@checkstack/healthcheck-ssh-backend 0.3.5 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,124 @@
 # @checkstack/healthcheck-ssh-backend
 
+## 0.4.1
+
+### Patch Changes
+
+- c55d7c6: Unify the healthcheck chart system on the `@checkstack/ui` SVG kit and
+  redesign the HealthCheck drawer.
+
+  - `@checkstack/ui` gains six chart primitives (each with a Storybook story):
+    `StackedTimeline` (stacked status counts per bucket on the colorblind-safe
+    status triad), `ChartTooltip` + `useBandHover` (the one shared chart
+    tooltip and its cursor hit-testing), `ChartCard` / `chartCardChromeClass`
+    (the premium gradient card chrome, flat on low-power devices), `StatTile`
+    (number-led metric tile with delta chip, sparkline/ribbon footer, and
+    click-to-expand disclosure), `DistributionBar` (stacked horizontal
+    distribution + legend, replaces pies), and `CategoryRibbon` (categorical
+    history ribbon). `TimeSeriesChart` gains a hover tooltip with a crosshair
+    marker.
+  - `@checkstack/common` adds four optional chart metadata keys to
+    `BaseHealthResultMeta`: `x-chart-priority` (tile sort weight, lower first,
+    default 100), `x-chart-good-direction` (`"up" | "down"`, which direction
+    of change is an improvement; consumers fall back to
+    `x-anomaly-direction`), and `x-chart-true-label` / `x-chart-false-label`
+    (prose for a boolean field's values wherever they surface in text, e.g. a
+    dominance chip reading "Usually successful (98%)" instead of "Usually
+    true"). Built-in collector backends annotate their headline metrics and
+    boolean fields accordingly (purely additive metadata).
+  - `@checkstack/healthcheck-frontend` rebuilds the drawer: a hero status
+    banner (status pill, healthy %, avg latency, interval, last run with the
+    exact datetime on hover, full-width status ribbon) replaces the metric
+    tiles; the status timeline and latency heroes share the `ChartCard`
+    chrome; the auto-generated charts become a prioritized, click-to-expand
+    2-up tile grid (collector ids demoted to hover titles); the anomaly
+    Expected/Trend derivation is consolidated into one tested module shared by
+    the latency hero and the tiles.
+
+  BREAKING CHANGES: `recharts` is removed from `@checkstack/healthcheck-frontend`
+  (and the unused dependency from `@checkstack/ui`); the
+  `HealthCheckStatusTimeline` and `SparklineTooltip` components are deleted.
+  Extensions rendering into `HealthCheckDiagramSlot` should build on the
+  `@checkstack/ui` chart primitives instead.
+
+- Updated dependencies [c55d7c6]
+- Updated dependencies [c55d7c6]
+  - @checkstack/healthcheck-common@1.13.0
+  - @checkstack/common@0.21.0
+  - @checkstack/backend-api@0.29.1
+  - @checkstack/healthcheck-ssh-common@0.1.28
+
+## 0.4.0
+
+### Minor Changes
+
+- faf98f5: Security: config secrets (health-check strategy/collector credentials such as
+  SSH passwords, DB credentials, HTTP auth, and integration connection
+  credentials) ride ONE shared, domain-agnostic extraction channel instead of
+  being stored as plaintext or re-implemented per plugin.
+
+  New primitive and shared service:
+
+  - `configSecret({ id })` (in `@checkstack/backend-api`) declares an
+    extraction-channel secret keyed by a STABLE `id`, independent of field name or
+    position, so renaming or reordering a field never orphans its value. Use it
+    (not `configString({ "x-secret": true })`) for any credential whose config is
+    relayed to a satellite, projected to AI, or diffed by GitOps. `validateSecretIds`
+    rejects, at plugin registration, an `x-secret` field with no `id`, a duplicate
+    `id`, or a secret nested in an un-keyable container (array / record / tuple /
+    map) - so a mis-keyable schema fails boot rather than at run time.
