Commit graph

5104 commits

Author SHA1 Message Date
rcourtman
7be844f23a Require signed unified agent release assets 2026-04-22 02:00:29 +01:00
rcourtman
7b1520b760 Add fingerprint-pinned TLS mode for unified agent 2026-04-22 01:36:46 +01:00
rcourtman
a8d9051b15 Restrict default workflow token permissions 2026-04-22 01:21:24 +01:00
rcourtman
43922161e4 Harden connection probe and simple stats rendering 2026-04-22 01:18:33 +01:00
rcourtman
70acd663bd Strengthen export and license persistence encryption 2026-04-22 01:03:10 +01:00
rcourtman
513399b004 Harden hosted signup and audit webhook trust paths 2026-04-22 00:54:49 +01:00
rcourtman
586473ee31 Bind recovery and bootstrap auth to direct loopback 2026-04-22 00:39:53 +01:00
rcourtman
360d08104e Compile out release env guardrail bypasses 2026-04-22 00:05:57 +01:00
rcourtman
c49176d700 Require TLS for non-loopback agent transport 2026-04-21 23:56:07 +01:00
rcourtman
3ec2c0779e Harden agent command and deploy trust boundaries 2026-04-21 23:50:34 +01:00
rcourtman
02e9107ac4 Harden cloud handoff membership authorization 2026-04-21 23:18:35 +01:00
rcourtman
22687e9301 Clear expired status work claim 2026-04-21 22:48:11 +01:00
rcourtman
62ec34ef02 Route hostname lookups through canonical equivalence 2026-04-21 22:47:23 +01:00
rcourtman
68c1e9564d Refine quick tour copy and guide labels 2026-04-21 22:35:58 +01:00
rcourtman
3c93694c5f Tighten provider-neutral host install wording 2026-04-21 22:34:51 +01:00
rcourtman
074b04eb76 Prove offline Proxmox node visibility in v6
Refs #1433
2026-04-21 22:23:53 +01:00
rcourtman
f796efceac Fix QNAP host/docker monitored-system split
Refs #1421
2026-04-21 22:11:13 +01:00
rcourtman
e1c852350e fix: rebuild unified-seed source mappings for dashboard trends 2026-04-21 18:30:49 +01:00
rcourtman
669908acd4 Normalize workloads and recovery page headers 2026-04-21 17:51:33 +01:00
rcourtman
4f0c8b3e42 Keep unified agent add-flow copy provider-neutral 2026-04-21 17:34:15 +01:00
rcourtman
1cad23fd4c Drive infrastructure catalog grouping from platform manifest 2026-04-21 17:24:22 +01:00
rcourtman
8b4a81be36 Fix guest row style typing 2026-04-21 17:21:14 +01:00
rcourtman
55df0041ec Neutralize infrastructure add catalog posture 2026-04-21 16:56:14 +01:00
rcourtman
0d5bec8a81 Add Proxmox workload refresh regression proof
Refs #1427
2026-04-21 16:45:00 +01:00
rcourtman
a170692683 Align AI discovery lifecycle with discovery settings
Refs #1425
2026-04-21 16:06:49 +01:00
rcourtman
fd5c14b049 Close RC-era issue gaps blocking v6 GA
Refs #1430

Refs #1436

Refs #1435

Refs #1409

Refs #1429

Refs #1432
2026-04-21 14:46:23 +01:00
rcourtman
ee2537987f Surface active PBS tasks in infrastructure views 2026-04-20 23:54:01 +01:00
rcourtman
770cceae52 Fix self-hosted community entitlements reporting expired state 2026-04-20 23:48:31 +01:00
rcourtman
92f4e2c0a9 Expose shared storage growth deltas on the storage page 2026-04-20 23:22:29 +01:00
rcourtman
4711d11163 Fix fresh Proxmox LXC installs defaulting to RC 2026-04-20 23:11:46 +01:00
rcourtman
4bd023fe1c infra: align agent-led add landing with Proxmox auto-detect 2026-04-20 22:48:34 +01:00
rcourtman
d8d94c48e1 Expose local commercial funnel diagnostics 2026-04-20 22:27:34 +01:00
rcourtman
c20766b7b8 Instrument self-hosted billing conversion stages 2026-04-20 21:46:59 +01:00
rcourtman
61430703b2 Reframe self-hosted paid value around operator outcomes 2026-04-20 17:30:52 +01:00
rcourtman
ed58890471 infra: lead the Add landing with the agent, not the probe
The previous layout put AddressProbeStep at the top with the agent card
below as "Or install the agent on the host." Both sections read as
alternatives to the probe, which made the probe the primary action even
though the probe is inherently a Platform-API-oriented move (figure out
which API to connect to). A user committed to the agent path has no use
for it. The "Recommended" chip on the agent card did not fix this — the
structural lead won.

