The page at /peer/assistant-access read its peer, WireGuard key and rules
from the URL and, once the forced sign-in came back, granted temporary SSH
access without asking anything further. The sign-in proves a person is
present; it does not prove they meant to grant that key access to that
machine. A link mailed to an admin was therefore enough: click, sign in to
a prompt you recognise, and a key you have never seen lands on the network.
Two checks close it, both before the sign-in so a link never gets to borrow
an identity provider's credibility:
The opener now mints a nonce into sessionStorage before calling
window.open, and the page refuses to grant anything without it. A window
opened from the panel inherits a copy of that storage; a window reached by
following a link does not. It is spent before the POST, so a reload or a
Back inside the window cannot grant twice, and dropped on every path that
settles the request.
The rules are checked against the set this flow may ask for rather than
passed through as given — tcp/3389 would be RDP, not SSH. A test drives the
executor across its version thresholds and asserts every rule it produces
is one the page accepts, since the two halves live in different files and
drift either way is silent.
Also drops the "eve" codename from assistant comments and test names, and
removes an eslint ignore for an assistant/ directory and CI workflow that
no longer exist.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The browser half of `ssh_run_command`. It resolves the peer against the real
peer list, then blocks: one prompt asks for the command and, the first time for
a peer, the sign-in that authorizes it. Both questions at the same moment,
which eve's own `approval` cannot do — it parks a call before it runs, so it
could only ever ask about the command and leave the sign-in as a surprise
afterwards.
The executor now reports what it is waiting on, because the trail row's label
comes from the tool name and reads "Running a command" through the whole
stretch in which nothing is running and the assistant is waiting on a person.
The authorization window closes itself once the grant lands. It kept a Close
button for a window whose job was done; the button now appears only if the
browser refuses to close it.
Also widens the wasm ignore rule, which matched an exact path and so let a
47MB `.bak-pre-exec` sibling be staged for commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The canvas half of the same change: a new policy carries its protocol and ports
from birth, so it is never briefly drawn as a rule open to everything while a
second write narrows it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Radix sizes a ScrollArea's content box with `display: table`, so an item wider
than the rail — a long label with a badge, which `whitespace-nowrap` forbids
wrapping — widened the box and the rail grew a horizontal scrollbar. The rail's
width is fixed, so that overflow is something to clip, never something to
scroll.
Also adds the shared table column breakpoints, so columns drop in a stated
order rather than each table deciding for itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
useAssistant has exposed pendingInput and respondToInput for a while and
nothing rendered them. eve parks a session on an input request — a tool
approval, a runtime limit — and answers nothing until one comes back,
including every message sent after it. Unrendered, that is a chat that stops
replying with no error and no way to tell it apart from a hang.
AssistantApprovalCard takes the composer's place while a pause is open, rather
than floating above it: the box you would have typed into is exactly the thing
that should not be there. It titles itself from TOOL_MANIFEST so the prompt
reads in the same words as the rest of the thread, orders the choices deny-left
and allow-right so the key bound to Enter and the button a pointer lands on are
the same one, and latches after the first answer because the session is parked
until it lands.
The activity rows had three faults that only showed up while watching a tool
actually run:
- A row kept its spinner after the call failed, because "running" came from
the runtime's last word rather than from having a result in hand. A result
now outranks the status, and a finished call always ends with a mark: a tick
when it worked, an info circle when it did not.
- The working indicator is one status line shared by the thread but rendered
per message, so a turn that left an earlier message unfinished stacked
"Thinking…" once per message. Only the last message may claim it.
- The copy button reserved a row of height under messages that were all tool
calls and had nothing to copy, which is what opened the gap between the last
step and the working line. It now appears only where there is an answer, and
tool-only messages are spaced as the work they are rather than as replies.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Pick a private-capable proxy cluster when bootstrapping the agent network
The connect-provider wizard bootstraps the account's agent network
endpoint from a proxy cluster it auto-picks off /reverse-proxies/domains,
taking the first validated free domain. That list includes clusters that
cannot host the endpoint: the endpoint is a private service, reachable
only from connected peers and authorised by their tunnel identity, which
needs a cluster with at least one connected embedded proxy — the same
supports_private flag the Reverse Proxy modal gates NetBird-Only Access
on. Management refuses a bootstrap onto a cluster reporting it false, so
the wizard could propose a pick the API rejects, and the endpoint it
assigns is immutable.
Filter the candidates on supports_private before auto-picking, and give
the "nothing to pick" callout a second message for the case where
clusters exist but none of them has an embedded proxy — a different
problem from having no proxy at all, and a different fix.
Only an explicit false disqualifies a cluster: a management build that
predates the flag reports nothing at all, and dropping every cluster
there would block setup on a backend that would have accepted it.
Callout takes an optional data-testid so a spec can assert on the state
it announces rather than on its copy.
* Derive the bootstrap cluster instead of holding it in state
Nothing picks the bootstrap cluster: there is no selector, so the state
could only ever mirror the first usable entry of the domains list, with
an effect writing it back on arrival and a render pass to show it. Derive
it from that list instead, which drops the state, the effect and the two
resets that kept them in sync.
* Declare the e2e proxy private so a bootstrap cluster exists
The connect-provider wizard now offers only clusters whose proxies report
the private capability, because the agent network endpoint is a private
service and management refuses to bootstrap it anywhere else. The e2e
environment's reverse-proxy ran with NB_PROXY_PRIVATE at its default of
false, so with that filter in place no cluster qualified: the wizard
showed the no-cluster callout, Continue stayed disabled, and every spec
that walks through the wizard failed on the Models tab it could no longer
reach — agentgateway, Kimi and the refused-save spec.
Declare the capability on the primary proxy. The no-ports proxy stays
centralised, so the pick also has to skip past a cluster that does not
qualify, which is the case the wizard filter exists for.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
* Send the no-cluster callout to the agent network Clusters section
The callout told users to connect a proxy under Reverse Proxy, the generic
services page. Agent Network has its own Clusters tab under Configuration,
which is where a user setting up the agent network expects to manage the
clusters it runs on, so both messages link there instead. The tab and the
callout gate on the same permission (services read), so every role that
sees the callout can follow the link.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
* Say private capabilities, not embedded proxy, in the no-cluster callout
The requirement is a cluster with private capabilities, which is what the
supports_private flag reports. Tying the message to an embedded proxy named
one way of getting there as if it were the requirement itself, and pointed
users at the wrong fix. The callout now states the requirement and where to
connect such a cluster.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Disabled routing peers, network resources, policies and legacy routes were
only distinguishable by a faded row, and the fade also dimmed the controls
needed to re-enable them. Bring back the Active toggle column that was
hidden in #654, and add a cellClassName hook to DataTable with a shared
fadeDisabledRowCells helper that fades every cell of a disabled row except
the toggle and actions cells.
Bump next from 16.3.0 to 16.3.4 and refresh the transitive lockfile
entries that came with it (@next/* swc binaries, sharp 0.35.4,
rolldown, vitest, playwright).
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove the unreachable FirewallGPT module and the abandoned traffic-event
detail prototypes, along with the dependencies they were the sole consumers of.
FirewallGPT was disabled in 9d8d9ee4 by removing its trigger button, leaving
the modal mounted but impossible to open. TrafficEventDetails was never
imported anywhere, and it was the only consumer of TrafficEventChart.
Dependency changes:
- Drop @faker-js/faker, whose only usage was mock chart data in the removed
TrafficEventChart. This also resolves GHSA-qxc2-j82w-r537 without needing
the 9 -> 10 major upgrade.
- Drop react-confetti-explosion, only used by the removed
FirewallGPTSuccessModal.
- Bump @types/node to 20.19.43 so it satisfies the peer range of the vite
version pulled in by vitest, silencing an ERESOLVE warning on install.
Stays on the 20.x line to match the Node 20 used in CI.
- Add an allowScripts deny policy for the four packages with install scripts.
Both @axa-fr postinstalls are bare echo statements, fsevents ships a
prebuilt binary, and the unrs-resolver postinstall only verifies a binding
that optionalDependencies already installs.
Surfaces the two bundle parameters added to the management API: an
anonymization level (Default/Strict, shown when anonymization is enabled)
and an optional upload service URL that overrides the default upload
server. The upload URL is validated as an https URL before the job can be
submitted; both fields are omitted from the request when left at their
defaults so the peer applies its own.
Stabilize the flaky Control Center and agentgateway e2e specs (#788)
Three separate causes behind the recent e2e failures.
The group view ranked every group in the account by peer count to decide what
to display, so with two workers it could land on a group another spec had just
created. openGroupView() selects the group by name instead.
Management now checks a provider's upstream URL when the provider is saved and
rejects it unless the URL returns a model list, so the agentgateway spec's
placeholder host stopped working. The test environment runs a stub that answers
the check.
The Backspace test blurred the group panel's search input before that input had
taken focus, so it reclaimed focus and swallowed the key.
The peer view matched policies only by source group membership, so a
policy whose source is the peer itself never appeared in that peer's
view. There was no group fallback either: a rule carrying a
sourceResource has its sources nulled on save, so the group check could
only ever return false for exactly these policies.
Such policies are reachable from the canvas itself, since dragging a
connection off a peer node writes a sourceResource rather than a group.
A user could create a peer-sourced policy, deploy it, drill into that
same peer and not see it.
Match rule.sourceResource against the peer id alongside the group check.
The rendering side needs no change, as select-peer-node is the peer and
its edge to the policy is drawn unconditionally. Draft mode is fixed
transitively: useDraft harvests visible policies from the live view's
nodes, and already draws a sourceResource peer as a source card.
A refused save closed the modal anyway, throwing away the key just typed — and
the API never returns one. Both paths now stop before closing. The failure was
also reported twice and, because notify() only reddens through its promise path,
both times as a success.
Load and submit now spin, say what they are waiting on, and stop taking clicks;
dismissal is refused mid-save, since the write lands regardless and would
otherwise close a session reopened in the meantime.
Discovery carries the record id and the form's URL together, so changing an
endpoint no longer demands the key back. A 422 from it was reported as
unreachable rather than unsupported — useApiCall rejects with { code, message }
and the hook read status, leaving the catalog fallback unreachable.
Discovered models arrived at zero: 0/0 was hardcoded for anything the catalog
lacked by exact id, which stopped being true once discovery returned real rates.
Bedrock felt all of it — its geography-prefixed ids never match by string.
A Playwright spec covers the refusal end to end.
* Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule
The management server now ships two delegated roles (agent_network_admin,
usage_viewer) and reports agent_network submodule permissions
(agent_network.providers, .policies, .usage, .logs, .settings, ...) in
/users/current. The dashboard still gated the whole Agent Network section
on services.read, so the new roles saw either everything or nothing.
- register the agent_network module keys so PermissionsProvider fills
denied defaults and typed lookups work
- gate the Agent Network sidebar and pages per submodule: providers,
policies, usage (usage or logs read), configuration (settings)
- show the section when any child is permitted instead of services.read
- add both roles to the role selector, user/invite tables and badges
* Gate Usage and Clusters tabs by their own permissions
A caller holding only agent_network.logs.read landed on the Usage tab it
cannot read, and one holding only agent_network.usage.read could open
Access Logs. Show each tab only with its matching read permission and
fall back to the first permitted tab on deep links.
The Clusters tab is a reverse-proxy surface: its table and controls run
on the services permission, so agent_network.settings alone (e.g.
agent_network_admin) no longer surfaces it.
* Fall back to a known configuration tab for unknown query values
An unknown ?tab= value selected no content pane and left the
configuration page blank; unknown or unauthorized values now fall back
to Global Limits.
* Derive the configuration tab from the URL query
The ?tab= query was mirrored into local state through an effect, which
can lag a render behind the URL and duplicates the source of truth.
Derive the active tab from the query directly; trigger clicks already
push the query themselves, and onChange keeps pushing it for Radix's
keyboard navigation, which fires without a click.
* Derive the usage tab from the URL query
Same treatment as the configuration page: the ?tab= query was mirrored
into local state through an effect, duplicating the source of truth.
Derive the active tab from the query; onTabChange keeps pushing it so
clicks, deep links and back/forward all resolve the same way.
* Group user roles into General and Agent Network tabs
Tab the role dropdown by product surface, gate the Agent Network
roles and tab on the Agent Network surface being available, and
disable the role field for the owner unless the caller is an owner.
* Point agent network learn-more links at their docs pages
* Skip the domains lookup when the role can't read it
* Flatten the role selector and add a caller-scoped My Setup page
The role dropdown split General and Agent Network roles into tabs,
which reads as two products inside one field. Return to the single
flat list from main, keeping the surface gate (Agent Network roles
hidden when the surface is unavailable) and the owner protections.
Regular users had no way to see which providers and models their
policies allow or where to point their tools. Add
/agent-network/my-setup backed by the caller-scoped me/setup and
me/consumption endpoints: the endpoint with copy, per-provider
available models, the Configure Your Agent instructions flattened
inline from the connect modal, and the caller's own usage counters.
The sidebar surfaces it for any role — limited view included —
whenever the caller's setup is configured, and stays hidden when
not, which is indistinguishable from no access by design.
* Fix delegated-role API errors and reuse the usage overview for My Usage
Field testing surfaced three problems. The policy and budget modals'
group selector fetched /networks/resources unconditionally, so an
agent_network_admin without the networks permission got a 403 and an
error toast on the policies page; gate the fetch on networks read.
Restricted users got no navigation at all, so the limited view could
never reach My Setup; render the sidebar for restricted users when
their setup is configured or their role reads an agent_network surface.
Roles below account admin also cannot read the account feature flag
(accounts read), so holding an explicit agent_network grant now counts
as proof the surface exists, while callers with accounts read keep the
flag as the source of truth.
My Usage rendered raw per-window counter rows, nothing like the admin
usage view; render it with the same chart-and-table component as the
admin overview, fed from the caller-scoped me/usage/overview endpoint
that returns the identical bucket shape filtered to the current user.
* Reuse the providers-page agent config on My Setup and self-scope Usage & Logs
My Setup now presents the endpoint exactly like the providers page — the
API Base URL badge with Copy and Agent Config opening the same modal
(provider ids come from the caller's me/setup answer instead of the
admin-permissioned provider context) — and drops the My Usage tab: the
regular Usage & Logs page now serves callers without the account-wide
grants too, showing their own data (the server pins the filters to them),
with the identity and provider filters trimmed since they'd be overridden.
usage_viewer gets working filters: the feature-flag fallback moves into
useAgentNetworkMode, AIProvidersProvider gates each fetch on its
submodule read grant so partially-granted roles don't fire 403s, and
GroupsProvider serves restricted roles that hold the groups read grant.
The limited view also gains the Peers link (the add-your-device page).
* Hide provider write actions from read-only viewers
usage_viewer now reads the provider list, but the page still offered every
write flow: Connect Provider, row-click edit, and the enable/disable/delete
menu. Clicking any of them opened the wizard, which - unable to read the
settings row - warned that Agent Network isn't set up even on configured
accounts. Each action is now gated on its own operation grant: the connect
button needs providers create, row-click edit needs update, and the menu
items need update/delete respectively (no menu at all without either).
* Restore the grouped role selector tabs
Bring back the General and Agent Network tabs in the role dropdown
from 3fbeb1e, undoing the flattening: the tabbed grouping keeps the
list readable as more surfaces ship their own delegated roles. The
surface gate (Agent Network roles hidden when the surface is
unavailable) and the owner protections are unchanged.
* Offer the provider and model filters to self-scoped callers
The providers endpoint now self-scopes on the server, so a configured
plain user fetches it too and the caller's own authorized providers back
the Provider and Model filter options on the self-scoped Usage & Logs
view. The identity filters stay hidden — the server pins user and group
to the caller regardless.
* Give the agent config a single home on Connect Agent
The endpoint card carried an Agent Config action on both the providers
page and the caller-scoped self-service page, so the same connect
snippets had two entry points. EndpointBadge now renders it only when
the caller passes providerIds, which is just the self-service page; the
providers page keeps the URL and Copy. The context-backed
AgentConnectModal wrapper is then unused, so it goes.
Rename that page from My Setup to Connect Agent in the sidebar,
breadcrumb and heading: My Setup was the only first-person label in the
navigation, and Connect Agent stays clear of the Configuration sibling.
* Simplify Bedrock config
* Inline the agent config on the Connect page
Drop the Agent Config modal: its snippets now render inline under the
endpoint card, so AgentConnectModal is just AgentConnectTabs and
EndpointBadge is back to the URL and Copy. Move the route to
/agent-network/connect and swap the hand-rolled provider list for the
standard DataTable. Follow the backend rename of me/setup to
agent-config.
* Show a policy's allowed models in the policies table
A policy's model restrictions live on the guardrails attached to it, so
the new Models column unions the enabled model allowlists: one chip for
a single model, a count with the names on hover past that, and a
Restrict badge opening the guardrails tab when nothing narrows the
policy. Clicking the column lands on that tab too.
Chip the models on the Connect Agent table instead of comma-joining
them, and capitalize the model counts across all three tables to match
the "2 Groups" chips on Peers.
* Point the Kimi e2e config assertions at the Connect Agent page
The Kimi-gated config surfaces moved: the Agent Config modal is gone and
the snippets render inline on /agent-network/connect, so the spec stopped
finding the button it used to click on the providers page. Navigate to the
Connect page instead.
That page's answer is caller-scoped — it only offers providers the
caller's own policies authorize — so the spec now grants the owner the
freshly connected provider through a dedicated group + policy, torn down
again (group detached from the owner first) before and after the run. The
backing GET /agent-network/agent-config ships with newer management
builds; on builds that predate it the suite skips, same as the existing
catalog and settings-bootstrap probes.
* Hand the agent config to every account member
The agent-config answer withheld the endpoint from callers no policy
covers, so "account not set up" and "you have no access" were the same
shape. The dashboard shows every user the same connection config, so
Configured now tracks the account: once it has an endpoint every member
gets it, with an empty providers list for those no policy covers. That
list stays caller-scoped, and the endpoint authorizes nothing on its own
since the gateway still refuses every request no policy permits.