+  - `ConfigSecretChannel` (in `@checkstack/secrets-backend`) is the single
+    extract / inflate / collect / redact / merge / delete / prune implementation.
+    Health-checks and integration connections both BIND it to their own scope
+    (marker prefix + internal-secret key layout); neither re-implements the walk.
+
+  Lifecycle (both bindings):
+
+  - **Write**: an inline value is extracted into the encrypted internal secret
+    store; the stored config keeps only an opaque marker. `${{ secrets.NAME }}`
+    references are stored verbatim and resolve through the active backend (local
+    or Vault) at run time.
+  - **Read**: configuration and connection reads strip `x-secret` values and
+    internal markers while keeping `${{ secrets.NAME }}` references visible; the
+    AI `getConfigurations` tool and create/update responses are redacted too. A
+    value never reaches a browser or an AI model context.
+  - **Run**: the core executor inflates markers/references in memory just before
+    the client is built. Satellites receive markers only and fetch values
+    just-in-time over the authenticated WS channel, per run, never persisted, then
+    fail CLOSED if any marker/reference survives resolution.
+  - **No orphan**: clearing a secret, removing a field/collector, swapping an
+    inline value for a reference, updating a connection, or deleting a
+    configuration/connection deletes the now-unreferenced internal secret. Cleanup
+    is schema-free (scans markers by prefix) and best-effort on delete, so it works
+    even when the owning plugin is uninstalled and never blocks a delete.
+  - **Forged-marker safe**: extract/inflate key each internal secret by the
+    SCHEMA leaf's stable `id`, never by an id parsed out of a stored marker string,
+    so a crafted marker can never resolve or delete another scope's secret.
+
+  Health-checks additionally get an idempotent, advisory-locked backfill that
+  moves pre-existing plaintext values into the internal store, and per-config-id
+  locking so concurrent writers across pods can never leave a dangling marker.
+  Integration connection credentials keep their released `__connref__:` marker
+  prefix and key layout (id equals the flat field name), so existing stored
+  connections are byte-compatible.
+
+  BREAKING CHANGES:
+
+  - Configuration and connection reads no longer include `x-secret` field values
+    (clients must treat blank-on-save as keep-existing; the bundled editors
+    already do).
+  - Satellites must be upgraded together with the core: an old satellite cannot
+    resolve the markers a new core stores, so its credentialed checks fail until
+    upgraded.
+
+### Patch Changes
+
+- Updated dependencies [faf98f5]
+  - @checkstack/backend-api@0.29.0
+  - @checkstack/common@0.20.0
+  - @checkstack/healthcheck-common@1.12.0
+  - @checkstack/healthcheck-ssh-common@0.1.27
+
 ## 0.3.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ssh-backend",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
@@ -17,10 +17,10 @@
     "pack": "bunx @checkstack/scripts plugin-pack"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.28.0",
-    "@checkstack/common": "0.19.0",
-    "@checkstack/healthcheck-common": "1.11.0",
-    "@checkstack/healthcheck-ssh-common": "0.1.26",
+    "@checkstack/backend-api": "0.29.1",
+    "@checkstack/common": "0.21.0",
+    "@checkstack/healthcheck-common": "1.13.0",
+    "@checkstack/healthcheck-ssh-common": "0.1.28",
     "ssh2": "1.16.0"
   },
   "devDependencies": {
@@ -28,7 +28,7 @@
     "@types/ssh2": "1.15.0",
     "typescript": "^5.0.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.7.0"
+    "@checkstack/scripts": "0.7.2"
   },
   "description": "Checkstack healthcheck-ssh-backend plugin",
   "author": {

