Skip to content

v1.11.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 16:14
v1.11.0
3d69b92
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New & Changed

  • feat(web): document node-list deprecation and authoritative impact in the Manual
  • feat(web): consume paged /infra/nodes/page with runtime parsing and bounded id batches
  • feat(api): keep deprecated GET /infra/nodes array, add paged /nodes/page with privacy and snapshot reads
  • feat(shared): add legacy node array schema and keep page/graph contracts
  • feat: add Spanish graph edge notices
  • feat: add English graph edge notices
  • feat: load topology edges in one request
  • feat: test graph edge completeness states
  • feat: derive honest graph edge states
  • feat: add single infra graph edge query
  • feat: add bounded infra graph edge endpoint
  • feat: test infra query validation and graph edges
  • feat: expose bounded infra graph edges
  • feat: test infra role and graph edge queries
  • feat: add infra role and graph edge queries
  • feat: test infra list and graph edge contracts
  • feat: add infra role and graph edge contracts
  • updt: export infra child identity separators
  • updt: align shared Noble hashes at 2.3.0
  • updt: align Next.js ESLint config at 16.3.0
  • updt: align web Noble hashes at 2.3.0
  • feat: api — spec for the over-cap id batch rejection (#1152)
  • feat: web — en+es copy for the truncation, batch and search-picker states (#1152)
  • feat: web — the 'On topology' glyph resolves the visible page exactly (#1152)
  • feat: web — the merge picker becomes a server-searched Combobox (#1152)
  • feat: web — exact edge-endpoint label resolve and a server-searched target picker (#1152)
  • feat: web — the agent wizard polls a bounded PENDING page (#1152)
  • feat: web — the review tray counts the queue and names its batch (#1152)
  • feat: web — the Servers table gets the house pagination, sort and server search (#1152)
  • feat: web — the canvas reads the bounded graph endpoint and shows truncation (#1152)
  • feat: web — specs pinning the 'never looks complete' boundaries (#1152)
  • feat: web — pure truncation/batch notices for the two subset surfaces (#1152)
  • feat: web — paged node hooks, the graph hook and exact asset batch resolves (#1152)
  • feat: web — getInfraNodes returns Page, getInfraGraphNodes lands (#1152)
  • feat: api — specs for the ids filter and the list page params (#1152)
  • feat: api — expose the ids node-list filter (#1152)
  • feat: api — an exact ids filter on the node list for label lookups (#1152)
  • feat: api — specs for the node list page params and the graph read gate (#1152)
  • feat: api — specs for the node page window and the graph truncation flag (#1152)
  • feat: api — GET /infra/nodes pages, GET /infra/graph/nodes lands (#1152)
  • feat: api — paginate listNodes and add the projected listGraphNodes (#1152)
  • feat: shared — specs for the split node-list / graph read contracts (#1152)
  • feat: shared — Page + the bounded InfraGraph contract (#1152)
  • feat(web): en+es copy for the archive-blocked detach and relink (#1202)
  • feat(web): detachPermitted — the per-arm permission decision for the detach (#1202)
  • feat(web): en+es copy for the asset link, its two detach outcomes and the relink (#1202)
  • feat(web): wire the asset link control + close the ADR-0093 §7 duplicate loop (#1202)
  • feat(web): node asset attach/detach control with branch-aware confirmation (#1202)
  • feat(web): relink-sequence — the ADR-0093 §7 two-step, resumable not restartable (#1202)
  • feat(web): relink-sequence tests — resume after a half-completed two-step (#1202)
  • feat(web): detachOutcome — name which detach a click runs, safe only on explicit false (#1202)
  • feat(web): detach-outcome tests — the null/absent fail-safe is the silent branch (#1202)
  • feat(api): project the auto-created marker onto getNodeDetail, no extra query (#1202)
  • feat(api): getNodeDetail assetAutoCreated tests — marker, fail-safe null, one query (#1202)
  • feat(shared): assetAutoCreated on InfraNodeDetailSchema — which detach a click runs (#1202)
