@checkstack/satellite-frontend 0.3.8 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +105 -0
  2. package/package.json +13 -13
  3. package/src/components/CreateSatelliteDialog.tsx +56 -4
  4. package/src/index.tsx +8 -15
  5. package/src/components/SatelliteMenuItems.tsx +0 -30
package/CHANGELOG.md CHANGED
@@ -1,5 +1,110 @@
1
1
  # @checkstack/satellite-frontend
2
2
 
3
+ ## 0.4.1
4
+
5
+ ### Patch Changes
6
+
7
+ - Updated dependencies [13373ce]
8
+ - @checkstack/common@0.14.0
9
+ - @checkstack/frontend-api@0.7.1
10
+ - @checkstack/gitops-common@0.6.1
11
+ - @checkstack/gitops-frontend@0.5.1
12
+ - @checkstack/satellite-common@0.8.1
13
+ - @checkstack/tips-frontend@0.3.1
14
+ - @checkstack/ui@1.13.1
15
+ - @checkstack/signal-frontend@0.2.1
16
+
17
+ ## 0.4.0
18
+
19
+ ### Minor Changes
20
+
21
+ - 9dcc848: Cut initial-load JS: lazy plugin contributions, a hardened lazy-by-default contribution contract, on-demand Monaco, and a lighter icon/chart load.
22
+
23
+ - Lazy plugin route pages: each plugin's route `element` references a `React.lazy`-wrapped page rendered inside a shared `<Suspense>` boundary. Plugins still register synchronously, so nav, slots, commands, API factories, and `foreignSignals` are available on first paint. This moves ~37 route-page chunks (~600 KB) out of the entry; the entry chunk drops from ~2.4 MB to ~190 KB. Auth flow pages stay eager. The `@checkstack/scripts` scaffold template generates lazy route pages too.
24
+ - Hardened contribution contract (BREAKING, frontend plugin contract): plugins declare contributions lazily and let the framework own code-splitting, Suspense, and per-plugin error isolation. Routes use `load: () => import("./Page").then((m) => ({ default: m.Page }))` instead of `element: <Page />` (`element` is still accepted for the rare page that must paint without a chunk fetch; provide exactly one). Slot extensions accept either an eager `component` or a lazy `load`; new `getLazyContribution` + `ExtensionComponent` exports from `@checkstack/frontend-api` render either kind. This also fixes runtime-installed plugins: `ExtensionSlot` subscribes to the plugin registry, and the API registry rebuilds when the plugin set changes (`getPlugins()` returns an immutable snapshot via `useSyncExternalStore`). A per-plugin error boundary contains a bad contribution.
25
+ - On-demand Monaco: the `@checkstack/ui` barrel no longer pulls the `@codingame/*` / `monaco-languageclient` stack into the initial load. `CodeEditor` lazy-loads its Monaco-backed editor behind `React.lazy` + Suspense, `validateTypeScriptSources` imports the editor API via in-body `await import(...)`, and the "vscode services ready" signal moved to a Monaco-free module. The ~10 MB editor body loads only when a `CodeEditor` mounts. A `react-vendor` `manualChunks` split was added for stable vendor caching.
26
+ - lucide-react 1.x + lighter icons/charts (BREAKING for icon consumers): lucide-react unified from three drifting ranges to `^1.17.0`. lucide v1 removed brand icons, so the GitHub/GitLab marks are vendored in `@checkstack/ui` (`GithubIcon`, `GitlabIcon`, `brandIcons`); a new `IconName` type (`LucideIconName | BrandIconName`) in `@checkstack/common` is canonical, accepted by `AuthStrategy.icon` and the card components, so data-driven brand names keep working. `DynamicIcon` no longer eagerly imports lucide's ~1600-icon map (~1 MB) - it lives in a `React.lazy` `iconRegistry` chunk fetched on first data-driven render, while statically named-imported icons tree-shake normally. The recharts-backed health-check charts (~300 KB) and the `HealthCheckSystemOverview` drawer leave the initial load.