Rename the files and symbols the endpoint outgrew when it became
/agent-network/agent-config: me_handler.go, setup.go and types/setup.go
become agent_config.go, GetSetupForUser becomes GetAgentConfigForUser,
and the AgentNetworkMeSetup schema becomes AgentNetworkAgentConfig.
Regenerating types.gen.go from the untouched spec first reproduced it
byte for byte, so the generated diff is only these renames.
* Let the surface switch decide the Agent Network section
Connect Agent and Usage & Logs were visible on the caller's own setup
alone, so a deployment with Agent Network off still showed them, and the
route tree then 404d the links the nav had just rendered. The switch now
decides first.
The caller's agent config still stands in for the switch, but only for
callers who cannot read the config themselves - otherwise an account
holding an endpoint kept the surface on for its owner regardless.
* Collapse the two User types the merge left behind
Both sides of the merge declared a User type, in different regions of the
helper, so the merge took both without ever reporting a conflict and
Playwright refused to parse the file. One type now carries the union of
the fields the /users answer returns.
* Fix SNAPSHOT version display
* Fix e2e tests
* Fix e2e tests
* Fix version display
* Fix e2e
* Fix e2e
* Fix e2e
---------
Co-authored-by: braginini <bangvalo@gmail.com>
The assistant backend (assistant/) and the dashboard-side agent runtime,
tool definitions, and canvas agent store all moved into the assistant
repo and now ship as a packed SDK consumed from ./vendor. The dashboard
keeps only what is genuinely app-specific.
- Drop assistant/ and its CI workflow, plus the local runtime, tool
registry, redaction/PII helpers, and canvasAgentStore that the SDK
now owns.
- Keep openPageExecutor app-side: only the dashboard knows its own
routes. executorParity.test.ts asserts every client tool in the SDK
manifest has an executor, and that we register none the manifest
doesn't dispatch to the client.
- Add usePageContextString so page context is read at send time through
a ref, since the getter is captured once per conversation.
- Swap the ai-sdk/zustand deps for the vendored SDK, transpile it in
next.config.js, and pin the assistant-ui paths in tsconfig so the app
and the SDK resolve one copy.
- gitignore vendor/: the tarballs are packed by scripts, not committed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add multi-select bulk deletion for Access Control groups
* Add indeterminate group selection and permission-safe column visibility
* Background rule for checkbox component
* Better show when disabled
Every conflicted file is byte-identical between main and the already
merged PR #744 branch, so the previous merge's resolutions stand as-is.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Main squashed this branch as #744, which made a direct merge of main
produce ~150 add/add conflicts with no usable base. Merging the real
PR branch first gives git the shared history; main follows on top.
Both sides evolved the control center in parallel after this branch
last synced. Resolution policy: the PR's later fixes (deploy integrity,
group-deletion cascade, install-peer lifecycle, artifact teardown,
resourceEnabled split) become the new base; this branch's features
(assistant bridge, routers on placeholder peers, pendingInstall rows,
group-panel canvas offers) are re-applied on top of them. Where the PR
had blocked editing placeholder-bound routers as a stopgap, the full
placeholder support wins, and its unit test now pins the new behavior.
Fixes ported across the seam: the resource-enabled toggle in
useDraftNodeActions adopts the live-baseline semantics, useAutoArrange
writes through the ReactFlow instance instead of useCanvasState, and
useDraftGroupActions regains an unconfirmed deleteGroup for the
assistant path over the new cascade-aware deleteGroups.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The generated Docker command used --rm, which removes the container on
stop. Combined with -d, the NetBird client would not survive a host
reboot despite the persistent netbird-client volume. Replace with
--restart=unless-stopped so the client reconnects automatically.
The peer view is the control center's entry default, but a deploy
exited back to whatever view the draft was entered from. exitAfterDeploy
now routes through onViewChange(PEERS), which also resets the layout,
clears selections and drops the ?tab= param. Cancel/discard still
returns to the previous view since nothing landed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The control center's peers empty state kept the Card's gray background
and border while the network empty states stripped them, because
showBackground only toggled the skeleton filler inside the card. Every
showBackground={false} caller also wants a transparent card, so fold
the two knobs: the flag now drops the card chrome too, and the separate
cardClassName prop is gone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix typo in PeerExpirationToggle component
* Fix the same typo in PeerActionCell
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add a workflow bumping the WASM client on netbird releases
* Cover the pinned WASM client with an instantiation test
* Connect the pinned WASM client to management in the e2e suite
* Validate the dispatched tag before it reaches the shell and satisfy lint
* Sort the spec imports
* Clean up the registered peer even when the connect test fails
* Drive the dashboard's own remote-access flow instead of the client directly
* Mint the flow test's target peer by exposing a service
* Limit the wasm check to what the test environment can prove
* Give the wasm download and compile a realistic budget
* Hold the wasm client to the dashboard's initialization deadline
The six-way shard split traded one 15-minute job for six ~7-minute
environments plus a week of chasing env-setup races; not worth the
compute and the moving parts. What stays are the fixes that help a
single job too: the build overlapping env setup (gated on the rendered
.test-config.json, at lowest CPU priority), proxies skipping their
GeoLite2 download, management's geolocation databases cached across
runs, and the 480s registration budget.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Management downloads GeoLite2 data on first boot (it cannot be disabled:
/locations/countries feeds the country dropdown the proxy specs use),
and a slow pkgs.netbird.io stretched env setup from 4 to 8+ minutes.
The workflow restores geo-cache/ before env setup; renderDockerCompose
bind-mounts the cached databases into management's data dir, where
getDatabaseFilename uses existing files without any network call. On a
miss, exportGeoDatabases copies the files out of the volume once
management's API serves, and the save step uploads them right after env
setup so a later test failure doesn't lose the cache. The key is static
(geolite-dbs-v1); bump it to refresh the data.
Also fixes a missing trailing newline in e2e/environment/.gitignore.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both reverse proxies download a GeoLite2 database at startup with a
2-minute client timeout, and a slow pkgs.netbird.io stalled proxy
registration past the wait budget — the source of the remaining shard
flakes. No spec exercises country-based enforcement, so the rendered
compose runs the proxies with NB_PROXY_DISABLE_GEOLOCATION=true.
Management keeps its geolocation download: /locations/countries feeds
the country dropdown the reverse-proxy specs select from, and disabling
it there returns a 412. The 480s registration budget stays to absorb
that first-boot download on a slow runner.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two of six shard groups died in env setup: management's container was up
but refused connections for the whole 120s proxy-registration window.
The concurrently running Turbopack build saturates all four runner cores
exactly while management starts, so the deadline became a coin flip
(5/5 green on one run, 4/6 on the next).
The build now runs at nice -n 19 so the containers always win the
scheduler, and the proxy-registration budget doubles to 240s so a slow
runner degrades into a later start instead of a dead job.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
control-center-draft was the long pole at 10:18 while the other four
groups finished in 5-7 minutes and waited. The matrix spec dominates the
group and must stay in a quiet-graph environment, so it gets a sixth
group of its own instead of a neighbor: idle-finished groups just wait
on the slowest, so one more docker environment per push is cheap in
wall-clock terms. Expected ceiling drops to ~9 minutes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The build/env overlap raced next build against create-test-env.sh: the
@/config/test alias resolves to .test-config.json, which the script
renders only after its Zitadel bootstrap, so every shard group failed on
Module not found. The build now waits until the file exists and parses
as valid JSON (the render is not atomic) before starting, which still
overlaps it with the setup's back half — image pulls and proxy cluster
waits. If the setup dies before rendering, the step reports that instead
of a misleading build error; if the build fails, the background setup is
killed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One 15-minute job becomes five parallel jobs, each with its own docker
environment, grouped by what the specs fight over rather than by count:
- control-center-draft: the specs asserting absolute canvas counts plus the
draft-only ones; nothing here seeds live policies or registers peers.
- control-center-live: the live-object seeders and both docker-peer specs;
only this group pulls netbird:latest.
- platform: networks, routes, access control, setup keys and the mocked
specs — prefix-scoped and mutually safe.
- agent-proxy-dns: proxy services, DNS, agent-network, edition gating.
crowdsec is NOT here: it creates a TCP service on listen port 3306, the
same fixed port reverse-proxy-services-tcp starts on.
- settings-team: every account-global mutator. settings-authentication
leaves peer approval flipped, so it can no longer poison the docker peer
registrations two environments away.
Groups live in e2e/test-groups.json; a workflow step fails the run when a
spec is assigned to zero or two groups or the JSON names a deleted file,
so the explicit split cannot silently drop a spec from CI. login.spec.ts
is passed to every group as the auth dependency.
The Next build now runs concurrently with the docker environment setup
(CPU-bound vs network-bound), hiding ~2 minutes of the fixed cost. Files
are ordered slowest-first within each group so the workers pick up the
long poles early. Expected wall clock: 8-9.5 minutes for the heaviest
groups; the remaining floor is the environment setup itself.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds 31 unit test files over the control-center draft machinery — changeset
tracking, group-deletion cascades, deploy and retry, placeholder artifacts,
leave guards, menus and views — and lands the fixes the suite surfaced:
- The navigation guard patched window.next.router, which the App Router never
defines, so it silently guarded nothing. Guards are consulted at the call
site via useGuardedRouter, adopted by the sidebar, header, user dropdown and
the billing nav cards, whose <button> triggers the anchor interceptor never
saw.
- Group deletions tag the policy writes they force, keep those tags across
repeated deletions and hand edits (mergeGroupDeletions), and restore the
stripped groups when the deletion is discarded. Draft policies are stripped
too; resources and routers naming a doomed group block the deploy instead,
since their writes land before the group DELETE.
- The deploy refuses permission-gated changes before the first request lands,
resolves group refs id-first so a name can't capture another group's id,
merges retry PUTs onto fresh reads instead of erasing other admins' edits,
and pins a retry to the network its create actually ran under.
- Removing a placeholder revokes its setup key immediately; the artifact
registry tracks key/group generations across undo, and the Install modal
reconciles dead keys against the API on open instead of waiting forever.
- Node removal goes through one gate everywhere: bulk toolbar actions,
keyboard Delete and the node menu share the same predicates
(canRemoveNode, useCanDeleteGroup), and group removals run as one batch per
gesture so every strip comes from a single canvas snapshot.
- View fixes: enabled policies win dimming across networks, a shared
destination group clones instead of collapsing into the source column, a
frame's dim flag no longer masks a resource's own enabled state, and large
membership diffs skip the quadratic LCS.
Also trims the newly added comments back to the 7268557f standard: 107
deletions or compressions, -126 comment lines, no code changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Loading a provider's models merged anything the catalog did not already carry
by exact id, and hardcoded both rates to zero on the way in. The comment gave
the reason: the discovery response carried no prices. That stopped being true
when the endpoint began returning the same rates the proxy bills with.
Bedrock feels all of it. Its listing returns geography-prefixed ids —
eu.anthropic.claude-opus-4-7 — while the catalog holds the bare
anthropic.claude-opus-4-7, so no Bedrock model ever matches by string and every
one of them takes this branch. Selecting one filled its row with $0, and the
form then warned that the model had no cost set, while the API had reported a
rate for it. Usage against it records nothing.
Exact-id matching stays. Collapsing a geography-prefixed id onto its catalog
entry would hand back the bare form, and only the prefixed one is invocable at
AWS.
Both ref assignments in useAssistantRuntime are intentional and the lint rule
cannot see why: contextRef has to be written during render or the transport
carries a commit-stale pageContext, and chatRef breaks the cycle between useChat
and the tool runner it calls. Comments say so, and the rule is disabled at those
two sites rather than left as standing errors.
Also repoints the friendlyFetch pass-through test at rate_limited/429, a code
the server now actually returns, instead of a status/code pair it never sends.
No behaviour change. Kept separate so it can be dropped on its own — it is
unrelated to the assistant service work and was not part of the review that
prompted it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Both registries open with a comment saying their wire names must match the
other's, and nothing checked it. A divergence means the model calls a tool the
dashboard cannot fulfil, which fails at runtime for the user.
The two packages live in one repo, so the test derives the server's names from
the tool directory (mirroring registry.ts's own exclusions) and the dashboard's
from the registry object, and requires them equal apart from an explicit
allowlist — currently just load_skill, which the server executes itself.
Also drops assistant/** from the root eslint config: it is a Bun service with
its own tsconfig and its own CI job, and Next.js rules do not apply to it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The service moved from agent/ to src/ and lost its database along the way (the
Drizzle layer, the Prometheus endpoint and the Grafana dashboard are all gone).
The move also dropped things worth keeping, and a full read of the folder turned
up more. This is the restructure plus that pass.
Service layer
- CI: .github/workflows/assistant.yml runs typecheck and bun test on any change
under assistant/**. The suite had no CI job at all, so every invariant it
encodes was decoration.
- Rate limiting: src/ratelimit.ts, a token bucket keyed per principal on /v1/*
and per client IP on /readyz, answering 429 with Retry-After. Restores the
limiter the restructure deleted. It is in-memory, so the limit is per replica
rather than per deployment — a deliberate trade for a service with no
datastore, recorded in a comment and in the README rather than left to be
discovered.
- Cost telemetry: the chat_turn log line now carries the token usage of all
three model calls a turn can make (main model, input guardrail, suggestions)
and the account they are billed to. modelCalls alone could not distinguish a
200-token turn from a 16k one. A guardrail rejection logs too: it never
reaches the stream, but the screening call was still billed.
- The verified principal is finally read. It was extracted from the JWT and
discarded; it now keys the rate limiter and attributes the usage.
- HTTP parsing moved out of the agent layer into the route, so chat() takes a
validated body instead of a raw Request and MutableCtx collapses into
TurnContext.
- initAuth dedupes concurrent OIDC discovery behind one in-flight promise, with
a timeout and a cooldown. Before, a slow or down IdP got one discovery fetch
per concurrent request, with no backoff and no token required to trigger it.
- The cors rejection code was defined with a user-facing message and never
used; originGate now returns it instead of bare text. Dropped the unused
other code, and moved classifyLlmError next to the taxonomy it produces.
PII backstop
- restoreText memoizes its pattern instead of recompiling per stream chunk.
- scrubMessages prefetches the analyzer concurrently and then mints serially,
so a long transcript is one round of latency rather than one per text part
and token numbering stays deterministic across resends.
- The analysis cache is keyed by hash with a TTL. It was keyed by the raw text,
which left up to 500 unredacted messages in memory for the process lifetime
and contradicted the module's own docstring.
Tools layer
- tools/lib/ became _contract.ts and _schemas.ts, and discovery now skips
_-prefixed, .test.ts and .d.ts files. A tool's name is its filename, so a
colocated test file used to become a tool and crash the process at boot.
- The docs extraction and the OpenAPI indexer moved into src/lib/ (docs.ts and
a new openapi.ts). A tool file's only export should be its defineTool call;
the tell was tests importing library code out of two of them.
- defineTool accepts a Zod schema and generates the model-facing JSON Schema
from it, with one uniform rejection in the registry. search_docs, fetch_doc,
get_api_reference and ask_user were each carrying two hand-maintained copies
of their contract, and ask_user's had already drifted: the model was told its
two-to-four option limit in prose and then punished by a validator it could
not see. render_component and the client tools keep their hand-written
schemas on purpose.
- The shared input schemas are frozen. They were mutable singletons shared by
reference across eleven tools.
- Suggestions use generateObject rather than hand-rolled brace-scanning.
Docs, packaging, evals
- A README, which did not exist: request lifecycle, the two-sided tool
registry, the skill contract, the fail-open consequences of the PII backstop,
every env var, and an honest limitations section.
- The dockerignore no longer excludes *.md recursively-by-accident-of-syntax,
the prod compose can find its .env, presidio has a healthcheck the app waits
on, and both build stages share a base image.
- The evals score tool selection alongside skill routing, with seven new cases.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The model picker only offered NetBird's compiled-in catalog, which goes stale as
vendors retire models and cannot reflect what an account is actually entitled to.
Adds a "Load models from provider" action backed by
`POST /agent-network/catalog/providers/models` (netbirdio/netbird#7246). Editing a
saved provider reuses the stored credential, so the masked key never reaches the
browser; creating a new one sends the key being typed. Discovered models merge into
the catalog options, with catalog entries winning a collision because they carry
pricing. A model the backend reports as unpriced is flagged and needs confirmation
before saving, so nothing is registered at a silent zero.
Two implementation notes: the unpriced warning renders once at list level rather
than per row, and the hook uses `ignoreError: true` so a provider-specific failure
is reported inline in the modal instead of as a global toast.
The cards are not equally tall (group 70px, peer 64, the pickers 66,
policy ~34) and React Flow anchors by the top-left corner, so columns
placed on the same y read as misaligned and policy edges bend. Center
them per node type, and nudge the policy column down to match.
Also matches the group count label to the peer IP size and the left
padding of the peer, peer-picker and group-picker cards to the group
card.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Assigning during render is a side effect in the render phase, so a
discarded render could leave the ref holding handlers from a tree that
never committed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Comments in the touched files go from 4,369 lines to 1,397 (-68%). No code
changed: every file's compiler output with comments stripped is byte-identical
to before, checked across all 139.
Removed comments that restated the line below them, doc blocks repeating a
symbol name and its types, references to callers, change narration, section
markers on a single statement, and facts stated more than once in the same
file — the largest single category, with one file explaining the same cascade
rule four times.
What stayed is capped at a line or two: constraints a reader cannot recover
from the code. The API rejecting bare id strings, never capturing history
mid-drag because the signature stringifies the whole canvas, parents before
children in node updates, the invisible-swap model behind the canvas
transition, and the ordered teardown the setup-key API requires.
