v1.0.0

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.0

The installer verifies llm-systems-manager-v1.0.0.tar.gz.sha256 before deploying anything.

What's Changed

• docs: host README screenshots in-repo (fix broken images for logged-out visitors) by @adrielnava in #5
• chore: repoint references to llmsyscore org + add SECURITY.md by @adrielnava in #7
• fix(installer): drop privileges via as_run_user instead of $SUDO -u by @adrielnava in #9
• fix(alarm-engine): logged best_effort for broad except-pass (#10, 1/3) by @adrielnava in #11
• fix(manager): logged best_effort for broad except-pass (#10, 2/3) by @adrielnava in #14
• fix(agent): logged best_effort for broad except-pass (#10, 3/3) by @adrielnava in #15
• fix(alarm-engine): DB-first update_config + drop dead method (#12, #13) by @adrielnava in #17
• fix(agent): truthful bench/autotune cancel reporting (#16) by @adrielnava in #18
• fix(manager): read Cheroot qsize property, not method (#21) by @adrielnava in #22
• fix(alarm-engine): clamp reactivex "Rx" logger to WARNING (#23) by @adrielnava in #24
• fix(manager): text/plain proxy errors, stop reflecting method/exception (#27) by @adrielnava in #28
• fix(manager): escape/coerce data at frontend DOM-XSS sinks (#29) by @adrielnava in #31
• fix(alarm-engine): escape agent/operator data at main.js DOM-XSS sinks (#30) by @adrielnava in #32
• fix(agent): honest pkill exit code on no-tracked-process cancel branch (#20) by @adrielnava in #35
• fix(alarm-engine): 422 + log when a found notification config is unparseable (#19) by @adrielnava in #36
• feat(manager): manager-origin CSP on proxied HTML instead of stripping it (#34) by @adrielnava in #37
• fix: stop leaking exception/traceback text in HTTP/SSE responses (#33) by @adrielnava in #38
• fix(manager): allow cdn.jsdelivr.net in proxy CSP so the AE SPA Chart.js loads (#39) by @adrielnava in #40
• fix(manager): harden /alarm/ frontend path guard against sibling-prefix bypass by @adrielnava in #42
• fix(manager): serve alarm index from a constant path to clear CodeQL #63 by @adrielnava in #44
• fix(manager): route alarm frontend assets via send_from_directory to clear CodeQL #73 by @adrielnava in #46
• fix: resolve four code-quality scanning findings by @adrielnava in #48
• fix: harden the broad empty-except handlers (py/empty-except) by @adrielnava in #50
• fix: remove dead module globals (py/unused-global-variable) by @adrielnava in #52
• fix: remove unused JS local variables (code scanning) by @adrielnava in #54
• fix: clear CodeQL dead-code findings (unused imports, dead local, duplicate imports) by @adrielnava in #56
• refactor(alarm-engine): public TTL accessor, derived venv paths, document TOML regex by @adrielnava in #58
• style: split import, name WS-host skip set + test poll constants by @adrielnava in #60
• refactor: dedupe normId, fix docstring, clarify auto_resolve_cycles, consolidate time import by @adrielnava in #62
• refactor(alarm-engine): correct stale seed docstring, hoist update field set, minor renames by @adrielnava in #64
• refactor(alarm-engine): accurate warning, warm-up debug log, shared default/uuid helpers, alert cache TTL setting by @adrielnava in #66
• refactor(alarm-engine): address CodeQL findings in repositories.py by @adrielnava in #69
• feat(branding): replace site logo with Context concentric-ring mark by @adrielnava in #72
• fix(manager): use longer lifetime cap for proxied long-running op streams by @adrielnava in #74
• feat: configurable llama.cpp install/upgrade methods by @adrielnava in #75
• docs(readme): note configurable llama.cpp install methods by @adrielnava in #76
• fix(manager): exclude venv from agent self-update bundle by @adrielnava in #78
• fix(agent): report llama build failure when a required tool is missing by @adrielnava in #80
• fix(agent): preflight per-method build tools; pick unzip/tar by asset extension by @adrielnava in #82
• fix(agent): select release_binary asset by backend (default CPU) by @adrielnava in #85
• feat(agent): setup-time llama.cpp install (#88) + true in-place upgrade (#89) by @adrielnava in #90
