3 Commits

Include renames

Author	SHA1	Message	Date
enricobuehler	a85e845255	fix(web): the console stops falling out of its own design system ... A pre-release sweep of the management console for two things that no type check and no diff can catch: primitives that were never @unom/ui's, and animation that a nested motion parent quietly cancelled. THE PRESET TILES ALL LANDED ON THE SAME FRAME. @unom/ui's <Section> sets `delayChildren: stagger(...)`, so a page whose cards are direct descendants of it staggers for free — which is why every page but one looked right. An <AnimatedCard> is ALSO a motion element and sets no `delayChildren`, and the Virtual displays preset tiles are cards nested INSIDE that page's config card, so that card became their timing group. Measured in a headless browser: the opacity spread between the first and last tile was 0.00 across the whole animation (six tiles in lockstep), and is 0.98 now — a ~100 ms cascade matching the rest of the console. The four hand-rolled copies of the stagger container collapse into one `<Stagger>` that carries the explanation. FIVE FILES IMPORTED THE WRONG BUTTON. `@unom/ui/button` exports both a plain `Button` and the `AnimatedButton` that this console's wrapper re-exports under the same name — so `import { Button } from "@unom/ui/button"` compiles, renders, and silently opts out of the mount animation and the hover/tap response. Displays, SessionGame, GPU, Update and PendingDevices had dead buttons sitting next to live ones. THREE PRIMITIVES HAD NO WRAPPER, SO NOBODY REACHED FOR THEM. @unom/ui ships form/select, form/textarea and form/checkbox; components/ui did not, and the gap was filled with browser-chrome `<select>`, `<textarea>` and `<input type="checkbox">` in the add-hook modal and both library forms. Select needs the same token correction Tabs needed — upstream `text-secondary` is a text colour, but here `--secondary` is a SURFACE, so the trigger's chevron and placeholder rendered at near-zero contrast on the card behind them. The hook timeout also stops accepting a value the host rejects: `min`/`max` on a controlled `<input type="number">` are decoration (no form validation ever runs), so 900 went into a field capped at 600 and failed later, at run time. @unom/ui's InputNumber clamps on blur and lets the field be empty while you retype instead of snapping to the fallback. Storybook gains the page that had no story at all — the console's largest config surface, and the reason this shipped unseen. Its <Card> wrapper is load bearing: it reproduces the motion nesting that IS the bug.	2026-08-07 22:34:24 +02:00
enricobuehlerandClaude Opus 5	4575134c21	fix(web): one bad password from anywhere stops locking out the whole console ... The console's login throttle was documented as per-IP and was not. Nitro's `localFetch` hands the app a synthetic request whose socket has no `remoteAddress`, so `getRequestIP()` returned undefined for every request and every attempt was charged to one shared "unknown" bucket. Five wrong guesses from any LAN peer locked out everyone — including the operator, and including the update-apply route, which shares that budget. The Bun entry is the only place the real peer is knowable, so it now stamps it into a header (deleting any client-supplied copy first) and `peerAddress()` reads it back. Verified on a real build bound to 0.0.0.0: seven wrong logins from 127.0.0.1 lock 127.0.0.1 out, a different peer still logs in on the first try, and a request forging the header is charged to its real address. Also on the way through: - Installing an unreviewed package and adding a catalog source now re-ask for the console password, like applying an update already did. A 7-day session cookie should not be able to run new code on the host, and `store/install` with `accept_unverified` did exactly that through the generic passthrough. The gate sits at the trust boundary — adding a source, or a raw spec — not on every install from a source the operator already chose to trust. - The ui-credential denylist is matched against the normalised path too, so `/api//v1/...` and friends can no longer walk around it. - The console serves nosniff, a no-referrer policy, and a CSP that pins frame-ancestors, object-src and base-uri. - A plugin UI's response no longer re-emits the content-encoding that `fetch` already decoded (which made compressed plugin pages fail to load), no longer sets cookies on the console's origin, and OPTIONS reaches the plugin instead of being refused 405 by us. - An unreachable host reads as 502 on these routes, matching the passthrough, instead of a bare 500. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 00:20:10 +02:00
enricobuehlerandClaude Fable 5	833f3348a0	feat(store): console plugin store, index repo, and the fixes on-glass found ... Console: a Plugins section (Browse / Installed / Sources) on a static nav entry, with install friction proportional to trust — a plain confirm for a verified entry, a warning naming the curator for an external one, and a danger dialog that makes you retype the spec for a raw package. Tier badges are permanent and follow the plugin onto its own UI page. Index: unom/punktfunk-plugin-index published and served from Gitea's raw endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is publish, which resolves the design's open hosting question. Four things only running it could find: - runner discovery matched @punktfunk/plugin-* only, so a third-party scoped plugin (which D8 requires) would install and never run - ...and that convention also matches @punktfunk/plugin-kit, a plugin's own framework: it listed as installed and would have been imported as a unit. Both now key off the plugins dir's top-level dependencies, with an emptied dependency list meaning 'nothing installed' rather than falling back to the naming convention - the store must not pass new flags to the runner: the scripting package ships separately and an older one reads an unknown flag's value as a package name. The host writes the bunfig scope mapping itself - ureq reports only >= 400 as Err, so a conditional request's 304 arrives as Ok with an empty body — handled as an error it made every refresh after the first verify a signature over zero bytes and sit stale Also: the console's first Tabs use exposed an @unom/ui theme gap that rendered inactive tabs invisible (caught in a browser pass, not by types). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:48:02 +02:00