Also drops three eslint-disable directives ESLint reported as unused. A fourth,
in useDrillDownBrowserHistory, stays: removing it surfaces a react-hooks/refs
error, because the plugin stops analysing a function once it sees any of its
own suppressions inside it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
VirtualScrollAreaList starts at index -1 when autoSelectFirst is off, but
the keyboard nav still assumed a non-negative index: Enter called
onSelect(items[-1]) — an uncaught TypeError in the routing-peers popover,
its only such caller — and ArrowUp walked to -2, -3, … Enter is now left
alone when nothing is highlighted, and ArrowUp wraps to the last row.
In the resource modal, the duplicate-name check compared takenNames
case-sensitively while the resourceExists check it is OR'd with is
case-insensitive, so two draft resources differing only in case both
validated and deployed into the very clash the check exists to prevent.
Draft mode also no longer mounts the Access Control tab: this branch
hides its trigger, but the resource-groups callout still linked to it,
and any policy configured there landed in state that saveDraft discards.
The callout now points at the canvas in draft.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
liveRenameGroup mapped the group's resources to bare id strings, which
the group PUT rejects ("could not parse json") — so renaming a live group
that owns network resources failed, and because the canvas patch sits
after the await, it silently did nothing. Resources now pass through
untouched, matching useGroupHelper and every other group PUT.
Rename was also offered without permission.groups.update, and the live
resource Edit / Disable-Enable items without permission.networks.update,
unlike every neighbouring action in the same menu. Both now hide when the
role lacks the permission, instead of offering an action that 403s and
appears to do nothing.
Note for later: GroupsProvider.createOrUpdate has the same bare-id
resources mapping, plus a PUT path that interpolates group.id after
resolving groupID by name — both pre-existing on main.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Entities marked for deletion are no longer droppable from the panel.
Only groups had that guard, so a deleted policy, network or resource
could be dragged back, drawn fully connected, and deleted anyway on
deploy. Deleting a network blocks its resources too — the API cascades
to them, so they would vanish again with no delete change of their own.
- A whitespace-only search no longer empties the category page. Only
isSearching trimmed the term, so a single space hid every template and
any entity whose name has no literal space.
- The components panel's onClose is stable, so PanelContent's memo holds
instead of rebuilding every entity row on each draft-context change —
even while the panel is closed.
- The selection toolbar recomputes its position when a drag ends. Node
positions are read imperatively, so nothing else signalled that the
selection had settled somewhere new and the toolbar reappeared over its
old spot.
- CanvasToolbar writes through the ReactFlow instance instead of
useCanvasState, which changes identity on every nodes update — the
toolbar was re-rendering on every drag tick, which its comment claimed
to have avoided.
- ToolbarButton renders a shortcut keycap without a tooltip, so the
selection toolbar's Create Group finally hints its `g` shortcut.
- Framed resource-group rows always mount their edge anchors. A row
created with showHandles false had no target handle, so a policy
connection could not be dropped on it and its edges had nothing to
anchor to.
- A policy's destination scope for an existing-network frame unions the
API resources with the frame's draft children, which were unselectable
before.
- A restored network frame orders rows by the network's own resource list
instead of the global one, so rows no longer reshuffle.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Found by the line-by-line review of this branch. Each fix has unit
coverage; the pure helpers gained tests alongside.
- Re-adding a group member the draft had removed now reverts the removal
instead of also recording an add. The stray add never netted out, so
the change sat in Review & Deploy forever and deployed a PUT equal to
live — and a later removal of that member looked like a draft revert
and vanished silently. The "nothing left to do" rule is now one
exported predicate (isNoopGroupUpdate) that the trackers and the
removal cascade share, so they cannot drift.
- The removal cascade prunes an update-group left empty by dropping a
create-resource or an install-peer, instead of leaving a phantom
"Update group" row that deploys a pointless GET + PUT.
- Deploy skips already-sent changes by payload, not just by id. The
changeset coalesces later edits into the same entry, so an edit made
after a partial failure was never sent and was then discarded with the
changeset. Completed creates are still skipped unconditionally — the
entity exists, so a second POST would duplicate it.
- undo/redo cancel the armed debounced capture before flushing. Only the
effect cleanup cleared it, which React runs in a later task, so an
expired timer could fire after undo() rewound the stacks and wipe redo.
- An update-group's resources render in the same wire shape on both sides
of the Review & Deploy diff, so unchanged members no longer show as
removed + added.
- Removing a draft group also drops its stale SSH authorized_groups key,
which is name-keyed and would otherwise be sent as if it were an id.
- Copy cURL escapes apostrophes so the body stays pasteable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The page.tsx teardown into view hooks dropped the agent-network overlay:
addAgentNetworkProviderNodes, the agentPolicies fetch, the layout buckets
for both node types and the agent-policy click handler all went with it,
orphaning AgentPolicyNode and ProviderNode. The feature itself is still
live and account-gated, and nothing recorded a decision to retire it.
Rebuilt for the current architecture rather than transplanted:
- views/agent-network-overlay.ts holds the pure builder that appends
source -> agent-policy-<id> -> provider-<id>, plus the small hook that
supplies its data.
- Data comes from useAIProviders() instead of a second set of fetches.
The provider already owns those endpoints and already gates them on the
feature flag, which also drops the API-to-domain cast the old code
needed.
- The group and peer views call it where they did before; the peer view
unions across the peer's groups.
- Agent policies rejoin the policy column, providers the destination
column, and clicking an agent policy opens AgentPolicyModal through the
new openAgentPolicy on the policy context.
- Edges use "smart", matching the rest of the live views. SmartEdge reads
data.policy optionally, so an agent edge without one is fine.
With the feature disabled the provider issues no requests and the overlay
is a no-op, so the views behave exactly as before.
This commit also carries useSelectNodeHandlers' share of the preceding
cleanup pass — its hunks interleave with the click-handler change too
closely to split.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
deleteGroup ran once per selected group, and each run rebuilt the policy
payload from a canvas that had not yet absorbed the previous run's patch.
Since trackUpdatePolicy supersedes the entry for a policy, the group
removed first reappeared in the payload written by the second, and its
DELETE was rejected at deploy.
The batch is now resolved in one pass: every group is folded out of each
policy before a single update is tracked per policy, and the deletes,
canvas-instance removal and node/edge updates all happen once.
confirmAndDeleteGroups hands the whole selection over; the single-node
deleteGroup wrapper had no callers left and is gone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A line-by-line pass over the draft-mode branch. Every candidate was found
by one review agent and re-verified by a second before being applied.
Dead code: applyD3ForceLayout and the d3 import, getDraftWarnings,
addExpandedGroupContent, the policy-drop-position mechanism, the
unreachable live branch of useCreateGroupOnCanvas, NetworkNode's
non-frame card and its /networks/resources fetch, six unreachable
PolicyNode handles, the ChangeCodeView header path, SetupModal's
ephemeralKey prop chain, the .cc-focus-root rules, and never-passed
props on several components. Deletes DraftModeTitle, NodeItem, NodeHalo
(never imported) and BidirectionalEdges, FloatingEdge (registered in
EDGE_TYPES but no code ever creates those edge types).
Comments: corrected the ones that described code that had moved on, and
dropped the ones that only restated what the line below already said.
De-duplication: the group/peer panels now share their placement and
close-guard plumbing, PeersToolbar reuses the node-capabilities set, the
draft uid helper and the resource/placeholder icon maps have one home
each. vitest.config.ts becomes .mts so Vite's native loader parses it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The API rejects a group DELETE while a policy still references it, so
deleting an existing group in draft now records an update for every
tracked policy that references it (via the new removeGroupFromPolicy
helper) before scheduling the delete, and patches the canvas policy
nodes to match.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bottom-right corner of the canvas, styled like the draft-mode Cancel
button, opens the feedback form in a new tab.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Patch the same shared app-router instance as before, but reach it via
window.next.router (the object AppRouterContext provides) instead of
importing the context from next/dist; the router type comes from the
public useRouter return type. If Next ever drops that handle, the guard
logs an error and the draft-leave e2e test fails. Install and guard
registration are now one-liner hooks: useNavigationGuard() in the
layout, useSetNavigationGuard(guard) in DraftLeaveGuard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closing the first-run Install NetBird modal never cleared the
netbird-first-run flag (AddPeerDropdown dropped the reset the old
AddPeerButton had), so any remount of the peers empty state — like
exiting draft mode after a successful deploy — auto-opened it again
in test builds, and its overlay swallowed all navigation clicks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The group panel's Install chip stayed "Install" after a setup key was
generated, and reopening the modal (from the panel row or a Review &
Deploy issue badge) offered "Generate Key" again — minting a second key.
The chip now flips to "Waiting" and both paths reuse the stored key via
getPlaceholderSetupKey, which also reads a group's draftPeers entry.
getPlaceholderPeer carries the install artifacts so absorbing an
installed placeholder no longer strips them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Since Next 16, useRouter() returns a per-component copy of the router,
so DraftLeaveGuard's patching of its own copy never intercepted the
sidebar or profile dropdown. Wrap push/replace once on the shared
AppRouterContext instance (installed in DashboardLayout before the
chrome renders) and let DraftLeaveGuard register a guard that shows the
same discard confirmation as Cancel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The header's top-left and top-right clusters were independent absolute
layers, so on narrow screens the network-view controls slid under the
Live/Draft switcher. They now share one row: the switcher stays pinned
top-right (stacking Live/Draft above Cancel/Review below lg), while the
left controls wrap as logical groups and the network selector shrinks
instead of overflowing. The views switcher renders as a select below lg.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Create-group-from-selection only stored placeholder peer ids in
addedMembers, never their objects as draftPeers on the group node —
unlike drag-to-group. The Details panel therefore resolved zero members
(placeholders aren't in /peers), and its close cleanup wrote that empty
count back onto the node, so the group showed "No Peers" after opening
the panel even though the changeset still held both peers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The live single-network view renders only the network's policies,
groups, and resources — no network-<id> node — so useDeleteNetwork's
canvas lookup came up empty and the header's Delete bailed out before
the confirm dialog. Fall back to resolving the network from /networks
by the id embedded in the node id.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The edit modal initialized its peer selection from the async SWR fetch
via useState, which only reads its argument on first render — so on a
cold cache the prefill never appeared. State now holds only an explicit
user selection (null = untouched) and falls back to the fetched peer
during render; the selector is disabled while that fetch is in flight.
PeerSelector's onChange is narrowed to a plain callback so state setters
of wider types remain assignable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The HubSpot form behind the self-hosted Agent Network signup now has a
required company-scoped Country/Region field, so submissions without it
are rejected. Adds a searchable Country dropdown to the signup step and
includes the value as an objectTypeId 0-2 field.
Uses a static country list instead of /locations/countries since the
geolocation database may be absent on self-hosted deployments and the
HubSpot property expects full country names, not ISO codes.
With the select tool active the canvas uses panOnScroll, and xyflow
routes ctrl+wheel (and trackpad pinch) through zoomOnPinch instead of
zoomOnScroll. Gating zoomOnPinch on canInteract therefore made zooming
impossible in select mode, so loosen it to menu/empty-state locks only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The desktop client reworked its UI in v0.75: the management server is now
asked for on the first-run "Set up NetBird" screen and lives under
Settings > General, so the "Settings > Advanced Settings" path the Windows
and macOS tabs described no longer exists. Move the copy into a shared
ManagementUrlStep, cover the already-installed case, and say "menu bar"
instead of "system tray" on macOS.
Fixes#732
* Remove unnecessary comment
Cover the wire contract the mocked unit tests can't; self-skipping when
the analyzer sidecar isn't reachable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add domain knowledge sections (peers, access control, routing, reverse
proxy, DNS, team, activity, settings), fold the control-center modeling
rules into them, list the full tool roster, and restyle per Anthropic
prompting guidance for Sonnet 5 (parallel tool calls, no aggressive
emphasis).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- one Redactor engine (utils/redaction.ts): whitelist redact(value, config),
detect() over the name catalog + PII patterns, restore/resolve for tokens;
per-tool whitelists live at the tool definitions; square-bracket tokens
- tool executor computes filters/time ranges/search/sort/count_by over the
full fetched list, then caps rows and bytes behind an explicit truncation
envelope with parameter validation and applied-param echo
- UI: always-mounted message actions (no layout shift, per-message copy
disable), streaming-safe inline components, OSLogo size prop for the context
chip, "Ask" header button, centered stop icon, empty-network callout in the
draft destination modal
- remove dead code: models flow, feedback theatre, source list, history panel,
legacy interfaces
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rework the vendored service around the AI SDK stream (agent/) and make the
privacy boundary two-layered:
- always-on server-side PII backstop: Presidio analyzer sidecar (pinned image,
internal-only), per-request vault minting [REDACTED_*] tokens, streaming
restore with split-token hold-back, LRU'd analysis, circuit breaker, fail-open
- list tools accept filters/since/until/query/sort_by/order/offset/limit and
count_by so big accounts are answered by narrowing, not raw row dumps
- add get_current_user; switch tokens to square brackets; draft-first prompt
- drop the dead /v1/models flow, mutating-tool remnants, unused headers/params,
test-only exports, and the @anthropic-ai/sdk dependency
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The probe is unauthenticated, so the existing rateLimit middleware can't
cover it — that one keys off ctx.principal, which a probe has no way to
supply (reusing it would dereference undefined and 500). This adds a
per-address token bucket, checked before readyz() so a flood is refused
ahead of the DB check rather than after it.
The ceiling is deliberately far looser than the chat limit (100 per 10s vs
30 per 60s): a load balancer polls every few seconds, and refusing a real
probe marks a healthy instance down — worse than the flood it prevents.
Buckets are per address, so one flooder cannot refuse the balancer, and
lapsed buckets are swept once the map is large enough for a scan to pay.
Client IP is the socket address. X-Forwarded-For is caller-supplied and
only honoured under TRUST_PROXY_HEADER (default off): trusted while
directly exposed, it would let a flood mint a fresh bucket per request by
rotating the header, or get a peer refused by forging theirs.
withMetrics now forwards Bun's server argument so a handler can reach
requestIP(); it stays optional, as handlers that don't need it declare one
parameter.
Verified against a running server: with the ceiling at 5, requests 1-5
return 200 and 6+ return 429 with Retry-After; the refusal keeps its CORS
headers, so the dashboard's browser probe reads a 429 rather than an opaque
network error; /healthz is unaffected; and 30 back-to-back probes at the
defaults draw no refusals.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
/readyz is unauthenticated, CORS-enabled and un-rate-limited (rateLimit is
only composed onto /v1/*), so every probe ran a fresh `SELECT 1`. That made
it a request amplifier: a flood from one host turned cheap HTTP requests into
DB round trips and could exhaust the connection pool the chat path needs —
taking the service down through the endpoint that reports whether it is up.
Cache the result for 2s and share the in-flight check between concurrent
callers. Probes run every few seconds, so a result this stale is
indistinguishable to them.
Measured with statement logging on the dev Postgres, before -> after:
3 rapid requests 3 queries -> 1
200 concurrent 123 queries -> 1
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Moves the standalone netbird-assistant project (previously a separate
WebstormProjects checkout with no commits and no remote) under assistant/
so the backend service lives alongside the dashboard that talks to it.
node_modules is not carried over — reinstall from bun.lock. The service's
own .gitignore comes along, which keeps .env untracked now that the
directory sits inside a repo whose root gitignore only covers .env*.local.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Conflicts resolved:
- eslint.config.mjs: both branches added it independently; kept the union of
ignore patterns and both branches' rule setup.
- src/layouts/Navigation.tsx: kept the absolute-positioned collapsed rail —
fixed positioning escapes the dashboard card's overflow once the assistant
panel insets it.
- src/layouts/DashboardLayout.tsx: kept the assistant-panel layout, carrying
over the keyed page Fragment from the other branch.
- package-lock.json: regenerated against the merged package.json (next 16.3.0
plus the assistant-ui dependencies).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Assistant + control-center work on top of the draft-mode canvas.
Control center
- A placeholder peer can be a network's ROUTING PEER: the routing-peer modal
lists the draft's placeholders (exempt from the version gate — an uninstalled
peer has no version), the router change is recorded against its draft id, the
peer's own install-peer step blocks the deploy, and installing rewrites the
router with the real id. The request preview renders {x_peer_id} rather than an
unrunnable draft id.
- Grouping a resource that lives in a network frame keeps its card in the frame:
the row is the network's representation of it, and removing it left the frame
looking empty while the changeset still deployed the resource into it.
- The group panel offers canvas-drawn resources as well as API ones, mirroring
what it already did for placeholder peers.
- Assistant actions: route_network, new_resource_group (a group inside a frame),
and initial `members` on a new/existing group. Membership goes through one
resolveMember — a draft resource's node data holds no id (it comes from
getDraftResource), so reading the raw field made grouping a no-op that still
reported success.
- The canvas is locked for the whole assistant TURN, not per step: a step lasts
milliseconds and the gap between two of them seconds, so per-step scoping
handed the canvas back mid-layout. The overlay is silent — the panel narrates.
Assistant
- Identifiers the user types are pseudonymised into the SAME tokens as the data
(names from the loaded lists, addresses and emails by pattern), so "where is
100.84.175.167?" is matchable instead of reaching the model as a value it can
never line up with. Values that can be attributed carry a note naming the
resource they belong to. This also stops typed addresses leaving the browser.
- The status line says what the assistant is doing — the running step's own
label, or its reasoning condensed to one short phrase. Reasoning itself is
never rendered in the thread.
- open_page refuses a scalar token as a resource id instead of navigating to a
dead end, and the activity row shows the route it actually pushed.
- Modals stay inside the dashboard card while the assistant panel is open, and
the canvas pans out of the panel's way (only as far as it must).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade to Next.js 16.3
Turbopack is now the default for both `next dev` and `next build`, so the
separate `turbo` script is redundant and has been dropped.
`next build` rewrites tsconfig `moduleResolution` to "bundler", which Next 16
expects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: migrate ESLint to flat config
`next lint` was removed in Next 16, so `npm run lint` had been failing with
"Invalid project directory provided, no such directory: ./lint" since that
upgrade. eslint-config-next 16 also ships flat config only, which the old
.eslintrc.json could not consume.