Move the agent card to the top of the Add landing with no divider above
it (it's the primary, not an alternative). Fold the probe + platform
grid into a single "Or connect a platform API directly" section below,
so the ordering matches the story: agent first, API as fallback for
hosts the agent can't cover.

Architecture pin in settingsArchitecture.test.ts updated to guard the
new ordering: agent card copy indexOf < API section indexOf < probe
indexOf. Explicitly asserts the old "Or install the agent on the host"
divider is gone.
2026-04-20 17:20:05 +01:00
rcourtman
0c47b2ada1 Clear v6 prerelease-to-GA promotion gate 2026-04-20 16:33:03 +01:00
rcourtman
6f60732f92 infra: foreground the agent on the Add landing
Flip the two sections so the agent card sits above the platform grid
and reads "Recommended" with a blue border. The platform grid is now
explicitly framed as "Or connect a platform API directly — for VMware,
TrueNAS, PMG, or a remote Proxmox you can't install the agent on."

The ordering matches what the agent actually delivers: on a Proxmox
host it mints the API token and auto-registers both PVE and PBS with
zero credentials paste (RunAll in internal/hostagent/proxmox_setup.go).
The platform grid is the right path when the target is an appliance
you can't install on or a remote machine. Visual weight now matches
friction.

Architecture pin extended to assert the section ordering so a future
edit doesn't silently swap them back.
2026-04-20 16:16:54 +01:00
rcourtman
85b816c606 infra: surface the agent's Proxmox auto-register shortcut
On a PVE or PBS host, the agent mints its own API token and registers
the node via RunAll (internal/hostagent/proxmox_setup.go + agent.go
:1295–1340). That is the fastest path to a working Proxmox connection
— no address paste, no credentials. Previous copy framed the agent
purely as "host metrics you add on top," which hid the shortcut and
steered Proxmox users into pasting credentials they did not need.

Reframe the two sections:
- "Or connect a remote platform API" — five tiles for when Pulse lives
  elsewhere from the target (PMG / VMware / TrueNAS have no host-side
  agent path, and remote Proxmox reaches the tile from a different box).
- "Or install the agent on the host" — leads with "On a Proxmox host,
  this is the fastest path," then keeps the host-metrics pitch for
  bare-metal Linux / Unraid / FreeBSD / Docker / Kubernetes.

Architecture pins extended to guard the Proxmox auto-register copy.
2026-04-20 15:56:42 +01:00
rcourtman
d39a935f86 infra: teach the agent as a host-level add-on, not a sixth platform tile
The flat catalog put Install Pulse Agent beside Proxmox / VMware /
TrueNAS as a peer. A user arriving to connect Proxmox picks Proxmox
instantly and never learns the agent also adds CPU temperature, disk
SMART, systemd services, and Docker/Kubernetes auto-detect on the host
itself.

Split the landing into two sections:

- "Or pick a platform to connect" — five peer tiles for PVE / PBS /
  PMG / VMware / TrueNAS. These are management-API integrations and
  belong together.
- "Or install a host-level agent" — a distinct full-width card with a
  "Runs on a host" chip. Copy names the telemetry the agent adds and
  says explicitly that it layers *in addition to* a platform connection
  above, not instead of one.

The agent is a different kind of integration from the platform APIs.
Framing it as a peer hid its value; framing it as an adjunct teaches
it.
2026-04-20 15:40:28 +01:00
rcourtman
b3abb746bc infra: replace Add picker with Datadog-style catalog landing
The intermediate two-card picker screen ("Add connection" vs "Install
agent") restated the same decision twice and framed the agent path as a
walled-off alternative. Replace it with a single catalog landing that
matches how Datadog, Grafana, and GCP Marketplace present "add an
integration" — an address probe at the top, and a tile grid below
listing Proxmox VE / PBS / PMG / VMware / TrueNAS / Install Pulse Agent
as peer entries. Picking a tile or a probed candidate drops straight
into that product's credential slot; "Back to catalog" returns to the
landing.

