in both themes
  (48 captures). Nine dashboard/sign-out axe scans and three
  category-editor/action scans report zero violations, clipping or
  JavaScript errors.
• Browser actions passed in each language: upload, rename,
  cancel/delete, category editing, cancel logout, and preference
  persistence with explicit-language override.

The localization contract and contributor requirements are documented in
docs/LOCALIZATION.md.

What's Changed

• Localize Lens in English, Spanish and Portuguese by @obsessixnv in #88

New Contributors

• @obsessixnv made their first contribution in #88

Full Changelog: v2026.11.09.1...v2026.11.11.1

lens 2026.11.09.1

deps(actions): bump the actions-minor-patch group with 3 updates (#87)

Bumps the actions-minor-patch group with 3 updates:
github/codeql-action/init,
github/codeql-action/autobuild
and
github/codeql-action/analyze.

Updates github/codeql-action/init from 4.39.2 to 4.39.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal

lens 2026.11.07.2

docs: update install and deploy guide for signed binary releases (#86)

Summary

• Update remaining install/bootstrap/update prose to reflect default
  keyless Sigstore OIDC signed binary releases (cosign v3.1.4, with no
  Go or Node toolchain required on production boxes unless --from-source
  is passed).

What's Changed

• docs: update install and deploy guide for signed binary releases by @bradflaugher in #86

Full Changelog: v2026.11.07.1...v2026.11.07.2

lens 2026.11.07.1

feat(release): keyless Sigstore OIDC signed binary releases (#85)

Summary

• Add scripts/version.sh (vYYYY.MM.DD.N CalVer release tags:
  current, describe, next, released-at, filter),
  scripts/cosign.lock (pinning cosign v3.1.4 SHA-256 digests for
  linux/amd64 and linux/arm64), scripts/retry-transient.sh,
  scripts/release-push-rejection.sh, and
  scripts/release-newer-published.sh.
• Add .github/workflows/release.yml (tag, build, publish)
  triggered on green Tests / CI push runs on main and
  workflow_dispatch:
• Mints and pushes vYYYY.MM.DD.N tags with retry on contention and
  idempotence on re-runs.
• Cross-compiles static lens-linux-amd64 and lens-linux-arm64
  binaries (CGO_ENABLED=0 -trimpath).
• Signs lens-linux-amd64, lens-linux-arm64, and SHA256SUMS using
  keyless Sigstore OIDC (cosign sign-blob --yes --bundle <file>.sigstore.json <file>), verifies every bundle against
  https://github.com/ElcanoTek/lens/.github/workflows/release.yml@refs/heads/main
  and https://token.actions.githubusercontent.com, publishes the GitHub
  Release with release.json, and prunes superseded releases beyond the
  newest 20.
• Add scripts/lib/release.sh and update scripts/update.sh,
  scripts/bootstrap.sh, internal/opscli, and internal/doctor so
  default deployments verify and install signed release binaries without
  requiring go or make on the box (preserving --from-source /
  LENS_FROM_SOURCE=1).
• Add unit and integration tests in
  internal/deploytest/release_test.go and
  internal/doctor/doctor_test.go.