Ignores .claude/ so stray worktree copies of the repo are not linted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replace ip-cidr with ip-address to clear CVE advisories
ip-cidr pulled a vulnerable ip-address (GHSA-mwp4-54f8-5fhr, high: leading-zero
octets decoded as decimal while resolvers read them as octal, enabling SSRF;
GHSA-v2v4-37r5-5v8g, moderate: XSS in Address6 HTML methods). npm reported "no
fix available" because even the latest ip-cidr pins ip-address ^9.0.5, still
inside the vulnerable range.
ip-address 10.x was already a direct dependency and covers every use: its
isValid rejects leading-zero octets and validates mask ranges natively, and
isInSubnet replaces the one `new cidr().contains()` call site.
The new validators were differential-tested against the real ip-cidr over a
67-input corpus (134 checks) before removal, with no divergences; containment
was checked across 14 v4/v6/boundary/cross-family cases. `npm audit` now
reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: replace next-themes with an in-repo ThemeProvider
next-themes renders an inline <script> to set the theme before paint. It was
loaded through dynamic(ssr: false), so that script rendered on the client, where
React 19 never executes script tags and warns:
Encountered a script tag while rendering React component.
Upgrading would not have helped; 0.4.6 still renders the script
unconditionally. The script was also useless here: injected after hydration, it
could not prevent a flash, and postbuild.js hoists inline scripts out of the
export anyway.
The replacement keeps the same `netbird-theme` storage key and three-mode
support, and sets the theme class on <html> in the layout instead, so the
static export ships the correct theme in its first byte with no script at all.
Dropping the dynamic(ssr: false) wrapper removed an implicit prerender bailout
for the whole provider tree, which exposed isNetBirdCloud() reading
window.location during the build-time render; it is now guarded. The exported
HTML is byte-identical either way, since the page already bails to client
rendering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key the router children slot in the dashboard layout
React logged "Each child in a list should have a unique key prop. Check the
render method of DashboardPageContent." The App Router's segment element for
`children` arrives with a null key, which React flags once it is reconciled
alongside the Navigation sibling. Wrapping it in a keyed Fragment resolves it.
Verified in the browser both ways: with the Fragment the console is clean,
without it the warning returns.
Also applies the pending simple-import-sort fix for this file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match IPv4-mapped IPv6 hosts against IPv4 CIDRs
Regression from replacing ip-cidr. Its contains() normalised an IPv4-mapped
IPv6 address to the embedded v4 before the subnet check, so
contains("::ffff:10.0.0.5") on 10.0.0.0/24 returned true; isHostInCIDR returned
false. Verified against ip-cidr@3.1.0 directly.
This is reachable: isValidIP accepts "::ffff:10.0.0.5", so a mapped host entered
in ReverseProxyAddressInput against an IPv4 resource CIDR was wrongly rejected.
An IPv6 network still rejects a mapped host, so families do not leak. Checked
across 20 cases (6 mapped-host, 14 pre-existing), with the mapped expectations
taken from measured ip-cidr output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive skeleton colors from the resolved theme
SkeletonTheme had the dark palette hardcoded, so a light theme would render
dark skeletons. The light values are the ones already defined on the
feature-light-theme branch rather than new invented colors.
resolvedTheme is tracked in state and updated from the existing apply(), so the
palette also follows the OS preference under "system".
Latent today, since DarkModeToggle disables both Light and System.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: center icons in collapsed navigation rail
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use one plus icon across network tab Add buttons
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the assistant side panel: chat runtime, streaming API client,
client tools, route-aware context, name redaction, chat history and a
standalone preview route. Migrates ESLint to flat config.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adopts the new Agent Network settings contract:
- The management API replaced the implicit settings bootstrap — a
`bootstrap_cluster` hint on the first provider create — with an
explicit POST /agent-network/settings carrying the proxy cluster
address. The settings response now carries endpoint +
proxy_address + dedicated instead of cluster + subdomain.
- The provider wizard keeps its UX (auto-picking a validated cluster,
gating the first create on having one) but now bootstraps the
settings row with the explicit POST right before the first provider
create. A bootstrap failure keeps the wizard open and surfaces the
error — previously a failed bootstrap was swallowed server-side and
the account silently ended up with a provider but no endpoint. A 409
(concurrent bootstrap won) is treated as success, since the row
exists either way.
- Types updated accordingly; bootstrapAgentNetworkSettings is exposed
on the providers context. The onboarding provider step reuses the
same wizard, so it is covered by the same change.
Without this, the dashboard against a new management silently stops
bootstrapping accounts: provider create succeeds (the old hint is an
ignored unknown field), but no endpoint is ever assigned.
Self-hosted management versions can carry a numeric build suffix
(e.g. 0.76.3-31256681241) that overflows the sidebar box. Show the
semver only and move the full string into the hover tooltip alongside
the latest version. Pre-release labels like -rc.1 are preserved.
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The draft Agent template's setup key was flagged ephemeral purely because the
template's own description mentions the word — nothing in the API contract or
product asks for it, and every other setup-key path in the dashboard sends
ephemeral: false. An agent placeholder becomes a real part of the deployed
topology (groups, policies, sometimes a router), so having the management
service delete it after ~10 minutes offline would silently break the config
the user just deployed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The bound group could not be deleted while the setup key still listed it as
an auto_group (the API rejects linked groups), and both deletes were fired in
parallel, so the group often survived on the freshly registered peer.
Sequence it instead, still silent and best-effort: unlink the group from the
key's auto_groups, empty the group's peers, delete the group, then delete the
setup key, then revalidate /peers + /groups so the matched peer drops the
throwaway membership without any user-facing step.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Auto Arrange left a policy's destination on the SOURCE side whenever the
canvas also carried a network frame: the destination restack lived in the
frameless branch only, so in a frames draft the hierarchical layout's
type buckets had the last word — a destination peer stayed stacked on the
sources at x 0, and a standalone resource landed inside the frame grid,
to be shoved aside by the overlap pass. A "Server -> policy -> Agent"
draft on a networks canvas came out with both peers on the left.
Hoist the destination restack out of that branch so it runs for every
draft, and start the frame grid past the destination column when both
exist (frames sit at 1050, the column at 1000). With frames as the only
destinations the grid keeps its bare FRAME_GRID_BASE_X, so live parity on
the networks overview is unchanged.
Also re-center the source column whenever it is non-empty: pulling a
destination peer out of the shared peerNode bucket used to leave the lone
remaining source at the pair's top offset.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The report's hard failure was a missing test id: submit-policy existed only on
the create modal's last step, so the draft policy edit test could never save.
Its three follow-up tests had been skipped by that failure and were each broken
in turn — a renamed menu item, a reload that assumed the canvas after the API
helper had navigated away, a components-panel search cleared by the category
switch (leaving the row unmounted below the fold), and an afterAll that spun up
a fresh context and outran its own timeout.
The drilldown flake was a client-side route update from the previous test
aborting the next navigation; navigateTo now retries once on ERR_ABORTED.
The Billing Admin flake was a real cross-spec leak: the control-center helper
pinned netbird-test-edition=licensed with an init script on the worker-shared
owner page, and Billing Admin is cloud-only — so whether it appeared depended
on file ordering. The edition is now set per navigation, and the billing test
asks for the edition it needs.
Selectors in the control-center suites go through test ids instead of copy:
cc-menu-<action> / cc-canvas-menu-<action> on the context menus, and title ids
on the policy modal and the shared confirmation dialog.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
After creating a resource in the live drilled network view, rebuild the
canvas from the revalidated data so the resource appears without a
re-navigation. Drilling into a just-created network now switches
instantly — no drill transition, fitView tween, or empty-state reveal —
so the flourish doesn't play behind the add-resource prompt.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The first fit after mount snapped instantly to avoid an origin flash, so the
peer view popped into place with no fly-in. Fit while the viewport is hidden,
snap to a zoomed-out start, reveal, then animate in on the next frame.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sharding the suite across a matrix would run create-test-env.sh once per
shard, which is the expensive part — and on GitHub-hosted runners the only
ways to avoid that (shared remote backend, or snapshot/restore + build-once)
add real complexity. Not worth it right now: keep one env + one build.
Restore .github/workflows/e2e-test.yml and e2e/playwright.config.ts to their
pre-sharding single-job form. The genuine improvements from that work stay:
the draft inline-group hard-fail fix and the three flaky-test hardenings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Peer/group/user live views built group nodes straight from the
policy-embedded group objects (rule.sources/destinations), whose
peers_count is a snapshot from when /policies was fetched and goes stale
as peers join/leave groups. The side panel already reads /groups, so the
canvas label and the panel disagreed.
Add withFreshGroupCounts() to override peers_count/resources_count from
the authoritative /groups list (already fetched by useControlCenterData),
falling back to the embedded snapshot for draft-only groups, and apply it
at every group-node build site in the three live views.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
All three passed on retry in CI; each raced a known timing window:
- control-center-live "delete a policy": the seeded policy node was
occasionally not placed after navigating to the group view (stale SWR
read / build-fit race). Re-open the view until the node is on canvas.
- team-service-users "update admin role": the list served a stale role
cell right after a role change + navigation. Wait, then reload once if
it hasn't settled (read-only verification, so a reload only re-reads).
- team-users-approval-and-billing "Billing Admin": the Radix Select open
was swallowed so the item never rendered. Retry the trigger click until
the item is visible (same pattern as the matrix spec).
None weaken the assertions — roles, node presence, and saves are still
verified.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fix the one hard failure in control-center-draft-connections (inline group
in the policy modal): the naive click→fill→Escape on the destination group
selector let a still-animating Radix popover swallow the trigger click, so
the search input never appeared. Adopt the retry-until-visible + in-modal
close pattern already proven in the matrix spec. This also un-skips the 4
serial tests that were skipped behind it.
Split the Playwright workflow into build → 4 shards → merge:
- build the static app once and pass out/ to shards as an artifact
- each shard boots its own docker env (isolated account) and runs a
--shard slice; fullyParallel:false keeps serial specs whole and per-shard
backends stop cross-file account state from colliding
- merge-report stitches shard blobs into one HTML report + summary and
gates on both the matrix result and the merged failure count
Switch the CI reporter to blob to enable cross-shard merging.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
"No Network" also renders on the canvas resource node, so scope the assertion
to the resource change row (cc-change-create-resource) inside the Review modal.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
"Install" matched both the issue badge and the expanded change's cc-peer-install
button. Target the cc-peer-install testid for the peer step and the unique
No Network text for the resource.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
getCanvasWarnings' detailed messages ("references a peer that isn't installed
yet", "has no network assigned and won't deploy") are dead code — the Review
modal surfaces blockers as badges (Install / No Network) via getChangeIssue.
Assert those badges, which is what the test's intent verifies.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Comparing the joined group's x to the anchor within 1px was fragile in-suite.
Assert it settled nearer its own column's anchor than the other column, which
is what "joined the column" means and tolerates layout offsets.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- The draft-policy edit modal saves via "Save Changes" (update flow), not the
create flow's submit-policy button (that lives on the general tab).
- Poll the joined groups' positions until layout reconcile settles them into
the existing column, instead of reading once right after save.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- clickContextMenuItem: retry the whole open+click; the menu re-renders and its
items detach when the node underneath updates.
- Policy-edit group selectors: retry opening each side's popover, and close it
with an in-modal click instead of Escape (Escape can close the whole modal
once the popover is already gone).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Opening the destination group selector right after the source one closed had
its trigger click swallowed by the still-closing Radix popover. Wait for each
side's search to be visible after opening and hidden after Escape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
isFocusWorthy requires 2+ policies on the canvas, so the Focus menu item never
appeared with the test's single policy. Add a second off-path policy (a peer
connected to g2) — that peer/policy is also what focus dims.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Backspace-to-remove: wait for the click-selection to register, then blur the
panel's focused search input (React Flow ignores delete keys while an input
is focused) instead of relying on Escape keeping selection — removes a race.
- Drop-ring: only the group under the cursor highlights now (dropTarget ring);
drop the stale "all eligible groups show border-white/60" mid-drag assertion.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
getApiContext()'s first read navigates to /team/users to capture a Bearer
token; a mid-test listGroups() therefore navigated off the canvas and dropped
draft mode. Prime it in beforeEach (before enterDraft) so the token is cached
and later listGroups() calls don't navigate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The matrix suite never ran end-to-end (it was blocked at the first test by the
components-panel category issue). Getting it running surfaced several latent
mismatches with current behavior:
- place(): a resource drop opens the editor modal (an address is required), so
fill name+address and submit to create the node; dragTemplateToCanvas no
longer presses Escape for resources (it would dismiss that editor).
- Network frames connect from their left handle (sl-connect), like resources —
use "sl" when the source is a network.
- Expose the React-only canvas on window.__ccDraftCanvas in the test build and
read it from readDraftCanvas (localStorage persistence was removed), same as
the changeset hook.
- A no-network resource is tracked (create-resource with a "No Network" issue)
and its referencing policy is tracked too — the resource, not the policy, is
the deploy blocker. Rewrite the "untracked resource" test to that model.
- network → policy on an empty network opens the "Select Destination" picker in
its no-resources state; assert the modal, not the resource selector.
- Group context menu item is "View Details", not "Details".
Matrix is at 24 passing; remaining tests in the serial suite are still being
worked through.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A policy that references an uninstalled placeholder peer is listed as an
ordinary create-policy change; the peer's own install-peer change carries the
blocking issue that gates the deploy (DraftChangesetContext getChangeIssue).
The test asserted the opposite (policy withheld from the changeset) and only
"passed" before because readDraftChanges read the now-empty localStorage.
Assert the real model: create-policy + install-peer tracked, 3 changes total.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- connectNodes: drive React Flow's connection as its own paced pointer drag
(dwell on the target's full-area handle) instead of reusing the panel drag,
so group/peer/resource connections actually open the create-policy modal.
- Expose the React-only changeset on window.__ccDraftChanges in the test build
and read it from readDraftChanges (localStorage persistence was removed).
- Detect the policy modal by its heading ("Create New"/"Update Access Control
Policy"), not the policy-name field — that field lives on the Name tab while
the modal opens on the Policy tab. Reach the name field via its tab when a
test needs to rename.
- live: a policy opened via Edit or left-click opens the modal directly; the
"live mode" warning is deferred to Save. Assert that flow.
Fixes the reported connect/live failures; some later tests in these serial
suites (placeholder-peer changeset, peer→resource, …) are now exposed and
still need work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Align the control-center suites with the app as it stands and make the
components-panel drag helper reliable:
- Add data-testid to the components-panel category tabs and aria-pressed to
toolbar toggle buttons so tests can select a template's category and read
the panel's real open state (it only fades, so DOM visibility is unreliable).
- dragTemplateToCanvas: open the panel via the toggle's aria-pressed state,
then switch to the tab holding the template (peer/group/resource/network).
- Drop the localStorage/reload-restore assertions — draft state is React-only
(persistence was removed); the reload test now asserts the draft is
discarded on reload.
- live policy Edit opens the modal directly and defers the "live mode" warning
to Save; update the test accordingly.
- Fix stale/ambiguous deploy-flow locators (Review & Deploy heading; the
create badge reads "Add").
draft.spec is green; connections/matrix reach the node-to-node connect drag
and the live edit-warning test still need work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the loose top-level component files into intent-named directories
(contexts/, header/, menus/, panels/), relocate ConnectionLine into edges/,
and split the draft/ grab-bag by pulling the Draft* modals into
draft/modals/. Only file moves plus the absolute-import-path updates they
require — no logic changes. CLAUDE.md's directory description is synced to
the new layout.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove comments that restate what the code or a well-named identifier
already says, drop process/past-tense and commented-out-code notes, delete
pure divider banners, and relocate trailing comments above their code. Keep
and tighten the non-obvious why-comments (ReactFlow perf traps, ordering
constraints, lazy-fetch and magic-number rationale).
Comment-only: no executable code, types, JSX, or imports changed. Verified
via JSX-transform transpile comparison, tsc --noEmit, and the unit suite
(253 tests passing).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The onboarding survey opened a HubSpot booking modal for accounts with
50+ planned users. Removes the modal, its onboarding-call experiment
variants, the trigger in Onboarding.tsx, and the now-unused avatar.
Keeps src/cloud/cloud-hooks/useExperiment.ts, which this was the only
consumer of, for a future experiment.
ip.test.ts and version.test.ts were hand-rolled runners (console.log +
process.exit) excluded from the vitest run and executed directly with
node/tsx. Convert them to describe/it.each/expect and drop the exclude so
they run with the rest of the unit suite.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop the temporary 'do not commit' short-circuit so feature-lock
resolution runs its real logic again.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Drill-in defers the camera dive one frame so the drilled view (header
switch) paints before it starts, instead of competing in the same frame.
- Reveal waits for the swap to actually commit (afterSwapSettled) rather
than a blind delay, so a heavy swap can't steal the tween's first frames.
- Switching networks while drilled no longer re-snapshots the drilled
positions as the overview (frames collapsed on exit); snapshot is taken
only when entering from the overview.
- Add Resource in a drilled network keeps its cursor placement — save
skips the redundant re-assign that re-gridded it to center.
- computeFinalViewport slot lookup is O(1) instead of an O(nodes) filter
per child.
- Deploy button spinner stays centered: centering moved to a wrapper so
animate-spin's transform no longer clobbers the translate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Right-clicking the canvas in the drilled network view and adding a
resource dropped the card at the frame's next grid slot (centered),
ignoring the click point — unlike the non-drilled 'New Resource', which
creates at the cursor via createStandaloneAt.
