Sysible Controller 3.0.0

Sysible Controller 3.0.0

First official tagged release. Sysible Controller is now fully browser-based — the legacy desktop (PySide6) GUI, X11-forwarding, and FreeRDP/RDP paths are gone. Everything is delivered through the web console, so the controller can live on a headless server and administrators can work from any browser on Windows, macOS, or Linux.

🔒 Security

• Closed a client-controlled audit/authorization bypass — an operator could set log=false on an SSH exec to skip both the read-only-auditor block and the audit record. The auditor block is now unconditional.
• Enrollment-token replay hardening — a leaked token can no longer take over a still-live host or resurrect an administrator-revoked one.
• Agent integrity — a host that sealed a measurement baseline and then stops reporting is quarantined (evasion-by-omission closed); the integrity state store is locked and written atomically at 0600.
• Payload size caps — agent-channel payloads (metrics / snapshot / measurements / task result / PTY output) are size-capped to bound controller memory against a hostile agent.
• Secret scrubbing — audit-log command text is scrubbed of secret-bearing arguments (--password, --token, Authorization: Bearer, KEY=value, …).
• No cross-host SSH clobber — an agent-reported IP can no longer delete or repoint another host's SSH record; the collision is surfaced instead.
• Terminal auditing — interactive terminals are audited (open/close) and bound to the operator who opened them.
• Forced password change is now enforced in the console (previously ignored).

⚙️ Reliability & operations

• Fixed a web-console startup crash (module-level use of threading before its import).
• Serialized the heartbeat-path JSON stores to end lost-update races under concurrent heartbeats.
• Hottest DB writers release their SQLite connection even on exception — no leaked WAL reservations compounding lock contention.
• Fleet-health is cached and shared across concurrent dashboard loads instead of re-probing every host per load.
• A failed agent task reports back immediately instead of hanging until a 15-minute reclaim rewrites it as a fabricated timeout.
• Foot-gun guardrails: the last superuser can't be deleted; an "all hosts" reboot/power-off skips the controller's own node; destroy's DB backup is 0600; deleting an environment with hosts is refused; duplicate environment names return a clear error.
• Force Delete for zombie hosts — Enrolled Hosts can immediately drop a broken agent build that keeps heartbeating but can't cleanly disenroll, skipping the graceful teardown that would otherwise stall. The record deletion also locks the agent out on its next heartbeat.
• Replacing the TLS certificate now warns and confirms (it breaks pinned agents until the trust bundle is redistributed).
• Agent install now works on SUSE and other minimal images — run_agent.sh installs Python 3 if absent, prefers the distro python3-requests package (no PyPI/compiler, sidesteps PEP 668), only falls back to pip and only passes --break-system-packages when that pip supports it, and hard-fails with clear per-distro guidance if requests still can't be installed. The systemd unit points at the python3 actually found rather than a hardcoded /usr/bin/python3.

✨ Usability

• Host-enrolled notification — when a new host enrolls, the console pops a toast from any page and records it in the Live Activity feed.
• Community Edition: all host/administrator seat caps removed; a small "Community Edition" badge replaces the counts.
• Nav reordered to follow the fleet workflow; consistent file-transfer/browse controls; de-cramped Enrolled Hosts rows.
• Schedule builder validates its fields (no more */0 / NaN cron) and notes that jobs run in the target host's local timezone.
• Accessibility & consistency pass: focus rings, colour contrast, missing confirmations, and loading indicators.

🧪 Testing & tooling

• Exhaustive API test-suite covering authentication, RBAC/permissions, input validation, SQL/XSS injection, size caps, duplicate requests, and rate limiting. Run with pytest.
• SessionStart hook that provisions the test environment for Claude Code on the web.

🧹 Housekeeping

• Removed legacy backward-compat shim scripts (sysible, start_sysible.sh, stop_sysible.sh). Use sysible_controller {start|stop|…}.
• Removed all desktop-GUI / xserver / RDP / FreeRDP references and host/user seat-cap language from the README, SECURITY, and docs.

📚 Documentation

• README and SECURITY updated for the current feature set, plus a Known limitations & operational notes section (TLS trust-bundle refresh, SIEM forwarding for durable audit, single-node SQLite write ceiling, bearer enrollment tokens, host-local schedule timezones).

---

Upgrading: run the update flow for the controller and agents as usual. Agent bundles are regenerated with the more robust Python bootstrap, so previously-failing SUSE/minimal hosts will install cleanly.