v0.5.1 — Fix stuck VM scan timeout cleanup

Fixes a guest scan hang where an Azure CLI launcher exited but a descendant kept stdout/stderr pipes open, leaving timeout cleanup waiting indefinitely.

• Bound cleanup waits and stop the isolated client process group on POSIX; request process-tree termination on Windows.
• Apply the same timeout handling to Azure inventory and VM preflight requests, and respond to cancellation during VM metadata checks.
• Show the current VM, inspection phase, and elapsed phase time in the dashboard.
• Keep retry reports and remote-execution uncertainty visible. Stopping the local client does not cancel an accepted Azure Run Command.

Validation: 114 tests passed locally, including a real orphaned-launcher regression. Browser checks cover phase timing, mobile layout, failed-only retries, preserved source results, and standalone HTML export. Wheel and source distribution built successfully.

CI passed on Ubuntu and Windows with Python 3.11 and 3.13, plus the Docker build and runtime checks.

v0.5.0 — Retry remaining VMs after sign-in expiry

Retry only the VMs that failed or were not submitted in a previous guest inspection, without rescanning successful VMs or overwriting the original report.

• Select a finished guest scan and click Retry remaining VMs. The dashboard shows the number of eligible VMs.
• Targets failed, timeout, cancelled, and not_submitted VMs, deduplicated by resource ID, with no 50-VM limit. Already checked, incomplete-but-inspected, and skipped VMs are excluded.
• Creates a separate retry run and HTML/CSV/coverage report linked to its source. The original report remains unchanged. No new inventory discovery expands the scope.
• Adds guest_retry_scan to the scan API. It accepts an existing guest scan UUID, not a local file path.
• Stops further guest submissions after expired-sign-in / AADSTS / interactive-login errors and records remaining VMs as unsubmitted for a later retry. Authorization/RBAC failures remain per-VM errors.

az login
azure-php-scout guest --retry-from previous-results.csv --dry-run
azure-php-scout guest --retry-from previous-results.csv -o retried-results.csv

Refresh Azure CLI authentication on the service host before retrying a scan that stopped for sign-in. For tenant-specific authentication, sign into the required tenant. Refreshing sign-in does not grant missing Run Command permissions or bypass MFA/sign-in-frequency policy. Check Azure before retrying timed-out or cancelled commands because an accepted Run Command may still be running.

Validation: synthetic reports with more than 50 retries, completed/skipped VM exclusion, deduplication, original-file preservation, dry-run without Azure calls, API/background workers, sign-in-expiry stopping behavior, browser retry controls, mobile layout, and standalone HTML export. Tests use mocked Azure adapters; no live guest commands were executed.

All five GitHub CI jobs passed: Python 3.11/3.13 on Windows and Ubuntu, plus Docker build/CLI checks.

See guest inspection documentation. Release downloads include the Python wheel, source archive, and SHA-256 checksums.

v0.4.0 — Automated inspection across all accessible subscriptions

Automatically inspect Windows and Linux VMs across every subscription available to the host Azure CLI account, including private VMs, and download one combined HTML report.

In the dashboard select New scan → VM guest inspection → All accessible subscriptions (automatic), then start. No subscription IDs, VM IDs, or inventory preview are required.

azure-php-scout guest --all-subscriptions --dry-run
azure-php-scout guest --all-subscriptions -o account-php.csv

• Refreshes account subscriptions automatically and deduplicates account records.
• Discovers VMs in batches of 100 subscriptions grouped by tenant, following all continuation pages. There is no 50-VM or 1,000-subscription cap.
• Retries failed inventory batches per subscription, allowing successful subscriptions to continue after discovery or permission failures elsewhere. Guest commands are not automatically retried.
• Includes subscription coverage with names, IDs, tenants, discovery status, and per-VM counters. Empty, disabled, inaccessible, and partially inspected subscriptions remain visible.
• Preserves existing single-subscription and individual-VM inspection modes.
• Adds guest_all_subscriptions: true to the scan API.
• Handles transient Windows file-sharing conflicts during report updates and closes CSV files before assessment so dashboard polling does not interrupt scanning.

The identity needs inventory read access and Run Command action permission on inspected VMs. A ready, running Azure VM Agent is required. Scripts run as root/SYSTEM; inspections are sequential. Stopping a scan prevents further submissions but cannot stop guest scripts already accepted by Azure. Access is limited to the authenticated CLI context; the service does not grant permissions or sign into additional accounts.

Validation covers a synthetic account with 1,003 subscriptions, multiple tenants, paginated VM inventory, private Windows/Linux VMs, empty/disabled/inaccessible subscriptions, per-VM permission failures, cancellation, API/background workers, and combined exports. Browser checks cover all three scopes, automatic scanning without IDs, desktop/mobile layout, and offline HTML subscription coverage and filters. No live guest commands were executed during these tests.

All five GitHub CI jobs passed: Python 3.11/3.13 tests on Windows and Ubuntu, plus Docker build/CLI checks. Windows CI also verifies actual concurrent reader-lock recovery.