Thread the right-click flow position through the resource editor
(createAt) into addResourceToFrame, convert it to the frame-relative
child position, and stamp drilledFreePos so useNetworkFrameLayout leaves
the card where it dropped instead of snapping it into the grid — the
same treatment a card dragged in the drilled view already gets. Exiting
the drill-down clears the marker and re-grids, as before.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The softer 700ms/zoom-in-[.97] entrance read as a position jump when
drilling into a network. Revert to the canvas reveal's fade/zoom timing
(450ms, zoom-in-[.7]) so the empty-state card settles in with the scene
instead of lagging behind it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dragging a standalone draft resource into a network frame left it at a
temporary slot (above the header) until the frame was moved. The reparent
in assignResourceToNetwork runs via reactFlow.setNodes, whose updater reads
the xyflow store — which at drag-stop still holds dragging:true — so
spreading ...n baked a stale drag flag into the child. useNetworkFrameLayout
bails while any node is dragging, so the reconciler never snapped the child
into its grid slot until a frame move cleared the flag.
Clear dragging on the reparented node so our own write can't trip the guard.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The floating "No Routing Peer" bar above a network frame rendered at the
header's 40px height, reading as too tall next to the node's other floating
overlays. Add a `compact` prop (h-[34px], matching the node's floating
"Install" button) and pass it only from the frame node — the drilled-network
header and live single-network header keep the 40px height.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reduce the comments added across recent control-center work to only
non-obvious whys; drop the ones that restated what the code does.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The folded group row in live frames read the policy-embedded group snapshot
(no counts -> "No Resources") while draft used fresh /groups data; live now
resolves the fresh group too, so both agree. Also soften the drilled
empty-network card's entrance (slower fade, subtler zoom) so it settles in
instead of flashing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Order draft nodes to match the live array order so React patches them in
place instead of moving their DOM subtrees on the switch, and defer the
switch past the chooser popover so its scroll-lock teardown no longer
thrashes the rebuild. Also index the build's per-item lookups (Map/Set)
to drop its O(n^2) scans. Profiled: switch INP ~1288ms -> ~104ms.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A grouped resource is folded into its group's row inside a network frame,
so it has no resource-<id> node of its own — the panel's on-canvas check
missed it, leaving it draggable. Re-dropping it spawned a duplicate
standalone node and drew a stray group->resource line from the folded row.
Treat a resource as on-canvas when it belongs to a group folded into a
frame (resourceGroupNode) on the canvas, so it greys out and can't be
re-added.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rubber-band select resource cards inside a drilled network and the
selection toolbar's Create Group now folds them into a new resource
group that lives in that network's frame. Drilled frame children are
made selectable (parent rows stay non-selectable to avoid full-width
graze), the toolbar positions from absolute bounds so it sits over frame
children, and the new group is placed at the frame-relative center of the
selection (drilledFreePos) instead of the bottom grid slot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
applyD3HierarchicalLayout placed every node via centerNodesVertically,
then ran a 100-tick d3 simulation whose forces were all no-ops
(zero-strength charge, zero-radius collision, a position force targeting
each node's own coordinate). It moved nothing and only blocked the main
thread on every view build — most visibly freezing the canvas on the
live<->draft switch. Read the placed positions directly and look up edge
endpoints via a Map instead of an O(edges x nodes) find. Layout output
is unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live network frames now represent a grouped resource by its group row
instead of also listing it as its own row, matching the draft build so
live and draft frames show the same rows in the same order. Align the
draft frame's resource input order with live, adopt the folded group
row's live twin size to stop a flash on the mode switch, and offer
Rename on folded existing resource groups (not just new ones).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Toggling resources in the group panel now previews the drilled
group↔resource edges (and subtitle counts) on the canvas immediately,
reverting on cancel and persisting on save. Drive the preview
imperatively from the toggle handlers instead of a selection effect so
opening a group no longer flashes a stale count, and drop the live-save
view rebuild so saving no longer refits/auto-arranges the canvas.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- The group→resource "simple" edge leaves from the group's right handle (sr)
instead of defaulting to the left one.
- Drilled view no longer auto-arranges on drop: each frame child is pinned
after its first (fixed-pitch) placement, so moving or absorbing a dropped
resource doesn't re-grid the rest. The parent view drops the pin and
re-grids as before.
- Entering draft no longer duplicates resources already shown in a group: a
resource that's a member of a group on the canvas and has no direct policy
connection is left off as a standalone child (the group covers it).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The policy modal now opens immediately in live mode; the "you are in live mode"
confirmation is deferred to when the user clicks Save Changes, via a new
onBeforeSave hook on AccessControlModal (awaited before it submits). Draft is
unaffected (useSave=false). The confirm-before-open was removed from the policy
left-click and the context-menu Edit in the prior commits.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Icon boxes light up on hover consistently: resource rows in live (was
draft-only), group nodes, and peer cards (DeviceCard's unnamed group-hover
now fires via the peer wrapper).
- The "+N more" cell no longer lights up when the whole frame is hovered (its
own `group/more` name instead of the frame's `group/node`).
- Restore hover on resource/destination groups in the live drilled view (drop
the stray hoverable:false); a live resource group drills from the overview
(onNodeClick), a no-op once already drilled.
- Drilled view no longer auto-arranges: the frame-layout reconciler keeps a
stable child order while drilled instead of re-sorting by position every
change, so moving/absorbing a node doesn't shift the rest.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add a "View Details" item (eye icon, top) to the network-frame right-click
menu that drills into the network — live and draft. (The policy-frame Edit
now opens the editor directly; its confirmation moves to save-time.)
- Drag a resource onto a group in the drilled view: it falls through to the
group-drop instead of just repositioning, resourceGroupNode is a valid drop
target, the dropped resource is absorbed (card leaves the canvas), and the
target group rings while a resource hovers it.
- Resource-group side panel now resolves its members (the panel matches
resourceGroupNode) and opens on the Resources tab for resource-leaning groups.
- New resource groups uniquify their name against live groups + pending creates
(fixes "group already exists" on deploy).
- A framed resource group behaves like a resource row: pointer + hover, drills
in live, opens the panel in draft.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- After a setup key is generated for a Server/Agent placeholder, poll /peers
(every 5s while any placeholder is waiting) so the upgrade watcher swaps the
placeholder for the real peer as soon as it registers. Self-terminates once
all waiting placeholders have upgraded.
- Badge reflects the waiting state: the canvas placeholder shows a spinning
Loader2 + "Waiting" (instead of "Install"), and the Review & Deploy install
IssueBadge shows a spinner + "Waiting" with its chevron — both still open the
install modal, and it still blocks deploy until the peer registers.
Wiring: InstallPeerChange.setupKeyId + markInstallPeerWaiting, set from
DraftInstallPeerModal.onSetupKeyGenerated; getChangeIssue returns a waiting
issue.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Source group nodes in the single-network view carried an onClick that navigated
to the whole group view, which was jarring from a drilled network. Drop it so
the click falls through to onNodeClick and opens the group's side panel, like
every other view.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Review & Deploy:
- Per-change deploy progress: the change being applied swaps its ⋮ for a white
spinner and the row pulses; done rows show a green check; changes stay listed
(skipped on retry) instead of being removed as they land.
- Deploy button shows a centered spinner at fixed width; button/Cancel disabled
and the modal can't be dismissed mid-deploy.
- On success: switch to live, close, then reset the changeset after close (no
empty-modal flash); a "Deploy complete" toast; errors keep the app's usual
red toast. The rows render against a frozen live snapshot so revalidation
can't flip a row to "Modify" mid-deploy.
Group/resource membership:
- The group POST/PUT sends resources as {id, type} objects (bare id strings are
rejected — "could not parse json"), via a resourceType resolver, in both the
deploy and the reviewed cURL.
- Live group/peer panel saves revalidate /policies (and /networks/resources) so
Save un-dirties and other views / the draft don't show stale counts; the
draft build reads group counts from fresh SWR /groups.
- Panels: Save/Assign show a fixed-width spinner while saving and close on
success.
- getGroupCountLabel leads with the larger side.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dragging a peer/resource gave every eligible group a white border
(dropEligible) at drag start, which read as noise. Remove it (styling, the
onNodeDragStart write, and the prop); only the group under the pointer keeps
its dropTarget ring. Drag-stop now clears any dropTarget directly, since it no
longer relies on dropEligible to clear the hovered group.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Right-click lag: the context-menu halo lived in CanvasUIContext, so every
node re-rendered on each right-click; and opening the menu flipped
nodesDraggable/connectable/selectable, which re-renders every node wrapper.
Move the halo to a per-node external store (useIsContextMenuTarget) so only
the target re-renders, and stop gating node interactivity on the menu (it
dismisses on any click/scroll anyway; pan/zoom stay locked via canInteract).
- Add the Focus item to the draft network-frame menu (the live frame menu
already had it).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Rename the "Highlight Connections" tool to "Focus" (Focus icon) across the
node menu, header pill, exit label and the e2e test; the F shortcut now
name-aligns.
- Remove em dashes from user-facing strings: the live-mode confirmations
(policy/resource/group/peer save, edit and toggle), the discard confirm, the
deploy error messages, and the no-network issue message.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Live resource edit in a drilled network crashed with "assignedPolicies is
not a function": the edit modal rendered NetworkResourceModal without the
NetworkProvider / NetworkAccessControlProvider that supplies it. Wrap it in
those providers, like the draft resource modal and the networks page.
- Rewrite the em-dash comments (and one confirm string) added in this PR into
simpler sentences.
Test: new e2e "edit a live resource inside a drilled network".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Live add-resource: revalidate SWR + reset layoutInitialized so the new
resource shows on the canvas without drilling in/out.
- Policy left-click in live mode now confirms first (like the menu Edit).
- Side panels: pin rows to a full ordered-id snapshot frozen per open
(pinByOrder) so a save's follow-up mutate can't reshuffle them.
- Group/peer panel live save: send resources as {id,type} objects (the API
rejected id strings with "could not parse json"); drive the toast off the
request promise so failures render red instead of a green success.
- Side panels reposition on window resize.
- Server/agent placeholders drop the hostname suggestion (they match by their
hidden bound group now); only user devices keep it.
- Review & Deploy opens the genuine first accordion (server/agent install
steps included).
Tests: 4 pinByOrder unit tests; new e2e in control-center-live and
control-center-draft-install.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Removing a change from Review & Deploy now reverts the draft as if the change
had never happened, cascading to the canvas AND to dependent changes (instead
of the old flat removeChange that left both out of sync).
- utils/change-cascade.ts (pure, unit-tested): reduceRemoveChange computes the
resulting changeset per type — create-* drop the change + dependents
(network detaches its resources to "No Network", group-by-name refs stripped,
a one-sided policy left behind is dropped); update-*/delete-* drop only the
target (reverting is a canvas restore). previewRemoveChange builds the
"warn with specifics" list.
- hooks/useRemoveChange.ts: the dispatcher — applies the changeset reduction and
the matching canvas mutation (remove nodes/edges, detach a network's
children, revert node data to live, or restore a deleted node via
drawPolicyOnCanvas / the new draft-node-factory). install-peer delegates to
removeNodeWithEdges (sweeps the setup-key / bound-group artifacts).
- utils/draft-node-factory.ts: pure builders (extracted from useDraft's
carryNetworkFrame) that rebuild a network frame / resource / group from live
data when a delete change is reverted.
- ReviewDeployModal / ChangeAccordionItem: route removal through the dispatcher
and show the cascade specifics in the confirm dialog; add cc-change-* testids.
Tests: change-cascade.test.ts (10 unit) + control-center-draft-remove.spec.ts
(5 e2e: create-network detach, create-group→policy drop, delete-network /
delete-policy restore, update-policy revert).
Test infra: suppress the cloud billing modal in control-center e2e via the
netbird-test-edition override (it isn't billing-gated); harden getApiContext to
wait for an authed /api response (avoids capturing a tokenless early response
right after a restart).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Comment-only cleanup over the changed files: keep comments only for
non-obvious "why", tighten verbose ones, and drop comments that restate
what the code already does. Also removes dangling references to the
deleted specs/*.md and a couple of stale comments that contradicted the
code. No code, behavior, or types changed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Handle agent-network settings defaults response
The management API now answers the settings GET with a defaults object
before the account is bootstrapped (empty cluster/subdomain/endpoint)
instead of a JSON null body. Normalize that shape to the existing null
settings signal so every consumer keeps a single not-bootstrapped check,
while still tolerating the null body and 404 from older backends.
* Pin the settings wire-shape normalization in a Playwright spec
The providers page must render the connect-first empty state for every
unbootstrapped settings shape the management API has answered with over
time (defaults object with an empty endpoint, JSON null body, 404) and
the endpoint badge once bootstrapped. The settings route is mocked per
test so the spec is independent of the backend build and of account
state left behind by other suites.
* Address review: no stale settings on 404, close context on setup failure
useFetchApi keeps the previous SWR data alongside the error, so a later
404 could expose stale settings through the memo; it now yields null
when the error is a 404 while still riding out transient failures on
the kept data. The wire-shapes spec closes its browser context when a
setup step throws before the close callback is handed to the test.
The onChange defer (fire after the ~180ms close animation) shipped globally,
delaying every dropdown in the app. Make it opt-in via `deferChange` (default
off = synchronous, the pre-existing behavior) and enable it only on the
control-center dropdowns whose onChange rebuilds the canvas (the entity
selectors and the header/title network selectors). The two lightweight draft
modal pickers stay synchronous.
Adds a component test pinning both paths (sync by default, deferred when set).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses the branch review findings (all but the intentionally-skipped
useIsFeatureLocked debug return) plus follow-ups from this pass.
Correctness fixes:
- Live routing-peer EDIT now PUTs instead of recording a dead draft change;
the draft frame path still records update-router (DraftRoutingPeerModal).
- Deploy resolvers persist client→real id maps across deploy() calls (+ live
network name fallback) so a partial-deploy retry no longer strands
network/resource dependents (useDeployChangeset).
- Review & Deploy discard of a draft network cascades (untrackNetwork).
- Group-absorbed placeholder peers now store/clean their setup-key + bound
group so no artifacts are orphaned (DraftInstallPeerModal, useDraftPeerUpgrade,
useDiscardDraft, useDraftGroupActions).
- trackUpdateResource drops a field-for-field revert; renameGroupInPolicies
follows into update-resource/update-router; trackDeleteNetwork cascade also
drops update-router/update-network.
- handleEntityChange no longer runs the d3 layout / side effects inside the
setNodes updater (pure updater) while preserving view-switch fitView.
- Live network delete removes the frame only after the DELETE succeeds.
- Undo/redo flush the pending debounced capture so an undo within the debounce
window can't overshoot or lose the in-flight edit (DraftHistoryContext).
- Live membership panels surface failures and re-sync (DestinationGroupPanel,
PeerGroupsPanel).
- isCompleteDraftResource checks the raw name; sortBy no-op direction arg
removed (behavior preserved); PeerNode reads placeholderIp from context
instead of a per-node account fetch; defensive create-router dedup.
Regression tests (run green on both main and this branch):
- New component tests for the app-wide shared components most affected:
SelectDropdown (deferred onChange contract), SegmentedTabs, Accordion.
CI:
- Add .github/workflows/unit-tests.yml running `npm run test:unit` on push/PR
(183 tests, no backend needed).
Docs:
- Remove the control-center specs/*.md design docs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A policy connected to a not-yet-installed placeholder peer (draft-… id) was
silently withheld from Review & Deploy: isDeployablePolicy gated tracking, and
a draft- peer reference made it false, so the policy was drawn on the canvas
but never entered the changeset.
Split the predicate: isTrackablePolicy (both sides set, draft resources tracked
— tolerates an uninstalled peer) now gates entry into the changeset, while
isDeployablePolicy stays the stricter deploy-time gate. The policy is listed as
an ordinary change; the deploy is still blocked by that peer's own install-peer
issue, and installing it re-records the policy with the real id via
usePlaceholderUpgrade.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove the "Add Resource Group" action from the live network-frame context menu
(and its create-group name dialog, handler, state, and now-unused imports). The
live frame menu is now Add Resource / Add Routing Peer / Delete. Draft mode's
Add Resource Group is unchanged.
Also fix the resource modal header: a draft standalone resource has no network
yet, so it rendered 'Add new resource to ""'. Show 'Add a new resource' when
there's no network name; keep 'Add new resource to "<name>"' otherwise.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live-mode control-center actions now hit the API immediately, since the draft
changeset can only be deployed from draft mode (a change recorded in live never
deploys). This reworks the previously changeset-based live network delete and
fixes the same latent dead-end in live network edit.
Networks (single-network top bar ⋮ + button):
- Edit -> immediate PUT /networks/{id}
- Delete -> immediate DELETE /networks/{id} + refresh, then deselect
- Add Resource -> real POST (DraftResourceEditorModal falls back to the API
network list, as the live single-network view has no frame node)
Network frame right-click (networks overview) — networkNode added to the live
context-menu allowlist, new live frame branch:
- Add Resource / Add Routing Peer -> immediate POST
- Add Resource Group -> Create Group name dialog -> POST /groups (empty group)
- Delete -> immediate DELETE /networks/{id}
Policy right-click: Delete -> usePolicies().deletePolicy (DELETE /policies/{id}).
Peer right-click (was View Details + Rename only): Delete -> DELETE /peers/{id}.
useDeleteNetwork is now mode-aware (draft: changeset; live: immediate API).
Draft mode behavior is unchanged. All live actions confirm first and mirror the
networks/peers/access-control page copy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the pencil edit button in the drilled single-network top bar with a
three-dots actions menu (⋮). It shows Edit in both live and draft; Delete
(existing networks) / Remove (draft-created) is draft-only, since deleting a
network is a draft/deploy flow with no live equivalent. Deleting the network
you're drilled into exits the drill-down.
Add an "Add Resource" button after the routing-peers bar in the draft
drill-down header (opens the resource editor targeting that network).