27
+
28
+ BREAKING CHANGES:
29
+
30
+ - Frontend plugin contract: routes/slot contributions are lazy-by-default (`load` instead of `element`/eager elements) as described above.
31
+ - Any external consumer importing a brand icon from `lucide-react` (e.g. `import { Github } from "lucide-react"`) must switch to the vendored `@checkstack/ui` brand icons or a custom SVG.
32
+
33
+ This is a beta minor.
34
+
35
+ - 9dcc848: Align workspace dependency versions and migrate React Router to v7.
36
+
37
+ BREAKING CHANGES (React Router v7): All frontend packages now depend on `react-router-dom@^7.16.0`. Previously the workspace declared four divergent ranges (`^6.20.0`, `^6.22.0`, `^7.1.1`, `^7.14.2`), which resolved both `react-router@6` and `react-router@7` into a single bundle. Everything is now unified on v7. The public imports the app uses (`BrowserRouter`, `Routes`, `Route`, `Link`, `NavLink`, `MemoryRouter`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`) are unchanged between v6 and v7, so no source rewrites were required - but any out-of-tree plugin still on react-router v6 should upgrade to v7 (see the React Router v6 -> v7 upgrade guide) to share the host's single router instance via the import map.
38
+
39
+ Other unified ranges (no API change): `react` -> `^18.3.1`, the `@orpc/*` family (`contract`, `server`, `client`, `tanstack-query`, `openapi`, `zod`) -> `^1.14.4`, and `better-auth` -> `^1.6.13`.
40
+
41
+ Removed the pre-rename `@orpc/react-query` leftover from `@checkstack/frontend-api`; its `createRouterUtils` / `RouterUtils` / `ProcedureUtils` now come from `@orpc/tanstack-query` (the package already in use).
42
+
43
+ Stale in-range runtime deps pulled up to current published versions: `hono` `^4.12.23`, `@tanstack/react-query` (+devtools) `^5.100.14`, `date-fns` `^4.4.0`, `jose` `^6.2.3`, `tar` `^7.5.16`, `semver` `^7.8.1`, `@xyflow/react` `^12.11.0`.
44
+
45
+ ### Patch Changes
46
+
47
+ - 9dcc848: Assorted bug fixes and small hardening across the platform.
48
+
49
+ - announcement-backend: `updateAnnouncement` now invalidates the active-announcements and admin-list caches (it was missing the `invalidateAllActive` / `invalidateListAll` calls), so an edited announcement no longer stays stale up to the 45s TTL.
50
+ - anomaly-backend: anomaly/drift state transitions (confirmations, recoveries, self-resolutions) now log at `debug` instead of info/warn - they are already surfaced via the `ANOMALY_STATE_CHANGED` signal, so logging them louder just added noise; genuine failure paths stay `warn`.
51
+ - backend: the `/api/:pluginId/*` dispatcher now populates `requestHeaders` on the per-request RPC context, so a handler that re-enters the router as the originating user (e.g. an AI tool's user-scoped client) can forward the caller's session cookie / bearer - previously the loopback failed with "Authentication required". Guarded by a real end-to-end integration test. The HTTP server idle timeout is also raised (default 255s, configurable via `CHECKSTACK_SERVER_IDLE_TIMEOUT_SECONDS`, clamped 0-255, reset on each streamed chunk) so long AI chat SSE turns are not severed mid-stream.
52
+ - backend: a request for an unknown plugin id (`/api/<unknown>/...`) now returns `404 Not Found` instead of `500` (and logs at warn, not error, since it is a client request) - an unknown _procedure_ on a known plugin already 404'd. The in-app docs namespace `/checkstack/*` now serves Starlight's own `404.html` with a real 404 status for a missing doc, instead of falling through to the SPA catch-all and 200-ing the app shell. Both guarded by tests.
53
+ - automation-common: remove polynomial-time backtracking from `toShellEnvKey`'s underscore-trim (CodeQL `js/polynomial-redos`); a negative look-behind anchors the trailing run, keeping the trim linear.