• fix(agent): propagate new config sub-keys into untouched blocks on upgrade (#91) by @adrielnava in #92
• fix(agent): filter tar members on self-update extract (#93) by @adrielnava in #94
• fix(agent): cap source-build -j at nproc, never emit bare -j by @adrielnava in #95
• fix(agent): source upgrade rebuilds existing tools + post-swap cleanup by @adrielnava in #99
• feat(agent): benchmark falls back to PATH when tool not beside LLAMA_BIN by @adrielnava in #100
• fix(agent): source build sets CMAKE_BUILD_TYPE=Release + HIP env for rocm by @adrielnava in #108
• fix(manager): keep per-card avg gen/prompt t/s live, stop flicker to dashes by @adrielnava in #109
• fix(agent): installer auto-llama — clean output, fix sed crash, add failure menu (#103-106) by @adrielnava in #111
• fix: hf download output formatting (#102) + llm-control panel reset on agent switch (#101) by @adrielnava in #112
• fix(agent): make release_binary in-place upgrade idempotent (#107) by @adrielnava in #113
• fix(agent): config reconcile adds missing sub-keys to activated blocks (#96) by @adrielnava in #115
• fix(manager): seed per-card perf cells so re-renders don't flash blank (#110) by @adrielnava in #116
• fix(agent): gate liquidctl on real hardware + scrub non-finite metric floats (#119) by @adrielnava in #120
• fix(manager): hide Admin tab unless role admin AND admin-CIDR (#117) by @adrielnava in #121
• fix(agent): flat release_binary install so upgrades don't break systemd (#118) by @adrielnava in #122
• docs(agent): annotate CodeQL py/empty-except handlers in llama modules (#123) by @adrielnava in #124
• refactor(auth): remove two dead module globals (#127) by @adrielnava in #128
• fix(manager): backfill perf sparklines on manager-tab entry (#131) by @adrielnava in #133
• harden(agent): contextual release-move error + reject '..' in version (#129) by @adrielnava in #135
• test(manager): add frontend JS unit-test harness + extract series helpers by @adrielnava in #136
• feat(agent): subscribe to llama.cpp /models/sse for push-based model state by @adrielnava in #142
• fix(manager): stream proxied event-stream upstreams via thread_pumped by @adrielnava in #143
• fix(agent): treat idle /models/sse read-timeout as benign reconnect by @adrielnava in #145
• Enable the agent's InfluxDB self-monitor probe (read unified-config TOML directly) by @adrielnava in #147
• fix(manager): demote benign /models/sse drain log to DEBUG + lengthen idle SSE read (#148) by @adrielnava in #152
• fix(llama): wake the sleeping model, not the first listed (#140) by @adrielnava in #153
• fix(installer): honor --enable-monitor-alarm/--enable-llama on first --update run (#149) by @adrielnava in #154
• fix(agent): mirror unified-config InfluxDB defaults in read_influx_settings (#150) by @adrielnava in #155
• perf(agent): cache influx probe settings + reuse InfluxDB clients across ticks (#151) by @adrielnava in #156
• fix(agent): show HF download progress by pinning hf --format human (#157) by @adrielnava in #158
• ci: add agent pytest job to CI (#139) by @adrielnava in #159
• fix(frontend): scope dashboard card visibility per-agent (#160) by @adrielnava in #165
• feat(frontend): make dashboard card order & size per-agent (#166) by @adrielnava in #168
• fix(bench): save pg metric (#161) and fix batched-bench output flag (#167) by @adrielnava in #169
• fix(admin): widen agent-config editor and stop line wrapping (#163) by @adrielnava in #170
• feat(bench): smart axis options + bar-only chart (#164) by @adrielnava in #171
• feat(bench): lossless SSE auto-reconnect for long benchmark runs (#164) by @adrielnava in #172
• test(agent): fix assert side-effects flagged by CodeQL (#173) by @adrielnava in #174
• feat(bench): two-pane report layout for benchmark + autotune modals (#162, #164.6) by @adrielnava in #175
• fix(autotune): pad the Targets group-box body (follow-up to #175) by @adrielnava in #177
• fix(agent-install): deploy _bench_replay.py with the agent (#176) by @adrielnava in #178
• fix(bench): match benchmark modal to Direction-B mockup (#179) by @adrielnava in #180
• fix(bench): un-clip benchmark config dropdowns (regression from #180) by @adrielnava in #182