  • feat(shared): assetAutoCreated read-tolerance tests for the detach-outcome field (#1202)
  • feat: receive stock — inline model create, reset-on-open, assetModel:write gate, wider dialog
  • feat: CreateAssetModelDialog — optional defaultName seeds the name field on open
  • feat: AssetModelCombobox — optional onSearchChange so callers can observe the search term
  • feat: tests for buildReceivePayload — model chosen last, blank-field omission, serials split
  • feat: extract the receive-stock form→wire payload builder as a pure module
  • updt: es wizard copy — house vocabulary for hypervisor guests (invitados)
  • feat: es wizard copy — hypervisor note, advanced veto, detection feedback, env-token hints (#1225)
  • feat: en wizard copy — hypervisor note, advanced veto, detection feedback, env-token hints (#1225)
  • feat: create-agent wizard — wider dialog, hypervisor callout, veto disclosure, detection feedback (#1225)
  • feat: hypervisor-detection — pure step-3 derivations over detail specs + pending list (#1225)
  • feat: hypervisor-detection tests — facet read-tolerance, banner labels, guest prefix count (#1225)
  • feat: install-commands — token off argv (export/$env + sudo -E) + noHypervisor option (#1225)
  • feat: install-commands tests — env-channel token, --no-hypervisor veto, composed riders (#1225)
  • feat: guest topology, identity join and policy projection specs (ADR-0095)
  • feat: ADR-0095 ingest — /guest/ child topology, corroborated identity absorb, ack policy projection
  • updt: help text names the HYPERVISOR veto key
  • updt: pin the hypervisor veto in the local-limits tests
  • updt: LAZYIT_COLLECT_HYPERVISOR joins the local veto keys
  • updt: wire the hypervisor collector into the Linux collectHost path
  • updt: Hyper-V detection rides the Windows facts sweep; guest sweep wired into collectHost
  • feat: tests for the Hyper-V guest sweep — GUID/MAC normalization, unwrap quirk, zero-cost gating
  • feat: Hyper-V guest sweep — second PowerShell document and gated mappers (ADR-0095)
  • feat: tests for the Linux hypervisor collector — detection predicates, pvesh/virsh parsers, absent-vs-empty
  • feat: Linux hypervisor collector — Proxmox, libvirt, XCP-ng per-tick autodetection (ADR-0095)
  • feat: shared collector types for the hypervisor channel (ADR-0095)
  • feat: install.ps1 contract tests — vmms probe, veto line, upgrade merge (ADR-0095)
  • feat: install.sh contract tests — banner detection corpus, veto line, upgrade merge (ADR-0095)
  • feat: install.ps1 — Hyper-V detection banner + -NoHypervisor veto (ADR-0095)
  • feat: install.sh — hypervisor detection banner + --no-hypervisor veto (ADR-0095)
  • feat(web): es label + Windows-cost copy for the hypervisor guests collector (#1217)
  • feat(web): en label + Windows-cost copy for the hypervisor guests collector (#1217)
  • feat(web): the sixth collect toggle — hypervisor guests, seeded over the shared defaults (#1217)
  • updt: include hypervisor in the ALL_OFF policy literal (ADR-0095 ripple)
  • feat: policy tests — default-true forward-compat and per-agent projection (ADR-0095)
  • feat: collect.hypervisor sixth policy key + projectAgentPolicy version projection (ADR-0095)
  • feat: contract tests for host.hypervisor + host.guests[] and the /guest/ key helpers (ADR-0095)
  • feat: agent report contract — host.hypervisor + host.guests[] + /guest/ child keys (ADR-0095)
  • updt(web): fleet copy for the --upgrade command and the lost-token route, en + es (#1207)
  • feat(web): copy for the fleet view and the update command, en + es (#1207)
  • feat(web): the agent fleet view — distribution, liveness, degraded, command (#1207)
  • feat(web): the per-host update command, with the token stated rather than missing (#1207)
  • feat(web): the Agents tab on the Topology view toggle (#1207)
  • feat(web): ?view gains a third value, read through one total helper (#1207)
  • feat(web): useAgentFleet, keyed under the infra namespace (#1207)
  • feat(web): read GET /infra/agents/fleet (#1207)
  • feat(web): the fleet view's pure rules — platform, filter and the bulk handoff (#1207)