54
+ - common + script-packages-common: the pure transport-safe sandbox-policy schema (`sandboxPolicySchema` and its sub-schemas + inferred types) moved to `@checkstack/common` (the neutral base), removing two inverted deps that existed only to reach the shape; `@checkstack/backend-api` continues to re-export it. The schema is no longer exported from `@checkstack/script-packages-common`. Pure refactor, no behavior change.
55
+ - catalog-backend: reject duplicate system names (a `CONFLICT` on create/rename, enforced by a pre-write check AND a new DB unique index on `systems.name`, migration 0004 which first resolves pre-existing duplicates by suffixing).
56
+ - catalog-frontend: detail-page cleanups (use `<NotFound />` not `<AccessDenied />` on the not-found branch, a readable key/value metadata list via `normalizeMetadata`, runtime locale via `formatDate`); and stop the browse view re-rendering on every health report (adopt a new statuses report only when a value actually changed, via `healthStatusesEqual`, so rows stay stable and interactive).
57
+ - healthcheck-backend: fix the daily-rollup retention step failing with an `ON CONFLICT` mismatch (SQLSTATE 42P10) after `environmentId` joined the `health_check_aggregates` unique constraint - the rollup now groups by (day, environmentId, sourceId) and uses a single exported conflict-target constant (`DAILY_AGGREGATE_CONFLICT_TARGET`) kept in lock-step with the schema by a unit test.
58
+ - automation-frontend: the service-account picker's "Learn more" links are now absolute URLs to the deployed Astro docs site (they 404ed as in-app relative paths). The Monaco script editor double-init crash is fixed (serialized cold init, a guarded `monacoGuard` accessor, theme/type effects gated on `apiReady`).
59
+ - auth-frontend: bound the desktop user-menu popover height (`max-h-[var(--radix-popover-content-available-height)]` + `overflow-y-auto`) so it no longer clips on short viewports, and fold the standalone `Account > Profile` item into a focusable name/email header (`profileHref` on `UserMenu`); the now-empty `Account` group no longer renders.
60
+ - satellite-frontend: picked up via the sidebar-nav migration (account-only user menu).
61
+
62
+ (Related UI fixes - the Monaco editor following the app theme, the `DynamicOptionsField` no-flash fix, the shared `Spinner`, GFM tables, and the user-menu popover bound - land their `@checkstack/ui` bump in the UI/perf changesets where `@checkstack/ui` is already minored.)
63
+
64
+ This is a beta patch.
65
+
66
+ - 9dcc848: Satellite deployments now ship with the script-sandbox flags they need, so script-based health checks run on satellites out of the box.
67
+
68
+ A satellite executes the same script checks as the core, so its container needs the same two runtime relaxations (`--security-opt seccomp=<tuned profile>` and `--security-opt systempaths=unconfined`). Without them the fail-closed sandbox refuses every script run - the satellite connects but script checks error. These flags were missing from every satellite deployment path.
69
+
70
+ - satellite-frontend: the "Satellite created" dialog now shows a complete, ready-to-run `docker run` deploy command (including both `--security-opt` flags and the seccomp-profile extract step) instead of just the three environment variables, with a warning that the flags are required for script checks and a link to the sandbox docs.
71
+ - The tuned seccomp profile is now bundled INSIDE the satellite image and exposed via a `print-seccomp` entrypoint subcommand (`docker run --rm <image> print-seccomp > checkstack-userns.json`). This is what makes the secure default work in air-gapped networks: the Docker daemon reads the profile from a host file at container-create time and a container cannot relax its own seccomp from the inside, so the operator must place the file before `docker run` - and now it travels with the image (no GitHub, no core round-trip), version-matched to the agent.
72
+ - New `docker-compose-satellite.yml` for standalone (remote-host) satellite deployments, with the flags and the extract step documented. The footgun commented-out satellite block in `docker-compose.yml` (which had no `security_opt`) was removed in favor of it.