• feat(autotune): empty-state placeholder stat-cards (parity with benchmark) (#183) by @adrielnava in #184
• feat(bench/autotune): align modals to dashboard instrument-card UX by @adrielnava in #186
• fix(bench): chart renders independent of axis helper; log t/s wrap; status chip by @adrielnava in #188
• fix(bench): populate axis dropdowns on open, map switch flags to fields (n_depth default), keep dropdown open on switch-remove by @adrielnava in #190
• fix(install): bake install-chosen flags into starter llama unit (#191) by @adrielnava in #193
• fix(install): persist llama build dir/backend/script to agent config (#192) by @adrielnava in #194
• fix(install): seed Config/Log prompt defaults from binary dir on fresh install (#195) by @adrielnava in #196
• feat(install): describe each llama build/install method at the prompt (#197) by @adrielnava in #198
• fix(install): prompt for backend on manual source/release_binary configure (#199) by @adrielnava in #200
• fix(install): gate split-install cert text to mode 3; track agent banner version from source by @adrielnava in #202
• Vendor all frontend CDN assets locally (self-host + pin) by @adrielnava in #207
• feat(charts): zoom + alarm-rule threshold lines on both dashboards (#204) by @adrielnava in #208
• feat(charts): carry forward llama ctx/gen so they draw immediately (#209) by @adrielnava in #211
• fix(install): exclude node_modules/ and frontend test/ from deploy/update rsync (#206) by @adrielnava in #212
• fix(frontend): rename colliding top-level _API consts so benchaxis.js loads by @adrielnava in #213
• Alert correlation: incident grouping + live alert_* WS events (#215, #221) by @adrielnava in #222
• Alert history: archive closed alerts to a history table with retention (#220) by @adrielnava in #224
• docs(readme): incident-correlation highlight by @adrielnava in #225
• Inference gateway: OpenAI-compatible endpoint routing across the llama fleet (#214) by @adrielnava in #226
• docs(readme): inference-gateway highlight + usage section (#214) by @adrielnava in #227
• Code-review fixes: CPU alert series, AE event-loop stalls, dead bench fallbacks, ingest validation, task refs, CORS by @adrielnava in #235
• Fix chart threshold-line series names; remove dead manager bench-replay leftovers by @adrielnava in #237
• Security-review fixes: unauth register bypass, agent-token RCE, lockout, gateway liveness, SSE backpressure by @adrielnava in #243
• Fix stale RuleEngine active-alert cache dropping re-alerts after manual actions (#244) by @adrielnava in #245
• Require auth on alarm-engine management routes (rules/alerts/notifications) by @adrielnava in #258
• Cap alarm-engine request-body size (reject oversized POSTs with 413) by @adrielnava in #260
• Block Flux injection via alarm-rule metric_source/metric_name by @adrielnava in #261
• Installer: generate a distinct [alarm_engine].management_token at install by @adrielnava in #262
• Make InfluxDB self-monitor write probe actually detect outages by @adrielnava in #263
• Exclude the point under test from the anomaly baseline by @adrielnava in #264
• Fix three frontend bugs: backup-log XSS, download-stream teardown, agent-switch chart race by @adrielnava in #271
• Fix three AE frontend bugs: WS reconnect give-up, offline-host rule widening, modal double-submit by @adrielnava in #276
• Agent privilege hardening: remove sudoers root-escalation chain (#287) + #277/#289/#292 by @adrielnava in #305
• Block unprivileged self-update when the svcconfig root migration is pending (#307) by @adrielnava in #308
• Install svcconfig wrapper + sudoers on root --update, not just fresh install (#309) by @adrielnava in #310
• svcconfig wrapper: quote backslash args to stop systemd line-continuation privesc (#311) by @adrielnava in #312
• Harden svcconfig install paths: wrapper-before-code on root --update; LLAMA_ENABLED guard (#313) by @adrielnava in #314
• Version the svcconfig wrapper so wrapper/sudoers updates reach already-migrated agents (#318) by @adrielnava in #319
• Harden installer: /tmp clone trust, secret log perms, influx input validation, update.sh failure handling by @adrielnava in #320