package/src/command-collector.ts

@@ -43,6 +43,8 @@ const commandResultSchema = healthResultSchema({
     // by the aggregated successRate). Treating exit-code changes as anomalies
     // is a classic alert-fatigue source. Still chartable; users can opt in.
     "x-anomaly-enabled": false,
+    "x-chart-priority": 20,
+    "x-chart-good-direction": "down",
   }),
   stdout: healthResultString({
     "x-chart-type": "text",
@@ -64,6 +66,7 @@ const commandResultSchema = healthResultSchema({
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 50,
     "x-anomaly-min-relative-delta": 0.5,
+    "x-chart-priority": 10,
   }),
 });
 
@@ -83,6 +86,7 @@ const commandAggregatedFields = {
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 50,
     "x-anomaly-min-relative-delta": 0.5,
+    "x-chart-priority": 10,
   }),
   successRate: aggregatedRate({
     "x-chart-type": "gauge",
@@ -94,6 +98,7 @@ const commandAggregatedFields = {
     // of real movement before alerting.
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 5,
+    "x-chart-priority": 20,
   }),
 };
 

package/src/strategy.ts

@@ -13,7 +13,7 @@ import {
   mergeCounter,
   mergeMinMax,
   z,
-  configString,
+  configSecret,
   type ConnectedClient,
   type TransportTimings,
   type InferAggregatedResult,
@@ -39,13 +39,13 @@ export const sshConfigSchema = baseStrategyConfigSchema.extend({
   host: z.string().describe("SSH server hostname"),
   port: z.number().int().min(1).max(65_535).default(22).describe("SSH port"),
   username: z.string().describe("SSH username"),
-  password: configString({ "x-secret": true })
+  password: configSecret({ id: "password" })
     .describe("Password for authentication")
     .optional(),
-  privateKey: configString({ "x-secret": true })
+  privateKey: configSecret({ id: "privateKey" })
     .describe("Private key for authentication")
     .optional(),
-  passphrase: configString({ "x-secret": true })
+  passphrase: configSecret({ id: "passphrase" })
     .describe("Passphrase for private key")
     .optional(),
 });
@@ -60,8 +60,12 @@ const sshResultSchema = healthResultSchema({
   connected: healthResultBoolean({
     "x-chart-type": "boolean",
     "x-chart-label": "Connected",
+    "x-chart-true-label": "connected",
+    "x-chart-false-label": "disconnected",
     "x-anomaly-enabled": true,
     "x-anomaly-direction": "dominance",
+    "x-chart-priority": 20,
+    "x-chart-good-direction": "up",
   }),
   connectionTimeMs: healthResultNumber({
     "x-chart-type": "line",
@@ -73,6 +77,7 @@ const sshResultSchema = healthResultSchema({
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 50,
     "x-anomaly-min-relative-delta": 0.5,
+    "x-chart-priority": 10,
   }),
   error: healthResultString({
     "x-chart-type": "status",
@@ -97,6 +102,7 @@ const sshAggregatedFields = {
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 50,
     "x-anomaly-min-relative-delta": 0.5,
+    "x-chart-priority": 10,
   }),
   maxConnectionTime: aggregatedMinMax({
     "x-chart-type": "line",
@@ -107,6 +113,8 @@ const sshAggregatedFields = {
     // already covers sustained latency regressions, so keep this off by default
     // (still chartable for tail-latency inspection).
     "x-anomaly-enabled": false,
+    "x-chart-priority": 30,
+    "x-chart-good-direction": "down",
   }),
   successRate: aggregatedRate({
     "x-chart-type": "gauge",
@@ -118,6 +126,7 @@ const sshAggregatedFields = {
     // of real movement before alerting.
     "x-anomaly-confirmation-window": 3,
     "x-anomaly-min-absolute-delta": 5,
+    "x-chart-priority": 20,
   }),
   errorCount: aggregatedCounter({
     "x-chart-type": "counter",
@@ -127,6 +136,8 @@ const sshAggregatedFields = {
     // volume rather than with a real problem. Availability is already covered
     // by successRate (the percent form), so prefer that and keep this off.
     "x-anomaly-enabled": false,
+    "x-chart-priority": 90,
+    "x-chart-good-direction": "down",
   }),
 };