73
+ - Docs: the "Connect a satellite" guide and the script-sandbox "Satellite runtime" section now cover the required flags, the offline profile extract, the bootstrap constraint, and the `unconfined` / `degrade` fallbacks.
74
+
75
+ This is a beta patch.
76
+
77
+ - 9dcc848: Move primary navigation into a left sidebar, and serve the user guide in-app.
78
+
79
+ Feature navigation (a ~20-item user-menu dropdown) now lives in a persistent left sidebar (a slide-over drawer on mobile), grouped by section with the active route highlighted; the user menu keeps only account actions. A route opts into the sidebar with new `nav` metadata (`{ group, icon, label?, order?, accessRule? }`) on its registration, co-located with path + access + title. The sidebar filters entries with the same access check as page guards. `@checkstack/common` gains `isAccessRuleSatisfied` and a centralized set of in-app doc slugs (`APP_DOC_SLUGS` + `docsPath`, with a test asserting each resolves to a real docs page); `@checkstack/auth-frontend` exports `useAccessRules`.
80
+
81
+ The backend now serves the Astro Starlight docs build same-origin at `/checkstack/*` (the same artifact deployed to GitHub Pages), so the user guide is available inside the app including for self-hosted / air-gapped installs (served verbatim, no rebuild, no link rewriting; from `CHECKSTACK_DOCS_DIST`, before the SPA catch-all, degrading gracefully when absent; the Docker image builds and ships `docs/dist`; Vite proxies `/checkstack` in dev). The "Docs" link is a shell-owned external sidebar entry under the Documentation group (book icon), opening `/checkstack/user-guide/` in a new tab; the group renders even when no plugin route contributes to it.
82
+
83
+ BREAKING (plugin authors): `UserMenuItemsSlot` is no longer the way to add navigation - registering a top user-menu item no longer surfaces it anywhere. Add `nav` to the page's route instead. `UserMenuItemsBottomSlot` (account items) is unchanged. All bundled plugins have been migrated.
84
+
85
+ This is a beta minor.
86
+
87
+ - Updated dependencies [9dcc848]
88
+ - Updated dependencies [9dcc848]
89
+ - Updated dependencies [9dcc848]
90
+ - Updated dependencies [9dcc848]
91
+ - Updated dependencies [9dcc848]
92
+ - Updated dependencies [9dcc848]
93
+ - Updated dependencies [9dcc848]
94
+ - Updated dependencies [9dcc848]
95
+ - Updated dependencies [9dcc848]
96
+ - Updated dependencies [9dcc848]
97
+ - Updated dependencies [9dcc848]
98
+ - Updated dependencies [9dcc848]
99
+ - @checkstack/ui@1.13.0
100
+ - @checkstack/common@0.13.0
101
+ - @checkstack/frontend-api@0.7.0
102
+ - @checkstack/gitops-frontend@0.5.0
103
+ - @checkstack/tips-frontend@0.3.0
104
+ - @checkstack/satellite-common@0.8.0
105
+ - @checkstack/gitops-common@0.6.0
106
+ - @checkstack/signal-frontend@0.2.0
107
+
3
108
  ## 0.3.8
4
109
 
5
110
  ### Patch Changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@checkstack/satellite-frontend",
3
- "version": "0.3.8",
3
+ "version": "0.4.1",
4
4
  "license": "Elastic-2.0",
5
5
  "type": "module",
6
6
  "main": "src/index.tsx",
@@ -13,21 +13,21 @@
13
13
  "lint:code": "eslint . --max-warnings 0"
14
14
  },
15
15
  "dependencies": {
16
- "@checkstack/common": "0.12.0",
17
- "@checkstack/frontend-api": "0.6.0",
18
- "@checkstack/satellite-common": "0.6.0",
19
- "@checkstack/signal-frontend": "0.1.5",
20
- "@checkstack/gitops-common": "0.4.2",
21
- "@checkstack/gitops-frontend": "0.4.6",
22
- "@checkstack/tips-frontend": "0.2.6",
23
- "@checkstack/ui": "1.11.0",
24
- "lucide-react": "^0.344.0",
25
- "react": "^18.2.0",
26
- "react-router-dom": "^6.20.0"
16
+ "@checkstack/common": "0.13.0",
17
+ "@checkstack/frontend-api": "0.7.0",
18
+ "@checkstack/satellite-common": "0.8.0",