• Metric pipeline: per-host cache retention (#252); identity-stable buffer claims (#278) by @adrielnava in #321
• update.sh: gate restart, exit code, and cleanup on --paranoid md5 failures by @adrielnava in #322
• Installer template hardening: literal substitution + value escaping by @adrielnava in #324
• AE notification path: sender status checks, repo DB fallback, bounded websocket sends by @adrielnava in #325
• Installer secret/temp-file hygiene: argv leaks, heredoc injection, PID temp files by @adrielnava in #327
• Agent shutdown wiring: drain metric buffer, terminate bench/autotune children by @adrielnava in #328
• Terminal SSE reattach + admin overlays closed on tab switch by @adrielnava in #329
• Installer hardening: parsed token handoff, atomic update swaps, userdel guard by @adrielnava in #330
• Fix net/disk throughput conversion: emit true Mbps, not MiB/s by @adrielnava in #331
• Make "Ignore for N hours" actually suppress an alert's rule by @adrielnava in #332
• Alarm-engine dialog UX: themed confirmations + ignore-duration picker by @adrielnava in #335
• Frontend guards: double-submit on benchmark/AE Ack-Close, fix -Infinity SQLite tile by @adrielnava in #336
• Installer flow/validation: sudoers-before-start, honest non-interactive log, --user charset guard by @adrielnava in #337
• Agent probes/teardown: AMD GPU PCI slot, llama SSE model fidelity, autotune drain bound, sd.cpp port by @adrielnava in #338
• llama /props surfacing, OpenClaw budget alerts, admin audit log, scheduled backups by @adrielnava in #339
• Pass ?model= on llama /props so router mode returns per-model fields by @adrielnava in #341
• README: surface budget alerts, audit log, scheduled backups, /props fields by @adrielnava in #343
• Sign the agent-update tarball with the internal CA; agents verify before extracting (#306) by @adrielnava in #344
• Installer hardening: plist XML-escaping, install-dir validation, vendored udev rules, atomic apt sentinel, imggen probe gate (#323, #304) by @adrielnava in #345
• svcconfig: renamed-unit mismatch detection + --no-sudoers handling (#315, #316) by @adrielnava in #346
• CI: installer fresh-install + upgrade integration tests, mode 1 (#25) by @adrielnava in #347
• Remove dead/broken integration prototypes: manager_proxy + adapter (#256, #257) by @adrielnava in #348
• Upgrade pruning: removed-paths manifest for upstream-deleted files and config keys (#349) by @adrielnava in #350
• Pruning follow-ups: shared TOML span-walk, reinstall pruning, agent-side manifest (#351, #352, #353) by @adrielnava in #354
• vLLM integration: provider module, gateway, dashboard, installer (#125) by @adrielnava in #355
• Agent installer: offer interactive vLLM pip install during role=auto detection (#362) by @adrielnava in #363
• Fix vLLM dashboard cards growing unbounded: wrap chart canvases in .chart-wrap (#364) by @adrielnava in #365
• Fix vLLM layout-preset dropdown (no-op) + align control buttons to llama/LMS (#366) by @adrielnava in #367
• vLLM control page: full parity with llama/LMS Server Control (#368) by @adrielnava in #369
• Admin Data Flow: add the primary vLLM push row (#370) by @adrielnava in #371
• Registry-driven provider loops, llama/vllm dedup, vLLM history backfill by @adrielnava in #372
• Spec-driven pin + pool routing for all providers (vLLM parity) (#359) by @adrielnava in #373
• vLLM: Auto-Tune max-model-len wizard (#356) by @adrielnava in #375
• vLLM: benchmark wizard (vllm bench serve) (#357) by @adrielnava in #376
• #374: registry-driven admin provider UI (primary checkboxes, view buttons, jump map) by @adrielnava in #378
• #377: converge bench replay-SSE generator into providers/_shared (llama + vLLM) by @adrielnava in #379
• Charts: box-drag zoom with reset icon + threshold lines clip to data scale by @adrielnava in #381
• README: lead with top 6 features + rewrite feature list by @adrielnava in #382
• #383: install from checksum-verified GitHub Release tarballs + release workflow by @adrielnava in #388

Full Changelog: https://github.com/llmsyscore/llm-systems-manager/commits/v1.0.0