v0.8.0

Added

Connector modules: a connector is a folder with a manifest (strata-module.json: name, version, settings, file import, the permissions it needs) and its code, test() and run() returning proposals. The four built-in connectors are now modules too (server/connectors/builtin), and new ones need no change to Strata. Guide: MODULES.md.
Module store (Connectors › Module store, admin): lists the modules of a registry (MODULE_REGISTRY, by default docs/modules/index.json of this repository, published on the project site), with what each one reads; installs, updates and removes them in DATA_DIR/modules. Each package is checked against the SHA-256 the registry gives. MODULE_UPLOAD=true lets admins install a package file; MODULES_DIR holds modules provided by the machine's administrator; on NixOS, services.strata.modules.
Three modules in the store:
CSV inventory: assets of an IS from a spreadsheet saved as CSV, imported as a proposal by any contributor.
Nmap scan: an nmap -oX report; hosts that are up are matched by IP or name, get the system Nmap guessed (90% accuracy or more) and their open ports as listening ports of their applications; missing hosts are created with a type guessed from their ports. Open to contributors.
NetBox: devices, virtual machines, VLANs and prefixes (NetBox 3.x and 4.x, read-only token); NetBox sites go to an IS through rules; fills in what assets lack, never overwrites what was typed by hand.
The module store is checked on every pull request that changes it (scripts/check-registry.mjs, Modules workflow): each package downloads over HTTPS, matches its SHA-256, holds a manifest that agrees with its entry, and loads in the restricted module process. .github/CODEOWNERS asks a maintainer's review on the store, the modules and the connector code.
scripts/pack-module.mjs packs a module for the store (the same files always give the same bytes) and updates a registry index; strata-pack-module in the Nix package.
API: GET /api/modules, POST /api/modules/{id}/install, POST /api/modules/upload, DELETE /api/modules/{id}; POST /api/connectors/{id}/run takes {"file": {"name", "text"}, "overrides"} for any module that imports files.
Tests for the modules: the built-in ones against the simulator, what a module process can reach, time limit, store install, checksum, upload, removal; the NixOS VM test runs a provided module under the hardened service.
Changed

three.js 0.186 (from 0.128, April 2021): the 3D view loads three.js and its orbit controls as JavaScript modules, still served from public/vendor (no CDN, works offline). Colours and lighting are set to look as before, in day and night modes. Browsers need WebGL 2: Chrome or Edge 80+, Firefox 114+, Safari 15+. The vendored files are larger (2.1 MB, unminified: three.js no longer ships a minified build). Dependabot now updates three.js like the other dependencies.
Each connector test or run happens in a separate Node.js process with the permission model: it reads its module folder and the SDK only, cannot write files or start programs, gets none of the server's environment, its own settings only, and the map only if its manifest asks for it; it is stopped after CONNECTOR_TIMEOUT_MINUTES (30) and limited to 512 MB.
The Palo Alto configuration import is a generic file import: the same form for every module that imports files. Scripts posting {"xml", "fileName"} keep working.
scripts/connector-sim.mjs listens on 127.0.0.1 only, on SIM_PORT (8099 by default), and simulates NetBox too.
Upgrading

No data migration: connector settings and secrets are kept (the built-in connectors keep their ids), and so are scripts calling the connector API.
Users need a browser with WebGL 2 (see Changed).
To keep away from the module store, set MODULE_REGISTRY=off.