2 Commits

Include renames

Author	SHA1	Message	Date
Omar SobhandClaude Opus 4.8	3554a3aaf2	CI: remove k8s stages, fix the Docker-level pipeline green ... Survey + fixes so the pipeline passes at the Docker level (no k8s). - Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the "Helm chart lints" gate step. release.yml was already k8s-clean. - Rust job: - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing). - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api fleet.rs doc list indentation, node_rules map_or→is_none_or). - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test query → offline compile failed). DB-backed tests use testcontainers at runtime. - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against the committed cache deterministically (no DB needed at compile time). - Frontend job: - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect; tag the slice with agentId + derive null on mismatch). - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the current APP_IDS + use a genuinely-unknown id for the reject case). Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline), frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-26 18:15:31 -07:00
Omar SobhandClaude Opus 4.8	7332d69f8a	Fleet P1: BYO Tailscale + network metrics, Tailscale SSH, exec hardening ... Security hardening: - The gateway no longer sends arbitrary shell to nodes. The WSS exec op is replaced by a typed `verify` op the daemon runs itself (fixed host+docker check); future container ops are typed too. cm-api NodeHub.verify() + the daemon's handle_command only dispatches vetted ops. BYO Tailscale: - migrations/0019_workspace_tailscale.sql + cm-db fleet_tailscale repo (store the user's Tailscale API key + tailnet, server-side only). - cm-api routes/tailscale.rs: POST/GET/DELETE /api/fleet/tailscale + GET /api/fleet/tailscale/devices (proxies api.tailscale.com device list). - Daemon: --tailscale-authkey → `tailscale up --authkey … --ssh` (enables Tailscale SSH for keyless user access); else `tailscale set --ssh=true`. Reports its tailscale IP (already). UI: - Fleet overview gains a Tailscale section: connect (key+tailnet) + live tailnet device status (online/last-seen/IP/os). Node cards show a copyable Tailscale SSH target (ssh <ip>). Remaining: P2 — RemoteDriver + placement (run agents on nodes) and the in-UI remote terminal (PTY proxied over the WSS channel). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-24 10:27:58 -07:00