19
+ "@checkstack/signal-frontend": "0.2.0",
20
+ "@checkstack/gitops-common": "0.6.0",
21
+ "@checkstack/gitops-frontend": "0.5.0",
22
+ "@checkstack/tips-frontend": "0.3.0",
23
+ "@checkstack/ui": "1.13.0",
24
+ "lucide-react": "^1.17.0",
25
+ "react": "^18.3.1",
26
+ "react-router-dom": "^7.16.0"
27
27
  },
28
28
  "devDependencies": {
29
29
  "@checkstack/tsconfig": "0.0.7",
30
- "@checkstack/scripts": "0.3.4",
30
+ "@checkstack/scripts": "0.4.0",
31
31
  "@types/react": "^18.2.0",
32
32
  "typescript": "^5.0.0"
33
33
  }
package/src/components/CreateSatelliteDialog.tsx CHANGED
@@ -88,8 +88,29 @@ export const CreateSatelliteDialog: React.FC<Props> = ({
88
88
  }
89
89
  };
90
90
 
91
- // After creation, show credentials
91
+ // After creation, show credentials + a ready-to-run deploy command.
92
92
  if (credentials) {
93
+ // A satellite executes script checks in a FAIL-CLOSED sandbox, so its
94
+ // container needs the same two relaxations as the core (`--security-opt`);
95
+ // without them script checks are refused. The tuned seccomp profile is read
96
+ // by the Docker daemon from a host file at start, so we extract it from the
97
+ // image first (works offline / air-gapped - it ships inside the image).
98
+ const deployCommand = [
99
+ "# 1. Extract the sandbox seccomp profile from the image (one-time, works offline):",
100
+ "docker run --rm ghcr.io/enyineer/checkstack-satellite:latest \\",
101
+ " print-seccomp > checkstack-userns.json",
102
+ "",
103
+ "# 2. Start the satellite:",
104
+ "docker run -d \\",
105
+ " --name checkstack-satellite \\",
106
+ " --restart unless-stopped \\",
107
+ " --security-opt seccomp=checkstack-userns.json \\",
108
+ " --security-opt systempaths=unconfined \\",
109
+ " -e CHECKSTACK_CORE_URL=<your-core-url> \\",
110
+ ` -e CHECKSTACK_SATELLITE_CLIENT_ID=${credentials.clientId} \\`,
111
+ ` -e CHECKSTACK_SATELLITE_TOKEN=${credentials.token} \\`,
112
+ " ghcr.io/enyineer/checkstack-satellite:latest",
113
+ ].join("\n");
93
114
  return (
94
115
  <Dialog open={open} onOpenChange={handleClose}>
95
116
  <DialogContent>
@@ -152,10 +173,41 @@ export const CreateSatelliteDialog: React.FC<Props> = ({
152
173
  </div>
153
174
 
154
175
  <div className="grid gap-2 mt-2">
155
- <Label>Environment Variables</Label>
156
- <pre className="rounded-md bg-muted p-3 text-xs font-mono overflow-x-auto">
157
- {`CHECKSTACK_CORE_URL=<your-core-url>\nCHECKSTACK_SATELLITE_CLIENT_ID=${credentials.clientId}\nCHECKSTACK_SATELLITE_TOKEN=${credentials.token}`}
176
+ <div className="flex items-center justify-between">
177
+ <Label>Deploy command</Label>
178
+ <Button
179
+ variant="ghost"
180
+ size="sm"
181
+ onClick={() =>
182
+ void copyToClipboard(deployCommand, "Deploy command")
183
+ }
184
+ >
185
+ <Copy className="mr-2 h-4 w-4" />
186
+ Copy
187
+ </Button>
188
+ </div>
189
+ <pre className="rounded-md bg-muted p-3 text-xs font-mono overflow-x-auto whitespace-pre">
190
+ {deployCommand}
158
191
  </pre>
192
+ <div className="rounded-md border border-warning/50 bg-warning/10 p-3 flex items-start gap-2">
193
+ <AlertTriangle className="h-4 w-4 text-warning mt-0.5 shrink-0" />
194
+ <p className="text-sm text-warning">
195
+ The two <code>--security-opt</code> flags are required: a
196
+ satellite runs script-based health checks in a fail-closed
197
+ sandbox and will refuse to execute them without these
198
+ relaxations. If you cannot ship the profile file, use{" "}
199
+ <code>--security-opt seccomp=unconfined</code> instead.{" "}
200
+ <a
201
+ href="/checkstack/developer-guide/security/script-sandbox/"
202
+ target="_blank"
203
+ rel="noreferrer"
204
+ className="underline"
205
+ >
206
+ Learn more
207
+ </a>
208
+ .