Extract the network-delete logic that was inline in NodeContextMenu into a
shared useDeleteNetwork hook so the context menu and the header confirm and
behave identically.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Virtuoso viewport was sized from estimatedItemHeight=34 while the real
row is ~32px, so the surplus rendered as a dead strip below the last row —
reading as more padding at the bottom than the top. Match the estimate to the
real row height so top and bottom gaps are equal.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The server/agent install-peer preview built auto_groups directly from the
group name ("<name> (Draft)"), bypassing the resolvers. The hidden bound
group's real id doesn't exist until the key is generated, so render it as an
id placeholder like the other not-yet-created ids.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Review & Deploy code view leaked draft names / client-ids where a real
API id gets filled in on deploy (e.g. a policy whose source is a draft group
showed the group NAME). previewResolvers now renders any id that doesn't
exist yet as an unmistakable {{KIND_LABEL_ID}} token:
- draft group (no id / draft-group name) -> {{GROUP_<NAME>_ID}}
- draft resource referenced by a policy -> {{RESOURCE_<NAME>_ID}} (name from
the create-resource change, threaded via LiveData.draftChanges)
- draft network -> {{NETWORK_<NAME>_ID}}; the path's old {new} -> {{NETWORK_ID}}
Real ids and live-group names still resolve exactly as before. Adds the
idPlaceholder helper and 3 preview tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Editing an EXISTING network or router in draft mode previously bypassed the
changeset and PUT to the live API immediately. Both now record a deployable
draft change instead.
Changeset (DraftChangesetContext):
- UpdateNetworkChange / UpdateRouterChange types + union, getChangeKind
("update"), getChangeApiCall (PUT /networks/{id}, PUT .../routers/{id}),
labels, and CHANGE_DEPLOY_ORDER slots after their create siblings.
- trackUpdateNetwork coalesces per network id and drops on revert to the live
name+description; trackUpdateRouter coalesces per router id.
Request bodies + deploy:
- networkUpdateBody / routerUpdateBody (same shapes as create), wired into
buildChangeRequest, the code-view before/after (network has a live before;
router is after-only — routers aren't in the global live data), and the
deploy executor.
UI:
- DraftNetworkEditModal: existing network runs the live modal in
useSave={false} mode -> trackUpdateNetwork; the frame label updates live.
- DraftRoutingPeerModal: API router -> updateRouterFromSelection (mirrors
addRouterFromSelection, incl. draft-group creation) -> trackUpdateRouter.
- useFrameRouterRows overlays a pending update-router onto its API row so the
edit shows on the canvas before deploy.
change-presentation exhaustive switches updated; 3 changeset unit tests added;
module CLAUDE.md corrected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Adding a routing peer no longer springs the dropdown open afterwards: the
empty-state "No Routing Peer" click can't latch the popover open behind the
suppressed (zero-row) list (preventDefault on the trigger).
- Clicking the ReactFlow canvas (or anywhere outside) now dismisses the
dropdown — a capture-phase pointerdown listener, since the canvas pane
stops propagation before Radix's bubbling outside-dismiss can see it.
- No first-row pre-highlight on open: VirtualScrollAreaList gains an opt-in
autoSelectFirst prop (default keeps combobox behavior); the read-only
routing-peers list passes false.
- Dropped the search box; trigger shows a caret-down (ChevronDown) instead of
the select up/down arrows; rows match the header network selector's sizing
(text-xs font-medium, py-1 px-2, nb-gray-910 hover) with balanced padding.
Rows keep the hover-pencil / click-to-edit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two issues when a network is drilled into while empty in draft mode:
- The drilled-in camera was framed from an empty keep-set, so its bounds
stayed Infinity and the viewport resolved to ±Infinity: a blank canvas
stuck at an invalid transform that couldn't be panned, with resources
added into the frame landing off to the side. Fall back to framing the
camera on the hidden frame's own rect when nothing is kept.
- A resource created into a drilled (hidden) frame had no measured size, so
React Flow kept it at visibility:hidden — it rendered but couldn't be
selected or dragged ("fixed, not really on canvas"). Seed initialWidth/
Height on creation so it's measured on mount and interactive immediately.
Verified in-browser: drilling into an empty network gives a finite,
pannable camera; the added resource shows centered, is draggable, and the
canvas pans.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Open group panel rings the framed resource group's icon box sky-500,
matching GroupNode's panel-active highlight and the framed-resource halo.
- Drilling into the single-network view (parent frame hidden) promotes the
framed resource group row to a full GroupNode card; it reverts to the flat
row back in the networks view — same drilled-child signal ResourceNode uses.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The ServerIcon glyph reads visually heavier than the bot/monitor/folder
icons at the same pixel size in the review & deploy list, so drop it 2px.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
In draft mode, clicking any resource inside a network frame now opens the
draft resource editor (was limited to new resource-new-… rows); clicking a
framed resource group opens the destination group panel.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The network frame's "Add Resource Group" action (addResourceGroupToFrame)
inserted a new draft group node but never recorded a create-group change,
unlike every other new-group path. The group never appeared in Review &
Deploy and no POST /groups ran on deploy; a later resource reference to it
by name would resolve to a bogus id. Call trackCreateGroup after inserting
the node so the create is tracked and coalesces with later rename/member
changes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Commit 0dc287c6 hid the all-networks selector when a draft was entered
from peers/users/groups by returning null for the whole
DraftDrillDownHeader when currentView !== NETWORKS. But that component
also renders the drill-down back button, network switcher, edit button
and routing-peers bar, so drilling into a network in such a draft hid
the entire header.
Gate the null return on the OVERVIEW state (!drilled) only. The
standalone all-networks selector stays hidden outside the networks view,
but once the user drills into a network the view-agnostic drill-down
header renders from any entry view.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Issue 1: the live single-network view showed "name - network" on resource
cards because they carry a draftNetwork ref (for the card look) but had no
signal to suppress the redundant inline suffix the way the draft drill-down
does. Carry an explicit `drilled` flag and hide the suffix on it.
Issue 2: draft drilled resources snapped back to their frame grid slot on
drop — useNetworkFrameLayout reconciled their positions every tick, while
live drilled resources are top-level nodes nothing repositions. Mark a
dragged drilled child free-positioned so the reconciler leaves it alone,
and clear the marker once it returns to the parent grid.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Show the drilled single-network "Create Resources" empty state and the
"Create New Network" empty state in Live mode, and wire their buttons to
the real networks-page modals (network → resource → routing peer) mounted
in place via NetworkProvider, so creating from the canvas no longer
navigates away.
- ControlCenterEmptyStates: add the drilled-empty-network state gated on
layoutInitialized + the drill transition finishing (useCanvasTransitionActive),
and fix the overlays being buried under the ReactFlow canvas by giving them
z-10 (matching the header/toolbar overlays). Drop the card chrome via the
new GetStartedTest cardClassName so the state floats over the canvas.
- GetStartedTest: optional cardClassName to override the Card background/border
(default unchanged for the ~30 table call sites).
- canvas-transition: expose FADE_IN/REVEAL/GROW_IN_FROM and a reactive
useCanvasTransitionActive store; settle an empty drilled view at
EMPTY_STATE_ZOOM instead of the dive-in zoom.
- NetworkRoutingPeerCount / DraftRoutingPeerModal / DraftNetworkEditModal:
make the network + routing-peer modals work from the live drilled view
(no frame node) — Add/status click POSTs a new router, edits PUT, and
results revalidate the relevant SWR keys.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The draft drill-down header rendered the network selector (incl. "All
Networks") based solely on frame-node presence, so adding a network in a
peers/users/groups draft made it reappear. Gate it on currentView ===
NETWORKS, which stays frozen on the entry view through a draft session
(the live FlowSelector is hidden and no draft action calls setCurrentView).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
When drilled into a network, its resources are still ReactFlow children of
the hidden frame. Dragging one triggered the frame-drag path (moving the
whole frame and every sibling), and the resource still rendered the floating
"No Network" bar even though it lives inside the drilled network.
Skip the frame-drag setup when the parent frame is the drilled network so
ReactFlow moves only that card, and gate the "No Network" bar on !hideNetwork
so drilled children never claim to be networkless.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adding a resource inside a drilled network flung the camera to a strange
position. saveDraftResource calls highlightNetworkNode, which fitViews to
the network frame to draw the eye to it. While drilled the frame is hidden
and the drilled world already fills the view, so fitting to the hidden frame
threw the viewport off. Skip the fit + pulse while drilled, same as adding a
resource in normal (non-drilled) draft mode.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Restore useNetworkDrillDown, useDraftNetworkActions, useNetworkFrameLayout,
and ResourceNode to their state before c5406d75. Drilled resources render as
flat frame-child rows again (useNetworkFrameLayout's drilled column branch),
dropping the reparent-based handling and the fixes layered on it (camera-jump
gate on add, add-during-drill positioning, empty-network empty state,
hide-inline-network-when-drilled) — they were causing strange behavior.
Kept: the "Draft your changes" empty-state removal, drill context-menu items,
drilled components-panel scoping, delete-network, and the Review & Deploy code
view.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- delete-network now shows a real diff: buildBeforeRequest reconstructs the
network (name, description, resources as {name,address}, routers) so the
code view renders it as an all-minus diff like the other deletes, instead
of "No request body."
- Remove the "No request body." and "Not an API request…" fallbacks: every
change has a request now (install-peer sends its POST /setup-keys), so
buildChangeRequest is non-null; the code view always renders a diff, falling
back to the request line only if a change genuinely has no body.
- Delete Visual mode entirely (unused — the modal hard-coded Code): remove
ChangeVisualView and changeset-fields, the view prop, and switch the live
type from FieldLiveData to LiveData (drops the now-unused peers).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a delete-network changeset type end to end:
- DraftChangesetContext: DeleteNetworkChange + trackDeleteNetwork (drops any
pending resource/router changes for that network, since the API delete
cascades them), plus kind/apiCall/label/deploy-order wiring.
- useDeployChangeset: DELETE /networks/{id} at deploy.
- changeset-request / change-presentation / changeset-fields: Review &
Deploy preview (bodiless DELETE), icon, title, type label, field rows.
- NodeContextMenu: existing network frames now offer Delete (confirm →
trackDeleteNetwork → canvas removal); draft networks keep Remove.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
While drilled into a single network, the components panel hides all
networks (existing + draft) and lists only that network's own resources —
scoping filteredNetworks/draftNetworks to empty and filteredResources/
draftResources to the drilled network. Applies to both the category page
and search; empty sections drop out automatically. Add New keeps only the
Resource template (the network template was already hidden when drilled).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drill-down (single-network draft view) fixes:
- Adding a resource no longer flings the camera: highlightNetworkNode skips
the fitView while drilled (the frame is hidden at an off-screen anchor).
- New resources no longer overlap the column: assignResourceToNetwork is
drill-aware and places them as free top-level cards at the bottom of the
drilled column (single writer); the drill hook only tracks them so exit
reparents them back into the frame.
- Empty-network drill lands on the centered "No Resources / Add Resource"
frame instead of an empty keep-set → NaN fit stuck at the dive-in zoom;
the first resource added hides the empty-state frame.
- useNetworkFrameLayout skips all frames while any frame is drilled (its
children are reparented out; touching them raced the reparent).
- ResourceNode hides the redundant inline "- Network" label when drilled
into the resource's own network (reparented cards are no longer framed).
Also: remove the "Draft your changes" empty state entirely (delete
DraftEmptyCanvas + its wiring in page.tsx and CanvasContextMenu).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Show the network selector AND the edit (✎) as one attached control in
both live and draft (previously live had selector-only, draft had a static
name chip + edit). The ✎ is a right-segment; the selector squares its right
corners when it's present. Live edit opens the real network modal (PUT) via
the always-mounted DraftNetworkEditModal.
- Draft selector: add min-w-[200px] + popoverMinWidth so its width matches
the live selector, and close it on canvas click (useCloseOnCanvasClick),
like live.
- DraftModeSwitcher: show the Live | Draft segmented control in both modes as
a persistent mode indicator (Draft active while drafting, Live switches
back); drop the showLiveTab gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Match server/agent placeholders to their installed machine by a hidden,
throwaway group instead of hostname:
- The bound group is created directly via POST /groups only when the setup
key is generated (SetupModal.resolveAutoGroups), rides on the key as an
auto_group, and the registering peer is matched by membership in it
(useDraftPeerUpgrade.findByGroup; hostname stays a fallback). It's never a
changeset entry, never shown, never used in policies.
- Naming: setup key "Draft <name>", group "<name> (Draft)" (random suffix
only on collision).
- Artifacts (setup key + group) are cleaned up once the peer is matched, when
the placeholder is removed, or when the draft is discarded/restarted
(usePlaceholderArtifacts + useDiscardDraft sweep).
Review & Deploy:
- Resolving an issue (Install / assign network) no longer closes the modal —
the fix stacks on top and returns to the changeset.
- Rows sort by the shared CHANGE_DEPLOY_ORDER so the list matches the real
deploy order (network before its resources, deletes last); install steps
first. Header count matches the button badge.
- install-peer rows are accordions showing the POST /setup-keys request they
produce at install time; smaller alert-triangle, chevron on clickable issue
badges.
Fixes:
- Connect-created policy node is centered between the two nodes (offset by
half its size) instead of landing down-and-right of the midpoint.
- Draft exit rebuilds the live view instead of restoring a snapshot polluted
by a mid-draft hot-reload (stale draft nodes lingering after Cancel).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Review & Deploy:
- A resource with no network and an uninstalled placeholder peer are now
tracked as hard issues (getChangeIssue/hasBlockingIssues) that block deploy.
- Issue rows show an amber badge (No Network / Install) in place of the
diffstat; clicking it opens the fix (network picker / setup modal). Issues
sort to the top, install steps first; install-peer rows show inline steps.
- Removed the summary callout; disabled Approve & Deploy shows a "Resolve
issues before deploying" tooltip.
Node context menu:
- "Details" -> "View Details" with an eye icon; separator before Delete.
Selectors:
- SelectDropdown gains optional controlled open/onOpenChange.
- Network selector (header) + on-canvas peer/user/group select nodes close on
a canvas click via the shared useCloseOnCanvasClick hook (capture-phase, to
beat the ReactFlow pane's stopPropagation); network selector gains a min
width.
Misc:
- Components panel: networks with no resources read "No Resources".
- "No network" -> "No Network"; draft tab lightens text on hover.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
Adding or dropping a resource now opens the editor first so an
IP/CIDR/domain is entered up front; the card is created only on save
(cancel leaves the canvas untouched). All entry points route through it:
canvas "New Resource" menu, the Resource template (drop/click), a frame's
"Add Resource" button, and the frame context-menu "Add Resource".
Standalone creates land a "No Network" card at the drop/click position and
stay out of the changeset until a network is assigned. Removes the now-dead
addResourceToFrameRef plumbing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
Rework Review & Deploy into a stacked accordion of changesets, each
showing its change as a GitHub-style JSON diff of the exact API request
that will be deployed.
- Add changeset-request.ts as the single source of truth for request
bodies; useDeployChangeset now shares these shapers so the reviewed
diff can't drift from what is sent. buildChangeRequest/buildBeforeRequest
reconstruct after/before payloads; toCurl renders a copyable curl using
the account's configured management origin (cloud or self-hosted).
- Add json-line-diff.ts (LCS line diff + diffstat) and a code view with
line numbers, +/- gutters, and a bounded scroll area.
- Accordion header: entity icon + name, request URL (click to copy as
curl), diffstat, and a more-menu (Copy cURL / Remove-with-confirm).
- Restrict the canvas group context-menu Delete to groups that can
actually be deleted (not IdP-issued, permitted, unused), mirroring the
Groups page via useGroupsUsage.
- Draft start chooser: New Empty Draft / From Current View with the Group
icon.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
Entering a network — drilling into a frame (draft) or the single-network view
(live) — now closes any open group/peer Details panel, which belongs to the
view just left. Fires only on the transition in, so a panel opened while
inside a network isn't force-closed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
- Hide "User Device" placeholder from the canvas context menu and the
components panel (renumber the context-menu ⌥ shortcuts); update the
interaction-matrix / draft-networks spec docs and the e2e specs that
exercised it (now use the Server placeholder).
- Group Details panel: derive assigned peers/resources from the changeset
(added/removed) unioned with node data, so an SWR mutate or canvas rebuild
no longer resurrects a removed member (panel + canvas now agree). Make the
unsaved-changes dialog danger: title "Unsaved Changes", Discard / Cancel.
- Assigning a resource to a network that's on the canvas zooms to the frame
and pulses its border (~2s) so the move is visible.
- Draft-created networks show a NEW badge in the "Assign a network" dropdown.
- Placeholder peers (Server/Agent) now get the blue selection ring like real
peers (showHalo matched only data.peer.id, which placeholders lack).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
Clicking the Draft tab now opens a popover chooser (styled like the
components panel) instead of entering draft directly:
- Blank Canvas: enter draft on an empty, pannable canvas with no start
screen (the user explicitly chose empty).
- Current Canvas: rebuild the draft from what's on the canvas, as before.
Details:
- DraftModeContext tracks startedBlank for the draft's lifetime; the
empty-canvas overlay (DraftEmptyCanvas) is suppressed for blank drafts.
- The empty-state interaction lock no longer applies to a blank draft, so
its empty canvas stays pannable/interactive.
- SegmentedTabs gains an activationMode prop; the switcher uses "manual" so
onChange fires only on click (not hover/focus), fixing flicker.
- The chooser popover uses Radix modal mode for reliable outside-dismiss
over the ReactFlow pane (which stops propagation) — no custom listeners.
- Draft tab holds its hover state while the popover is open, and is hidden
once in draft mode (Cancel is the way back). Live tab hidden for now.
- e2e helpers updated: enter via Draft tab -> Current Canvas; exit via Cancel.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
The draft changeset and canvas already lived in React context; localStorage
was just a persistence layer on top. Remove it so draft state is context-only
for the lifetime of the session. A mid-draft page reload now rebuilds from the
live view instead of restoring the pending draft.
- Delete draft-storage.ts + its test (both localStorage keys, serializers,
clearDraftStorage).
- DraftChangesetContext: seed changes from [] and drop the write-through effect.
- useDraft: remove the persisted-canvas restore branch and the debounced
saveDraftCanvas effect; clean up newly-unused symbols.