See guest inspection documentation. The release includes a Python wheel, source archive, and SHA-256 checksums.

v0.3.0 — Subscription-wide VM inspection

Inspect every Windows and Linux VM in one selected Azure subscription using Run Command, including VMs without public IPs, and download one combined HTML report.

• New dashboard scope: VM guest inspection → All VMs in one subscription. Load the available subscriptions or paste one subscription UUID; no VM resource IDs are needed.
• Paginated inventory includes public/private and stopped VMs, with no 50-VM limit for subscription scope. Existing individual selection remains available.
• The report identifies the subscription and includes findings, skipped/unready VMs, failures, and VMs not submitted after cancellation.
• Incomplete discovery prevents command submission and produces a coverage report explaining the failure.
• CLI and API support the same subscription scope.

azure-php-scout guest --subscription SUBSCRIPTION-ID --dry-run
azure-php-scout guest --subscription SUBSCRIPTION-ID -o subscription-php.csv

Run Command executes the bundled inspection scripts as root/SYSTEM. The identity needs inventory read access and Run Command action permission. VMs need a running, ready Azure VM Agent. Guest checks are sequential; cancellation cannot stop a script already accepted by Azure. See guest inspection documentation.

Validation: 90 tests and 61 subtests pass locally. Headless browser checks cover subscription selection/preview, both guest scopes, mocked private Windows/Linux inspection, skipped VMs, desktop/mobile layout, and offline HTML report filters. Azure responses in these tests are synthetic; no live guest commands were executed.

GitHub CI passed all five jobs: Python 3.11/3.13 on Windows and Ubuntu, plus the Docker build and CLI checks.

The release includes a Python wheel, source archive, and SHA-256 checksums.

Azure PHP Scout v0.2.0 - Windows and Linux guest inspection

Azure PHP Scout can now inspect installed PHP inside explicitly selected Windows and Linux Azure VMs, including private VMs whose runtime versions are hidden from external HTTP checks.

• New dashboard guest-inspection mode, VM discovery/selection, fixed-script review with SHA-256, and CLI azure-php-scout guest workflow.
• Linux binary/package inventory; PHP version probes drop to nobody with cleared supplementary groups and no-new-privs. Windows reads executable version metadata and IIS FastCGI paths without executing PHP binaries.
• Explicit VM IDs, running/ready-agent preflight checks, OS-specific Action Run Command, immutable script snapshots, bounded output, and per-VM errors.
• Guest evidence, installed versions, package backport uncertainty, VM progress, and HTTP observations remain distinct in the dashboard and HTML/CSV exports.
• Cancellation and timeout reports retain remote execution uncertainty; a command already accepted by Azure cannot be cancelled by stopping the local scan.
• Newly generated token files end with a newline for reliable terminal copying.

This mode is opt-in and requires Run Command action permission; Reader alone is insufficient. Azure executes the inspection scripts as root/SYSTEM and creates its normal agent/extension artifacts. The scripts do not install software or change application configuration. Guest inventory does not prove the PHP runtime loaded in web workers or vendor patch status.

Validation: 83 tests pass on Python 3.11 and 3.13 across Linux and Windows; the Docker CI job passes. Browser checks cover guest selection, script review, mocked background scans, desktop/mobile layout, and offline HTML report filters. Linux probes were also checked against PHP 8.2.35 in a read-only, network-isolated container. Azure guest invocations in tests are mocked; no live customer VM Run Command was performed.

See guest inspection and permissions and the README. The advisory catalog remains scoped to the two reviewed PHP core CVEs documented there.

Azure PHP Scout v0.1.0

Azure PHP Scout's first public release provides a self-hosted dashboard and CLI for finding Azure services that may need a PHP security update.

• Read-only Azure inventory for VMs with public IPs, App Services and deployment slots, and Static Web Apps.
• Bounded TCP discovery with common, custom, or full-range VM scans and PHP/WordPress HTTP evidence.
• Reviewed, branch-specific version triage for CVE-2026-109618 and CVE-2026-109619, plus upstream lifecycle and unknown-version findings.
• Authenticated dashboard/API, persistent scan history, queued/cancellable workers, and offline HTML/CSV/JSON exports.
• Docker Compose, synthetic demo data, contributor documentation, and MIT licensing.

Findings require runtime, package/build, deployment, and vendor backport verification. This catalog covers two PHP core advisories and does not establish exploitability or complete vulnerability coverage. No customer inventories, scan results, or Azure credentials are included.

Python 3.11+ is required. Install the wheel with pip install azure_php_scout-0.1.0-py3-none-any.whl, then run azure-php-scout serve. In another terminal, use azure-php-scout token to obtain the local dashboard sign-in token. Azure CLI and Resource Graph are required for live Azure inventory; the demo and CSV workflows work without Azure.

See the README for full setup, coverage limits, and Azure authentication. The included SHA256SUMS contains the downloadable wheel/source archive checksums.

Validation: 65 regression tests passed on Python 3.11 and 3.13 across Linux and Windows. The Docker build, packaged CLI/Resource Graph checks, local authenticated container smoke test, and desktop/mobile browser checks also passed.