209
+ </p>
210
+ </div>
159
211
  </div>
160
212
  </div>
161
213
 
package/src/index.tsx CHANGED
@@ -1,32 +1,25 @@
1
- import {
2
- createFrontendPlugin,
3
- createSlotExtension,
4
- UserMenuItemsSlot,
5
- } from "@checkstack/frontend-api";
1
+ import { createFrontendPlugin } from "@checkstack/frontend-api";
6
2
  import {
7
3
  satelliteRoutes,
8
4
  pluginMetadata,
9
5
  satelliteAccess,
10
6
  } from "@checkstack/satellite-common";
11
- import { SatelliteListPage } from "./pages/SatelliteListPage";
12
- import { SatelliteMenuItems } from "./components/SatelliteMenuItems";
7
+ import { Satellite } from "lucide-react";
13
8
 
14
9
  export default createFrontendPlugin({
15
10
  metadata: pluginMetadata,
16
11
  routes: [
17
12
  {
18
13
  route: satelliteRoutes.routes.list,
19
- element: <SatelliteListPage />,
14
+ load: () =>
15
+ import("./pages/SatelliteListPage").then((m) => ({
16
+ default: m.SatelliteListPage,
17
+ })),
20
18
  title: "Satellites",
21
19
  accessRule: satelliteAccess.satellite.read,
20
+ nav: { group: "Reliability", icon: Satellite },
22
21
  },
23
22
  ],
24
23
  apis: [],
25
- extensions: [
26
- createSlotExtension(UserMenuItemsSlot, {
27
- id: "satellite.user-menu.items",
28
- component: SatelliteMenuItems,
29
- metadata: { group: "Reliability" },
30
- }),
31
- ],
24
+ extensions: [],
32
25
  });
package/src/components/SatelliteMenuItems.tsx DELETED
@@ -1,30 +0,0 @@
1
- import React from "react";
2
- import { Link } from "react-router-dom";
3
- import { Satellite } from "lucide-react";
4
- import type { UserMenuItemsContext } from "@checkstack/frontend-api";
5
- import { DropdownMenuItem } from "@checkstack/ui";
6
- import { resolveRoute } from "@checkstack/common";
7
- import {
8
- satelliteRoutes,
9
- satelliteAccess,
10
- pluginMetadata,
11
- } from "@checkstack/satellite-common";
12
-
13
- export const SatelliteMenuItems = ({
14
- accessRules: userPerms,
15
- }: UserMenuItemsContext) => {
16
- const qualifiedId = `${pluginMetadata.pluginId}.${satelliteAccess.satellite.read.id}`;
17
- const canRead = userPerms.includes("*") || userPerms.includes(qualifiedId);
18
-
19
- if (!canRead) {
20
- return <React.Fragment />;
21
- }
22
-
23
- return (
24
- <Link to={resolveRoute(satelliteRoutes.routes.list)}>
25
- <DropdownMenuItem icon={<Satellite className="w-4 h-4" />}>
26
- Satellites
27
- </DropdownMenuItem>
28
- </Link>
29
- );
30
- };