- useDiscardDraft: drop clearDraftStorage calls (clearChanges suffices).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015V8ir8CjY6KWUw8QbcdBcz
Zypper ignores the gpgkey= entry of a .repo file, so the yum snippet would
leave the repository key uninstalled on openSUSE. The new distro entry adds
the repository with GPG checking enabled and imports the key on refresh.
* Cover RPM-based distros and desktop app dependencies in the Linux tab
The manual-install section of the add-peer modal only covered Ubuntu via
APT. Replace the single Ubuntu accordion with a distro selector covering
Debian/Ubuntu (APT), Fedora (DNF), RHEL/AlmaLinux/Rocky (DNF), and Amazon
Linux (YUM).
The desktop app links GTK 4.10+ and WebKitGTK 6.0 but the released
netbird-ui packages do not declare them, so each desktop-app install line
names the packages explicitly and a callout states the minimum release
(Ubuntu 24.04, Debian 13, Fedora 43, RHEL 10 with EPEL). Distros without
the required stack get CLI-only instructions.
* Add e2e coverage for the Linux distro selector
- Live destination peer cards (ResourceNode standalone branch) get the
shared 64px card height instead of the old py-1 metrics
- Live standalone resource cards show "Name - Network" inline like
draft (only drilled views keep hiding it - the header names it there)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
"Discard changes to X?" read like dismissing the popup — the dialogs now
state the situation ("You have unsaved member/group changes") and spell
out that closing the panel loses the toggled assignments; the confirm
stays the short "Discard".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tab/search changes no longer remount the Virtuoso list (which painted
empty for a frame while measuring) — the mounted list scrolls back to
the top imperatively instead; the open/close remount for fresh
measurements stays.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Group/peer panels: no remount on target switch (motion key removed,
placement kept) — the slide-in only plays when opening from closed;
search/tab/selection still reset per target
- Peers, resources, and groups lists virtualize with react-virtuoso
through the styled scroll area (shared PanelVirtuosoScroller); lists
remount per target so scroll offsets don't carry over
- Edges (and their wide interaction path) get pointer-events: none —
no edge has a click action, so dragging over connection lines now
pans the canvas; replaces the dimmed-only rule
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Rename Focus to "Highlight Connections" (Waypoints icon): context menu
item, header pill text, exit aria-label. No ring on the highlighted
node (the dim is the signal) and no menu entry on it while active
- Availability relaxed: any node with an edge, as long as the canvas has
at least two policies
- Dimmed edges get pointer-events: none (incl. the wide interaction
path) so drag-to-pan works over them in highlight mode
- Draft entry from peer view: adopt live twin sizes BEFORE the build
layout — its overlap pass measured fresh nodes with an 80px fallback
and shoved the 60px-pitch policy column apart (huge gaps until Auto
Arrange re-ran on measured nodes)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Extract the peer page's Edit Peer Name modal into shared
EditPeerNameModal and reuse it from the control-center context menu
(existing peers only, permission-gated); saving PUTs the peer,
patches canvas nodes in place, and revalidates /peers
- User-device setup modal: "Select" -> "Assign" (header, step 2, button)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Peer, placeholder, select-peer, and select-user nodes all match the
group node's 64px height
- SelectGroupNode padding py-3 -> py-3.5 (same as GroupNode)
- DeviceCard default variant adopts the placeholder card's tighter
title/subtitle metrics so installed and pending peers read the same
- User select avatar on the peer icon-box surface (nb-gray-850)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Placeholder peers (user device / server / agent):
- Track pending installs as install-peer changeset entries: own "Install"
section in Review & Deploy, resolved by install/select or removal,
renames follow, deploy skips them (user steps, not API calls)
- User-device setup stepper modal (install NetBird -> select peer);
the canvas node drops its inline select, upgraded placeholders always
become plain peer cards
- Placeholders open the peer groups panel (click or Details); assigned
existing groups ride on the generated setup key as auto_groups
- Group panel lists absorbed draft members (held on the group node) with
NEW badge, IP/address placeholders, and alert CTAs: "Install or assign"
/ "Install" / "No network" (network picker works node-less via
assignHeldResourceToNetwork)
- Install hostname matching also scans group-held placeholders
Groups & policies:
- Group renames and membership changes propagate into the group copies
held by policy nodes/edges (policy-group-sync) so the edit modal and
PeerGroupSelector stay current
- New side groups added while editing a policy join their column
(same x, stacked below) instead of landing at the origin
- Group names: "All" reserved, duplicates rejected against canvas drafts
- Dropping into "All" rejected; All still mirrors draft peers added to
other groups (implicit membership, never deployed)
- No-network draft resources can join groups
- Delete/Backspace routes through the context menu's Remove semantics
(useNodeRemoval) instead of React Flow's raw deletion
Review & Deploy:
- Canvas warnings for undeployable states (placeholder-peer policies,
unassigned resources); modal stays open on partial failure so a retry
resumes; update-group deploys against fresh API state
- Focus mode is explicit only (context menu / header tool) - left-click
opens panels without dimming
- Drop-eligible groups show a white border mid-drag
Tests & docs: interaction matrix spec (specs/interaction-matrix.md),
three Playwright suites (lifecycle, connections, full matrix) on a shared
e2e helper, testids across draft controls, unit tests for canvas
warnings and policy-group-sync.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Live resources open the networks page's resource modal on click (PUT on
save) and their context menu offers Focus / Edit / Disable — every
action behind the live-mode warning; the canvas patches from the
response. Peer context menus gain Details (opens the groups panel);
live group Delete is dropped (Focus / Details / Rename remain). Dialog
confirms gain an opt-in dismissOnOutsideClick, enabled for all
control-center warnings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Clicking a peer opens the peer-side twin of the group panel — one Groups
tab listing every group ("All" excluded, draft-created ones included)
with assigned-first frozen order, search, and batch apply: draft stages
adds/removes into the changeset (canvas group nodes update in place),
live PUTs each changed group behind one warning confirmation. Same
chrome and close semantics (ESC keycap, discard guard, pane click), and
the clicked peer wears the panel halo — selectedPeerPanel lives in the
narrow DestinationGroup context so PeerNode can ring without
subscribing to CanvasState.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The live single-network view now runs its resource column through
orderFrameResources, so the drilled view, the draft drill-down and the
overview frames all agree (policy-reached resources first). The network
selectors (live + draft drill-down) size to their longest option label,
clamped to the old 256px as max.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Focus Mode is entered from the node context menus ("Focus", shown only
where it declutters — 4+ edges and 2+ policies in the neighborhood, via
isFocusWorthy) or the "F" shortcut; the header button is gone and the
top-center pill owns the key handling. Live right-click now also covers
groups (Details / Rename / Delete behind live-mode warning confirmations,
PUT/DELETE + canvas patch) and peers/resources (Focus).
The shared drilled layout sorts both group columns by name so the live
single-network view and the draft drill-down agree on the order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Focus Mode is now armed from a header button next to the mode switcher
(SquareDashedMousePointer, sky accents, "F", switcher-style shell): the
next node click picks the focus target — hover previews the ring, node
buttons are inert, selectors/edge-less nodes are unfocusable — then the
mode goes sticky: the target keeps a glowing sky ring (cc-focus-root),
on-path nodes stay clickable/movable (dimmed ones lock), group panels
open without stealing focus, and only Esc / the top-center pill's X /
the button exit. The pill (switcher surface, fully rounded) names the
focused node. Fit-view moves to "1" to free F.
Policy left-click opens the editor again (live and draft); the context
menu keeps Edit/Disable. Network frames order policy-reached resources
first, via one shared helper so live and draft frames agree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The destination group panel becomes a search + Peers/Resources tabs
editor (PeerGroupSelector-style rows and checkboxes): toggles edit a
local selection previewed on the node's count text, and Assign (draft)
stages ONE coalesced update-group change while Save (live) PUTs behind
the live-mode warning. Implicit closes (Esc, keycap, pane click) confirm
before discarding unassigned toggles via a shared close guard; Cancel
discards directly. The changeset/deploy pipeline learns member REMOVALS
(removedPeerIds/removedResourceIds + removedMembers node sets).
Panel chrome: components-panel surface, right-anchored full-height with
header-width tracking (in-place on width changes — no flash), toolbar
spring slide-in, singleton mount, frozen row order per open, and the
canvas pans the group node clear of the panel. Focus mode is skipped for
nodes without connections, and mode switches close the panel and drop
node selection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Virtuoso keeps its scroll offset across data swaps, so changing the
category (or entering/leaving search) landed mid-list at the previous
tab's position. Remount the list on category/search-mode changes, like
the existing open/close remount.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The draft build centered the frame grid on the measured midpoint of the
source/policy columns, which always landed a few px off the live
overview's fixed midline — and the live-frame anchor shift then pushed
that delta onto the columns, so peer/policy cards hopped a few pixels on
every live↔draft switch. Use the same fixed midline as live
(SOURCE_NODE_HALF_HEIGHT) so the geometry matches exactly and nothing
moves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Policies move from x 480 / -17 center offset to the shared x 500 / +14
anchor, sources drop their -30 half-height shift, and the frame grid
centers on the columns' midline instead — so a policy and its source
keep their world position when switching between the peer/user/group
and networks views. The draft build layout mirrors the same change to
keep entry/Auto Arrange parity.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Focus mode turns global nodesDraggable off so dragging pans, which also
froze the focused node itself. The dim effect now stamps a per-node
draggable: true on the focus root (overrides the global flag) and strips
it when focus ends — works for policy/peer/resource focus and the group
panel alike.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Clicking a policy or peer now enters focus mode (path highlight + blue
ring) in live and draft instead of opening the policy modal. Policy
editing moves to the right-click menu: in live it offers Edit and
Disable/Enable only — both behind a "you are in live mode"
confirmation — applying via updatePolicy and patching the canvas in
place through refreshLiveViewRef. No Delete in live.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On a controlled flow, instance.setNodes round-trips through
applyNodeChanges, which keeps replaced nodes at their ORIGINAL index —
so reparenting a resource that predates its frame (network drop
adoption, assign-to-network) left the child in front of the frame and
ReactFlow dropped the containment: correct parentId in state, card
rendered detached at frame-relative coordinates.
Reconcile the invariant centrally in onNodesChange (and heal persisted
snapshots saved with the bad order on draft restore). Also stamp the
owning network on policy-drop destination resources so they don't show
"No Network".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Assigning a resource to a network that isn't a frame yet stamps only the
ref; dropping that network later now adopts those resources into the
frame (and the create-network assign waits for the frame to reach the
ReactFlow store instead of racing it on a 0ms timeout).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Stragglers outside every layout column (e.g. a standalone resource in a
frames draft, type-bucketed at x 1400 inside the frame grid) could land
on top of another node. Add resolveNodeOverlaps to the shared draft
build layout: larger nodes anchor, smaller intersecting nodes are nudged
the shortest way clear plus a 40px margin, re-checked until free.
Detection is exact intersection so tight column rhythms keep entry-layout
parity. Unit-tested.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extract the draft build layout into utils/draft-build-layout.ts
(applyDraftBuildLayout) and use it for the toolbar's Auto Arrange, so
arranging an untouched draft matches the entry layout exactly for drafts
entered from any live view; drill-downs re-run the shared drilled layout.
Delete the divergent applyDraftArrangeLayout and its height-aware pitch
machinery.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Footer buttons follow the shared modal pattern (right-aligned, gap-3)
with the header's separator color; CTA renamed Save -> Assign Network.
- Network select: search inside the popover, popover matches trigger
width, list capped at 190px, placeholder "Select or create a
network...".
- New optional `footer` slot on SelectDropdown: content pinned below the
scrollable options (always visible regardless of scroll/search) — used
for "Create New Network", styled like a regular entry.
- Creating a network opens the Add Network form ON TOP of the picker
(nested modal); Cancel returns to the picker instead of closing both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
onBeforeDelete on the ReactFlow canvas: live mode blocks Backspace/
Delete entirely (the canvas mirrors the account); draft mode keeps node
deletion (edges cascade with their endpoints) but never deletes a
selected connection on its own.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The networks view stacked source and policy node TOPS on the column
midline while the frame grid centers frames on it, leaving a lone peer
~30px and a policy pill ~17px below their frame. Both the live overview
and the draft rebuild now subtract shared half-height constants.
Draft fixes this exposed: packFrameGrid also runs for a single frame
(previously left at the far layout column, so the live-anchor shift
dragged the columns ~350px out of line), and the frame-grid midline
falls back to the live twin's measured height instead of an 80px guess.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add Kimi (Moonshot AI) provider support to Agent Network UI
Pairs with the management catalog's new kimi_api entry:
- kimi_api in the AIProviderId union and the access-log provider-id
normalization list.
- Provider modal: api.moonshot.ai host placeholder, upstream-URL help
explaining the OpenAI-shape (/v1) vs Anthropic-shape (/anthropic)
path choice, sk-... key placeholder.
- Configure Your Agent: Kimi backend option in the Claude Code tab
(JSON + shell modes), a Kimi variant in the Codex tab using
wire_api="chat", and a new Kimi CLI tab with the ~/.kimi/config.toml
provider setup. All Kimi surfaces render only when a kimi_api
provider is connected, and pre-select themselves when Kimi is the
only provider of its shape.
- Onboarding defaults to the Claude Code tab for Kimi providers.
* Add Kimi provider e2e spec
Walks the Kimi lifecycle against the real backend: select kimi_api from
the catalog (prefilled host, catalog model pricing), connect it, then
assert the Kimi-gated Configure Your Agent surfaces (Kimi CLI tab,
Claude Code kimi-k3 config, Codex wire_api=chat variant) and clean up
via new agent-network API helpers. Skips when the management build
under test has no kimi_api catalog entry, so it can merge ahead of the
backend and activate once the management-cloud image carries it.
* Remove Codex option for Kimi and align Claude Code config with Moonshot guide
Codex has no clear support against Moonshot's upstream, so the Kimi
variant is dropped from the Codex tab. The Claude Code Kimi snippet now
pins all default model tiers and the subagent model to kimi-k3 and
disables tool search, per Moonshot's Claude Code guide.
* Carry the /anthropic shape prefix in the agent base URL for Kimi
The Kimi provider keeps its default https://api.moonshot.ai upstream;
Claude Code and Kimi CLI select the Anthropic shape by appending
/anthropic to the endpoint base URL, which rides through to Moonshot.
One provider now serves both API shapes.
* Kimi CLI uses the bare endpoint base URL
Only Claude Code carries the /anthropic prefix; Kimi CLI's anthropic
provider type points at the bare endpoint.
* Kimi tooltip
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Restored the note on the Kimi CLI tab
---------
Co-authored-by: braginini <bangvalo@gmail.com>
- Source columns (live peer/group/user views, user-view peers, draft
rebuild) share the destination column's 100px pitch instead of 80/120.
- Live destination resources show "Name - Network" inline like draft
(network ref stamped in addDestinationResourceNodes).
- Draft rebuild: dual-role groups (source AND destination) restack in
the destination column like the live view shows them.
- Mode-switch flicker: React Flow hides unmeasured nodes for one frame,
blanking the swapped canvas. Draft nodes now adopt their live twin's
measured size (initialWidth/Height), including renamed ids (self-ref
dest-group clones, destination resources/peers).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Policies were matched by rule.sources only, so a destination-only group
rendered an empty view. Those policies now render mirrored to the left
(sources -> policy -> selected group); source groups carry explicit
enabled state so they don't fall back to the incoming-edge check and
render dimmed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Keep architecture, layout/sort parity rules, changeset/deploy facts, and
the hard-won perf/camera gotchas; drop per-file trees and feature
narration discoverable from code. Fix stale claims (change types,
deploy order, provider names, focus-mode scope).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Peer/group/user-entered drafts used the networks-overview rhythm (160
base, policies 480/90) and scattered destinations across layout buckets.
Now frameless drafts use the live views' spacing (120 + DEFAULT_LAYOUT_
CONFIG), restack destinations as one x1000/100 column ordered like live
(groups first, then resources/peers by first policy edge), sort policies
with the views' sortBy, and name-sort destinations on group-view entry.