What's Changed

• chore(deps): bump the pip group with 8 updates by @dependabot[bot] in #1
• chore: bundle Dependabot security updates and quiet pytest collection warning by @bradflaugher in #2
• chore: adopt ruff for linting and formatting, enforced in CI by @bradflaugher in #3
• build: lock dependencies with pip-tools by @bradflaugher in #4
• Standardize on Nebula Sans + Hack and re-sync the vendored Flag copy by @bradflaugher in #5
• Ask for tabular figures so numeric columns stop rendering ragged by @bradflaugher in #6
• Stop the job-cancel test writing to the real managed-files tree by @bradflaugher in #7
• Make the test suite structurally unable to write into managed-files/ by @bradflaugher in #8
• Move the managed-files isolation to a root conftest so root-level tests are covered too by @bradflaugher in #9
• Add CodeQL scanning and issue/PR templates; drop the other products' icons from logos/ by @bradflaugher in #10
• Add the SPDX header to the three deploy scripts that lack it by @bradflaugher in #11
• chore(deps): bump openai from 3.5.0 to 3.6.0 in the pip group by @dependabot[bot] in #12
• feat(auth): opt-in central auth client with a Lens-local allowlist and back-channel revocation by @jzhao234 in #15
• chore(deps): pin itsdangerous in requirements-dev.txt so CI installs the session middleware dependency by @jzhao234 in #16
• fix(auth): touch Lens sessions at most once a minute instead of on every request by @jzhao234 in #18
• fix(auth): keep Lens access state outside the release tree by @jzhao234 in #19
• fix(auth): make Lens readiness and logout truthful by @jzhao234 in #20
• fix(auth): let the login-transaction cookie follow the cookie-secure switch, and add a Content-Security-Policy by @jzhao234 in #21
• fix(tests): repair the endpoint test file left unparseable by a bad conflict resolution by @jzhao234 in #22
• feat(auth): resolve Auth's signing keys from its published JWKS, and drop unsafe-inline styles from the CSP by @jzhao234 in #23
• feat(auth): Lens sessions default to 24 hours absolute, 12 hours idle by @jzhao234 in #24
• fix(auth): stop keeping every Lens session row forever by @jzhao234 in #25
• fix(auth): make lens access revoke fail loudly when nothing was revoked by @jzhao234 in #27
• fix(auth): let the Lens signed-out page reach the central account by @jzhao234 in #26
• fix(auth): keep a slow Auth exchange from freezing every other Lens request by @jzhao234 in #28
• fix(auth): signing out of Lens signs out of every Elcano app by @jzhao234 in #29
• Add one-line install, doctor diagnostics, and Fedora host maintenance by @bradflaugher in #30
• Fix root-shell diagnostics and unattended deployment issues by @bradflaugher in #31
• Document Fedora SELinux requirements for unattended maintenance by @bradflaugher in #32
• Add optional custom categories powered by TypeSafe by @bradflaugher in #33
• Improve custom-category research evidence and model selection by @bradflaugher in #34
• chore(deps): bump the pip group with 2 updates by @dependabot[bot] in #35
• Use a brand-safety example for custom categories by @bradflaugher in #36
• Keep jobs alive when .env is root-owned, and fix the dashboard bars by @bradflaugher in #37
• Put each TypeSafe choice probability in its own column by @bradflaugher in #38
• Default classification to the GPT Luna latest alias by @bradflaugher in #39
• Make model menu options readable by @bradflaugher in #40
• Provision Lens access from Auth by @jzhao234 in #41
• Run custom categories on OpenRouter decision models, with Jev as the default by @jzhao234 in #44
• Build the Lens venv when bootstrap is started from root's home by @jzhao234 in #45
• Serve Lens over HTTPS on Fedora's default Caddyfile by @jzhao234 in #46
• Let a bootstrap re-run rebuild the existing venv on current uv by @jzhao234 in #47
• Show what each run costs, per row and per run by @jzhao234 in #48
• Verify the id_token Auth signs before trusting a central sign-in by @jzhao234 in #49
• Let the direct pass follow redirects within the same site by @bradflaugher in #50
• Queue dashboard runs from the host with lens submit by @bradflaugher in #51
• Let the dashboard run several jobs at once by @bradflaugher in #52
• Stop retrying Firecrawl scrapes after all engines failed by @bradflaugher in #53
• Record a Sonar vs Sonar Pro comparison on 80 production CTV apps by @bradflaugher in #54
• Make Perplexity Sonar the default research model by @bradflaugher in #55
• Remove Firecrawl by @bradflaugher in #57
• Give each deep-crawl run its own Chrome container by @bradflaugher in #56
• Keep only the newest two rollback snapshots after an update by @bradflaugher in #58
• Run research fallback requests independently of the crawl pool by @bradflaugher in #59
• Add a per-run switch for the headless-Chrome retry pass by @bradflaugher in #60
• chore(deps): bump the pip group across 1 directory with 4 updates by @dependabot[bot] in #43
• Let Fleet start Lens jobs and fetch results: scoped API tokens, REST API and MCP server by @bradflaugher in #61
• Remove four PyPI dependencies: own HTML tree and WebDriver client, vendored dotenv, no rich by @bradflaugher in #62
• deps(pip): bump the pip-minor-patch group with 3 updates by @dependabot[bot] in #64
• Uninstall Cockpit and name the box after its domain on bootstrap by @bradflaugher in #65
• Bootstrap: key-only SSH safety net; doctor warns when sshd accepts passwords by @bradflaugher in #66
• Key-only SSH: capture sshd -T before grep -q (pipefail) by @bradflaugher in #67
• Rewrite Lens in Go by @bradflaugher in #70
• deps(actions): bump the actions-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #68
• ci: drop nonexistent Dependabot labels and the master trigger by @bradflaugher in #71
• Adopt the Elcano frontend standard: flag.lock, stack-check, cloud hook by @bradflaugher in #72
• Remove only Firecrawl's own volumes when r...