Retires the ConnectionsExplainer component, the picker-mode state in
InfrastructureWorkspace, and the "Enter credentials manually" toggle
in AddressProbeStep. Tests updated for the shortened path (one click
from ledger header to any credential slot).
2026-04-20 15:01:51 +01:00
rcourtman
c4a4d175ce Fix v6 dry run backend contract regressions 2026-04-20 14:57:49 +01:00
rcourtman
a62f185cce infra: replace fixed ledger explainer with an Add infrastructure flow
The two teaching cards lived permanently above the ledger, so every
repeat visit paid visual cost for content the user only needs when
adding something new. The new shape:

  Ledger      — just the table plus one "Add infrastructure" action.
  Picker      — clicking Add brings up the two cards on their own
                screen ("Add connection" / "Install agent") with full
                teaching context.
  Sub-flow    — the chosen mode runs as before: probe for Platform API,
                install section for the agent. Each sub-flow exposes a
                "Change method" button so the user can step back into
                the picker without leaving add mode.

Legacy ?add=pick deep links still route into the new picker rather than
jumping directly into the probe.
2026-04-20 14:24:58 +01:00
rcourtman
f9104115a5 Fix v6 top-level page header composition 2026-04-20 14:20:38 +01:00
rcourtman
6db9aeadcf Prepare the v6 stable promotion candidate 2026-04-20 14:09:17 +01:00
rcourtman
948499839d infra: fold Add/Install CTAs into the unified entry cards
The teaching cards and the ledger-header action buttons were duplicating
the same mode split: cards explained Platform API vs Unified Agent, then
the header restated it as "Add connection" / "Install agent." The cards
are now the entry surface — each carries its own CTA button inside the
card body — and the ledger header goes back to just titling the table.

Removes the dismiss (X) affordance; the cards are now functional, not a
tutorial banner, so they stay permanently visible. In read-only mode the
CTAs are hidden so the cards remain informational.
2026-04-20 13:51:09 +01:00
rcourtman
b8b0125418 Clear the self-hosted commercial coherence gate 2026-04-20 12:11:53 +01:00
rcourtman
5338ae576d infra: render Add connection and Install agent as equal-tone peers
The two-card explainer teaches Platform API vs Unified Agent as peer
options, but the ledger-header buttons had Add connection rendered as
primary/blue and Install agent as secondary/bordered — implying Add
connection was the default choice. Neither is a default: the right one
depends on the user's system. Both buttons now use the secondary tone so
they read as peers, and the user's choice is driven by the explainer
above rather than by button prominence.
2026-04-20 11:50:50 +01:00
rcourtman
eb505a9371 infra: surface Install agent as a first-class ledger-header button
The Add screen's subtext offramp was the only path to the agent install
page, and that was the wrong design: the explainer teaches Platform API
and Pulse Unified Agent as peer modes, but clicking Add connection
funneled users into a probe-first flow where the agent path was a
footnote. Users wanting CPU/disk temps, SMART, or bare-metal Linux
couldn't find the page without hunting.

Changes:
- Ledger header now has two peer actions: Add connection (Platform API
  probe) and Install agent (direct to agent install slot).
- Drop the always-visible "Install the Unified Agent on a host" subtext
  from the Add screen; the header button makes it redundant.
- Enhance the probe no-match box to name bare-metal Linux / Unraid /
  FreeBSD and offer the agent as a first-class alternative so a user who
  probed the wrong thing isn't stranded on a Platform-API-only picker.
- Rewrite the infrastructure description to match: "Add connection for
  Platform API setup; Install agent for host-level metrics or bare-metal
  Linux / Unraid / FreeBSD."

Tests updated to match (architecture pins, workspace flow, editor
behavior). 41 affected vitest cases pass. Playwright-verified against
the live dev server: both header buttons route correctly, subtext is
gone, no-match box surfaces the agent alternative.
2026-04-20 11:46:10 +01:00
rcourtman
1eccdde2b4 Document the v6 GA promotion packet 2026-04-20 10:48:37 +01:00
rcourtman
7e7765187b ledger: tell the truth on Platform API remove confirm
Agent rows already got an honest confirm-expansion ("Removing forgets
this agent from the ledger; history is retained…") plus uninstall
commands as a courtesy. Platform API rows (PVE / PBS / PMG / VMware /
TrueNAS) had nothing beyond "Click again to confirm," which left two
honest questions unanswered:

- Does this delete my history? (No — history is retained in v1.)
- Does this log me out of the platform itself? (No — credentials on
  the platform side are untouched.)

Add a parallel expansion for non-agent rows that answers both directly.
Matches the plan's "user-facing copy in Remove dialog must be explicit"
note and keeps honesty symmetric between Agent and Platform API rows.
2026-04-20 10:44:58 +01:00