  • feat(web): the token-less per-host update command, lifted to lib/agent (#1207)
  • feat(agent): -KeepToken, the Windows half of the same re-run form (#1208)
  • feat(agent): --keep-token authenticates a re-run with the token already on disk (#1208)
  • feat(api): one aggregate agent line on the existing update.available email (#1206)
  • feat(api): GET /infra/agents/fleet, gated on infra:read (#1206)
  • feat(api): the agent fleet read — buckets, liveness, diagnostics, os family (#1206)
  • feat(shared): the agent fleet wire shape and the version buckets (#1206)
  • feat(web): add the chassis, endpoint-toggle, adoption and duplicate-suspicion copy (en + es) (#1200)
  • feat(web): surface duplicate-inventory suspicion and the reported chassis on the drill-in (#1200)
  • feat(web): name the Asset a confirm will adopt, before the operator clicks (#1200)
  • feat(web): let an auto-confirm rule state a reported chassis (#1200)
  • feat(web): show the reported chassis on each review-tray row (#1200)
  • feat(web): hide reported laptops and desktops by default, with the hidden count on the board (#1200)
  • feat(web): back the Show endpoints toggle with ?endpoints=1 (#1200)
  • feat(web): assert the two chassis cases that render nothing (#1200)
  • feat(web): resolve a reported chassis to a label, or to nothing (#1200)
  • feat(web): pin the endpoint filter, including the no-signal path and the canvas-only boundary (#1200)
  • feat(web): route endpoints off the topology canvas as a pure, view-level filter (#1200)
  • feat(web): es strings for the agent-linked timeline event (#1198)
  • feat(web): en strings for the agent-linked timeline event (#1198)
  • feat(web): es strings for the agent-linked timeline event (#1198)
  • feat(web): en strings for the agent-linked timeline event (#1198)
  • feat(api): persist and merge the chassis rule condition (#1198)
  • feat(api): adopt a corroborated Asset at the confirm gate, and route on chassis (#1198)
  • feat(shared): export the InfraAssetCandidate read type (#1198)
  • feat(api): additive migration for chassis routing and asset adoption (#1198)
  • feat(api): InfraNode.chassis, the rule condition column and the AGENT_LINKED event (#1198)
  • feat(shared): admit the agent_linked activity verb into the closed allowlist (#1198)
  • feat(shared): AGENT_LINKED — the one asset event an adoption emits (#1198)
  • feat(shared): chassis as an auto-confirm rule condition (#1198)
  • feat(shared): chassis on the node contract, the endpoint mapper and the adoption corroboration gate (#1198)
  • updt(agent): pin that a disabled Windows collector is never queried (#1177, #1169)
  • updt(agent): pin that both collectors emit the same MAC spelling (#1169)
  • updt(agent): assert the WOW64 arch gate and execute the throwing Die where PowerShell exists (#1191)
  • updt(agent): pin logical cores, the canonical hostname and the UTF-8 stdout declaration (#1191)
  • updt(agent): name the processor-line count as the cross-OS logical-cores wire semantic (#1191)
  • updt(web): assert the wizard emits the insecure-http opt-in only for http origins (#1190)
  • updt(agent): execute the http gate and pin the required checksum in the install.sh contract (#1190)
  • updt(agent): pin the ACL reset, required checksum and http gate in the install.ps1 contract (#1189, #1190)

Fixes

  • fix: make agent wizard polling host-safe
  • fix(docker): run Next.js web build under Node 26
  • fix: api — cap the ids/assetIds batch filters at the page limit (#1152)
  • fix(web): gate the archiving arms of the drill-in on asset:delete (#1202)
  • fix(web): disable the archiving detach for a role without asset:delete (#1202)
  • fix(api): AND-check asset:delete on the detach that archives an auto-created asset (#1202)
  • fix(api): order a node's edge list by startedAt then the unique id (#1152)
  • fix(web): the secure-context crypto lint guard now matches any object (#1126)
  • fix(web): derive TOTP codes with @noble/hashes, not crypto.subtle (#1126)
  • fix(api): order the infra node list by createdAt then the unique id (#1152)
  • fix(api): cover the MAC fallback's real populations and its log discipline (#1227)
  • fix(api): tell the MAC-fallback's real population the truth, and stop logging at it (#1227)
  • fix(agent): assert the SMBIOS warning through buildDiagnostics, not at the sink (#1227)
  • fix(agent): fit the SMBIOS-UUID warning inside the 300-char cap (#1227)
  • fix(shared): pin the length symmetry of the guest UUID join's two operands (#1227)
  • fix(shared): cut both operands of the guest UUID join at the same length (#1227)
  • fix(api): break the silence in the guest identity join, add a MAC-keyed hint (#1227)
  • fix(api): a report with no smbios-uuid must still surface its guest child (#1227)
  • fix(agent): the missing-SMBIOS-UUID warning names the cause, not just the gap (#1227)
  • fix(agent): pin a REAL Windows-on-Proxmox identity pair end-to-end (#1227)
  • fix(shared): canonicalise guest smbiosUuid through sanitizeIdentifierValue (#1227)
  • fix(shared): guest smbiosUuid must canonicalise like the identifier contract (#1227)
  • fix(web): node detail — stop the secrets section rendering twice after an attach (#1228)
  • fix(web): cover the #1228 key collision and the remount contract it must keep
  • fix(web): scope the General-tab remount keys so the two editors can never collide
  • fix: review-round specs — race fall-through, dedupe, re-propose, escaping, join determinism + cap warning
  • fix: review round — child-create P2002 fall-through, guest ref dedupe, discarded-canonical re-propose, LIKE-escaped prefixes, deterministic join candidates
  • fix: Get-VM enumeration sentinel — an empty vms artifact never ships as a positive guest list
  • fix: tests — Get-VM sentinel, errors-with-no-VMs absent-not-empty, visible cap
  • fix: aggregate 60s enrichment budget, transient-vs-permanent dumpxml split, virsh --domain, cap warning
  • fix: tests — aggregate enrichment budget, transient dumpxml degrade, --domain flag, visible cap
  • fix(web): the dialog stops recommending a token export that --upgrade refuses (#1207)
  • fix(web): hide the credential card without permission, and stop the bulk card lying about its scope (#1207)
  • fix(web): the credential block is optional, and absent is not empty (#1207)
  • fix(web): the update command is --upgrade, so it stops re-pinning the fleet's URL (#1207)
  • fix(agent): -Upgrade and the padded key, the Windows half of the same two defects (#1208)
  • fix(agent): the token leaves curl's argv, and --upgrade re-runs a host from its own config (#1208)
  • fix(api): hand the fleet read its principal so the credential gate can resolve (#1206)
  • fix(api): gate the agent credential inventory on settings:manage, and count never-used unbounded (#1206)
  • fix(shared): the fleet view's credential block is optional — it is separately gated (#1206)
  • fix(infra): pass APP_VERSION into the agent-builder stage so shipped binaries carry the release tag (#1203)
  • fix(web): complete the asset-timeline event maps for AGENT_LINKED (#1198)
  • fix(web): complete the asset-timeline event maps for AGENT_LINKED (#1198)
  • fix(agent): charge the PATH corpus pwsh spawn to a warm-up, not to a case test (#1186)
  • fix(agent): never query a collector the policy turned off, and canonicalise WMI MACs (#1177, #1169)
  • fix(agent): report the canonical MAC form on Linux (#1169)
  • fix(agent): canonicalise a NIC's MAC to one lower-case colon-separated wire form (#1169)
  • fix(web): install.ps1 gates on the machine architecture under WOW64 and Die throws a clean, checkable failure (#1191)
  • fix(agent): cores are logical CPUs, the hostname is one canonical lowercase value, and the PowerShell boundary declares UTF-8 (#1191)
  • fix(web): wizard install commands carry the insecure-http opt-in on an http origin (#1190)
  • fix(agent): require the checksum and gate plain http in install.sh (#1190)
  • fix(agent): reset the binary ACL, require the checksum and gate plain http in install.ps1 (#1189, #1190)
  • fix(agent): skip non-string registry and CIM values instead of failing the report (#1188)

Full changelog: v1.10.0...v1.11.0

Assets 2
Loading