Existing destination resources get their real network stamped (no bogus
"No Network" badge), and the live destination-peer card sizes to content
(w-auto) like the draft peer card.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On client-side nav back to the page, nodes commit before fitView's
measurement wait completes and painted at the default viewport. The
first fit after mount now hides the viewport (cc-prefit, instant hide),
snap-fits without animation, and fades the scene in already framed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Live frames gain the draft chrome for real: Add Resource opens the
networks ResourceModalContent (real POST), routing bar Add + zero-state
open the real RoutingPeerModalContent; the Add band is reserved in both
modes
- Live frames contain destination resource-group rows like draft
(per-network ids); peer-only destination groups are skipped in the
networks view (live never drew them; networks-entered drafts drop them
+ their edges); draft group folding matches canDropGroupIntoNetwork
(one member resource in exactly one network, peers don't block)
- Identical geometry and order across modes: shared FRAME_GRID_BASE_X,
frame heights re-seeded after folding, group rows first, sources
(groups + source peers) as ONE 160-pitch column, policies at x480/90,
every column + the frame grid sorted by name
- Routing-peers dropdown polish: rows prefetch on trigger hover (no
skeleton flash), skeleton geometry matches the final list, exact list
height (no scrollbar for short lists), tighter search-to-rows gap
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
useGroupFocusDim and the focus drag-lock no longer gate on live mode;
className joins the history's transient keys so focus toggles never
create undo entries.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Networks overview builds source -> policy node -> network frame with
smart edges (like draft) instead of labeled straight lines; sources
left, policies middle, packFrameGrid right; frames whose policies are
all disabled dim (frame + child rows)
- AnimatedLine is a SmartEdge-style bezier with a midpoint label chip
(orthogonal channel router removed); drill-out reveal zooms out
- Focus mode (live): clicking a group opens its panel, clicking a
peer (user view) or resource card sets focusedNodeId; everything off
the node's path dims to grayscale (forward+backward closures) via
cc-dimmed className; dimmed nodes are non-interactive and clicks fall
through to the pane which exits focus; node dragging disabled while
focused (dragging pans; per-node draggable:true removed - it
overrides the global flag)
- User-detail view removed: previousSelectedUser breadcrumb,
forceSinglePeerView/forceSingleUserView, user-peer history level,
onForceSingleUserView
- Bigger frame grid gaps (280/200)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fly-out's reveal reused the drill-in's grow-in (0.7x -> fit), which
read inverted going back; direction "out" now starts at 1.45x and
settles outward, mirroring the dive.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
React profiler showed ~2700-fiber User-Blocking commits (120-170ms) on
every drag tick, hover flip and click. Root causes and fixes:
- DraftModeProvider context value memoized (hover state changes handed a
fresh value to every useDraftMode consumer = every node)
- Every callback/object prop on <ReactFlow> is identity-stable via
useStableHandler; inline callbacks defeated GraphView's memo so each
nodes update re-rendered the entire canvas subtree
- selectedDestinationGroup split into its own context (group click
re-rendered every node via useCanvasUI)
- Edges subscribe to endpoint rects via useEdgeNodeRect (value equality)
instead of useInternalNode; ResourceNode's parent-hidden check likewise
- elevateEdgesOnSelect off (edge DOM reshuffle restarted dash animations)
- Draft persistence + history capture skip while dragging and pre-check
structurally before stringifying; history ignores transient node state
- Lazy router-rows fetch for draft frames too; Add Resource button uses
a ref instead of mounting useControlCenterData per frame
- Components panel, PeersToolbar, DestinationGroupPanel, CanvasToolbar,
DraftEmptyCanvas subscribe structurally (useStructuralNodes), not to
the churning canvas context
- Drag drop-target highlight throttled to ~8px steps
- Live networks overview arranged like draft (sources left, packFrameGrid
staggered frame grid right; d3 force layout removed from this view)
- Draft build: resource-only destination groups fold INTO their network
frame; frames seeded with the capped grid; useAnySourceGroupEnabled
skips when enabled is explicit
Verified via Chrome trace on the live app: 4ms/s JS during a 125Hz drag
over 36 network frames, no long tasks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
destinationResourceNode gets standalone: true in the shared builder —
resource destinations route to the StandaloneResourceNode card, peer
destinations get the same card surface as PeerNode's card variant
(previously both were transparent rows).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Draft mode (not drilled) shows the top-left network SelectDropdown like
live: "All Networks" first, canvas frames sorted by name, picking one
drills in. Drill history entries are consumed deferred (150ms) so the
transient deactivation during draft/live switches reuses the entry
instead of racing history.back() — browser Back after switching modes
now exits to the overview instead of leaving the page.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
useDrillDownBrowserHistory tracks a stack of drill levels (network
drill-down, user-to-peer breadcrumb): entering pushes one same-URL
history entry, popstate exits through the same path as the UI back
arrow, UI exits consume the entry silently. SimpleConnection stroke
lightened from #595959 to #7d7d7d.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Warm SWR cache makes the view initialize before ReactFlow measured the
freshly remounted nodes; fitView now retries (bounded rAF loop) until
every target node has a measured size before fitting.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
getFirstGroup excluded All from the has-policies check, so an empty
non-All group could win over a populated All view. New order: non-All
group with policies, then All with policies, then any non-All, then any.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PeerNode now always renders the invisible AllHandles edge anchors
(GroupNode's pattern) so showHandles:false only hides the visible
connect bubbles instead of detaching edges.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
No more waiting on the SWR /policies revalidation (or a layout reset):
refreshLiveView rebuilds the current view with the saved policy spliced
in, keeping positions and camera; all view appliers accept a
policiesOverride and the policy modal reads the canvas node's policy
first in both modes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
utils/canvas-transition.ts: one continuous zoom stitched across an invisible
swap — accelerating dive/zoom-out + fade-out (half ease-in), swap while
transparent, grow-in reveal + fade-in (half ease-out) into a viewport
computed from the new scene. One-liner facades drillInto/drillOutOf (Node or
Rect targets) for any future drill-down; isCanvasTransitionActive suppresses
view-init fitViews mid-transition.
- Draft drill-down enter/exit refactored onto it (position-aware close-up on
exit, exitingRef guards the reconciling repair; frame layout + edge
attachment + row/card rendering key off frame.hidden so nothing morphs
while visible)
- Live network select dives into the clicked frame (dropdown picks zoom from
center), back flies out to the overview
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Backed out of the drill inside draft → live lands on the all-networks
overview instead of the stale drilled snapshot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- utils/drilled-layout.ts: ONE layout (applyDrilledLayout, 95px resource
pitch, getDrilledFrameAnchor incl. the column's +5 centerY offset) shared
by the live single-network view, the draft drill-down, and live→draft
- Draft drill re-lays the kept world out with it (parent positions
snapshotted, restored on exit with hidden flags + viewport); drilled frame
grid is a fixed-pitch single column, cards auto-size (no forced width)
- Live networks render as read-only frames (RoutingPeersBar without Add,
frame anchors/handles for edges, hover highlight, click/row-click drills,
bottom padding instead of the draft Add band); drilled resources render as
standalone cards in live too, with direct policy→resource edges
- Entering draft from live drilled carries the network as a frame and enters
the draft drill-down in the same commit (pre-hidden, no flash); exiting
draft while drilled lands in the live view of that network
- Live all-networks lines are blue with an All fallback label; peer sources
drawn in both live network views; NEW badge only for id-less networks
- Drill header: name chip matches the live selector (icon size/color,
typography, paddings), edit segment for all frames (existing networks open
the real network modal), RoutingPeersBar height/chevron aligned with the
fixed-height network selector; SelectDropdown defers onChange past its
close animation (no blink) and uses a 16px chevron
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extracts the frame's [status | Add] routing button group + searchable
routers popover into RoutingPeersBar (indicator, row type, peer-count and
sort helpers). NetworkNode consumes it unchanged; the live single-network
header's NetworkRoutingPeerCount now renders the same bar over the API
routers, with Add/edit navigating to the routing-peers tab. Status button
left padding 14px.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Matches the context menu's Add Resource (addResourceToFrame); the editor
still opens on row click.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Frame status button gains a ChevronsUpDown trigger and a PeerSelector-style
popover (search by peer/group name, no enter badge): one row per router with
muted OS icon + peer name or group badge + group name (peer count inline)
- Draft router rows open the routing-peer modal prefilled (editChangeId on
routingPeerModal); save replaces the create-router change
- Status counts peers, not routers: groups contribute their peer count,
disabled routers contribute nothing and render at 50% opacity, sorted last
- Floating bar nudged 2px left; NetworkRouter API routers of existing
networks are listed too (read-only)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Drag a group onto a network frame → converts in place to a resource-group
row inside it (same node id, policy edges re-attach to the frame). Eligible
when the group is empty, has a resource already in that network, or carries
unassigned draft resources (canDropGroupIntoNetwork, tested)
- Grouped standalone draft resources ride on the group node (data.draftResources);
dropping the group into a frame records create-resource changes assigning
them to that network with the group membership
- Frame children are selectable:false — full-width rows no longer join any
grazing rubber-band selection (phantom Create Group members)
- Create Group resolves draft resources via getDraftResource so their new-…
ids reach the group (count label, changeset membership, policy regrouping)
- Group count label leads with resources: "2 Resources, 1 Peer"
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Dragging from a resource onto a peer/group prefills the create-policy modal
with the resource as destination and the peer/group as source (framed
resources keep the network destination scope). Also: context-menu Add
Routing Peer uses Share2Icon, NetworkNode Add buttons use CirclePlusIcon.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Shared getTopZIndex (max settled z + 2, beating frames and their children)
applied in placeNode, dropExistingNetworkFrame, addNewGroup, and
onNodeDragStop — e.g. a peer dropped over a network frame paints above it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Removing an existing policy records an update-policy change with emptied sources/destinations (draft policies still just cancel their pending create)
- Components panel re-drop (and network/resource auto-drawn policies) prefer the pending update-policy state over API data, so a disconnected policy doesn't come back with its deployed sides
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Dropping an existing network/resource also draws the API policies targeting its resources (getPoliciesTargetingResources + drawResourcePolicies)
- Policy context menu Remove (CircleMinus, no confirm) removes only the policy node and edges, keeps sources/destinations on canvas, cancels pending create / drops pending updates
- Deletes (policy/resource/group) confirm: marked for deletion, deleted on Review & Deploy
- Group node removal strips the group from connected policies (like peers/resources); deferred policy sweep skips policies removed in the same cascade
- Remove icons switched to CircleMinusIcon; unit tests for the policy matcher
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The context menu's item-click and outside-click shared one onClose that
cleared the panel too, so "Details" opened the group panel then instantly
closed it. Split into onClose (menu only, for item clicks — stopPropagation so
it doesn't reach the document listener) and onDismiss (everything, for outside
click/scroll). Details now opens the panel and it sticks; outside click still
dismisses menu + panel in one click.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
centerNodesVertically is shared by the live hierarchical layout and the draft
auto-arrange; the height-aware pitch added for tall network frames broke live
column alignment (unequal per-node pitches). Make height-aware pitch opt-in
(auto-arrange only); live keeps a fixed pitch so equal-height nodes stay in a
straight line.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Dropped resources are standalone cards with an inline network label / "No
Network" picker (DraftResourceNetworkModal); assign via drag-into-frame or
the picker; extract StandaloneResourceNode
- Existing networks drop as full frames (dropExistingNetworkFrame) with their
resources as children; reparent an already-dropped resource instead of
duplicating its node id
- Refactor frame-ness to an explicit data.frame flag (isFrameNode /
isDraftNetworkNode); network-new- now means only "draft network", existing
frames keep their real id
- Resource context menu: Edit (all), Enable/Disable, Rename (draft), and
Remove vs Delete (existing framed) — wired into the changeset via new
update-resource / delete-resource change types + deploy PUT/DELETE; draft
enabled folds into create-resource
- Components panel: existing resources show "name - network" and can't drop
into a frame; resource drags highlight the target frame (white border)
- Frame z-layer so no node renders between a frame and its resources
- Auto-arrange stacks columns by measured node height
- Group node "Details" menu item opens the panel; policy left-click no longer
leaves a halo; misc spacing/badge/icon tweaks
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add "Add Resource Group" context-menu item (default group icon); blank
group rows drop first in the frame and count toward layout/overflow
- Group naming now consistent ("Group", "Group (2)", …) everywhere
- Resource groups: Rename + Details context menu, sky halo on right-click,
hover-only white ring during connects, "No Resources" count label
- Group node context menu gains "Details" (list icon) to open the panel;
clicking a group no longer toggles the panel closed (only outside click)
- Newly added resources/groups always land first in the frame grid
- Auto-arrange stacks columns by measured node height so tall network
frames (with floating routing bars) don't overlap neighbours
- Tune Add Resource button spacing (top gap + bottom padding)
- Remove routing-peer HelpCircle + HA tooltip; nudge "+N more" cell 1px
- Fix User Device select node NEW badge alignment
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- PeerNode: server/agent placeholder Install button uses the shared Button
(secondary, xs) to match the User Device select node.
- NetworkNode: rework the frame's floating controls — an "Add" resource
control and a routing-peers button group ([● status | + Add]) sized to
match the Install button (secondary, xs).
- Add a secondary "Add Resource" button in the frame body: centered when
empty, full-width bottom row once resources exist; opens the resource
editor. Reserve a bottom band for it in the frame layout (mutually
exclusive with the "+N More" overflow footer).
- Sparse frames (0/1 resource) match the two-resource width; empty frames
get a little extra height so the centered button breathes.
- Hovering the floating controls / add button no longer highlights the
frame or reveals its ConnectHandle (new ConnectHandle `hidden` prop).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
When creating a network resource and adding a policy with a single peer
(sourceResource) as the source, the payload included both an empty
`sources: []` array and `sourceResource`, causing the backend to reject
it with "specify either sources or source resources not both".
`createPolicyForResource` always computed `sources` as an array while the
`...rule` spread carried `sourceResource` through. This mirrors the
existing destinations handling: gate `sources` on `rule.sourceResource`
so it becomes undefined (and is dropped during serialization) when a
source resource is set.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rework the draft network frame's resource affordances:
- Move adding into a header "Add" dropdown (chevron) on the right of the
name/count, with Routing Peer (server icon) and Resource (resource
icon) items. Removes the separate "Add" button from the floating
routing-peer status pill and drops the always-present "Add Resource"
child row (AddNetworkResourceNode deleted).
- Summarize resources past the visible cap with a "+N More" footer
rendered by NetworkNode in a band useNetworkFrameLayout reserves at the
frame bottom (pointer-events-none, so clicking still drills in),
replacing the fade mask and the short-lived ResourceOverflowNode.
useNetworkFrameLayout is simplified to lay out only resource children and
sweeps legacy add-resource/overflow child nodes from persisted drafts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New draft networks are created without seeded resources: drop the
layout-testing seed (30 fake resources + 10 resource groups) from
addDraftNetwork so a network starts empty.
Every network frame — including a freshly-added empty one — now always
contains the "Add Resource" child row: useNetworkFrameLayout creates it
if missing and no longer removes it when the frame is empty (dead
obsoleteAddRows path removed). The centered "No resources yet" hint is
gone; the header subtitle reads "No Resources" when empty and the frame
keeps its header separator.
Also removes the bottom-fade gradient overlay from the existing-network
card's resource preview grid.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Resource editor gains a create-mode (frame's Add Resource row opens the
modal; the node is only created on save) and the provider nesting fix
for the resource-modal refactor; new DraftNetworkEditModal (name +
description) shared by the network context menu and drill-down header.
- Context menus: Edit items (SquarePen) for policies/networks/resources,
policy Remove vs Delete split (draft vs API), PencilLine renames,
Add Resource on frames, Policy above Group ordering.
- Components panel: draft peers/policies/networks listed with NEW badges
(IP placeholder, kind icons), "Networks & Resources" category with
existing networks droppable as live cards, virtualization measurement
fixes, panel hides once a real drag starts.
- Selection toolbar: Remove option next to Create Group, padding fix.
- Auto-names drop the "New " prefix ("Group", "Resource").
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Spec §10 implementation plus the frame interaction model:
- Connections: peer/group drops onto a frame or its contained rows open
the create-policy modal (source prefilled, destination scoped to the
network, one-way); POLICY↔network drags open the minimal destination
picker (DraftNetworkDestinationModal). Drag no longer creates routers.
- Policy edges to framed resources attach to the frame in the parent view
and to the actual resource in the drill-down (useFrameEdgeAttachment,
pure logic + tests in utils/frame-view).
- Drill-down: clicking a frame enters a live-mode-like single-network view
(no frame box, square-ish grid, back/name/edit/routing-count header);
hidden flags + viewport restore on exit.
- Routing peers: the frame button group and context menu open the networks
page's routing-peer modal; routers are changeset-only (no canvas nodes),
counts derive from create-router changes, deploy sends the modal's
metric/masquerade/enabled.
- Frame layout: 4x2 row-major grid capped at 6 visible resources with a
fade-out on the last row, always-visible Add Resource row, tunable
padding/gap/width constants, drop z-order fix for stacked frames.
- Node visuals: NEW badges after draft names, frame-hover highlights
header/border/icon boxes, placeholder select copy, min widths.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- NetworkModal, NetworkRoutingPeerModal and NetworkResourceModal gain a
useSave={false} mode: no API calls, values return via onSaved — the
draft canvas reuses the exact networks-page modals.
- AccessControlModal: destinationScope restricts the destination selector
to a network's resources/groups (no peers) and locks the policy one-way.
- PeerGroupSelector: groupIds whitelist (disables inline group creation),
initialTab (open tab without reordering triggers), scoped empty states,
and a default icon for type-less draft resources.
- ResourceBadge/PeerOperatingSystemIcon: default resource icon and
Server/Agent/User-Device icons for draft placeholder peers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
NetworkNode: RoutingPeersIndicator and AddRoutingPeerButton extracted
(shared by the draft frame and the live card). The invisible
whole-node target handle becomes handles/FullAreaTargetHandle, reused
by AllHandles, PolicyNode, and NetworkNode.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Frame children are draggable again (non-draggable nodes emit no drag
events — the gesture fell through to canvas panning). A drag-start
handler snapshots child + frame positions; each drag tick transfers
the child's displacement to the frame while snapping the child back
into its slot, so the whole frame (and every resource in it) follows
the cursor. Framed resources stay excluded from drag-into-group.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Restore ReactFlow's fall-through: frame children are non-draggable,
so a drag on a resource moves the parent frame (and everything in
it). Clicks still open the resource editor.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Dragging a non-draggable frame child fell through to dragging the
parent — contained resources now carry the "nodrag" class (clicks
still open the editor). Frame width reduced to 340px.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
specs/limitations.md: framed resources can't drag into groups (use the
editor's Groups field), routing-edge-only deletion leaves its router
change, network descriptions not editable on canvas.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
420px wide with a taller header (64px), roomier rows and padding;
contained resources keep spanning the frame width.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Contained resources are laid out by the frame: not draggable, and
spanning (basically) the full frame width; popping out of a removed
frame restores free dragging and auto width
- Network frame widened (360px) with slightly taller header/padding
and peer-style hover treatment
- Group nodes get a little more padding
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- No "Set up" affordance above incomplete resources — the dimmed
x.x.x.x placeholder and click-to-edit carry that state
- The resource editor no longer opens on drop (click / context-menu
Edit instead)
- Network frames: solid background with a dashed border
- Routing-peer indicator hidden entirely at 0 (the floating Add
Routing Peer button covers it); NEW badges removed from draft
resource and network nodes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Dropping a resource auto-creates a draft network FRAME around it —
a bordered, slightly opaque container node; the resource lives
inside as a ReactFlow child (frame grows per member, children pop
out at absolute positions when the frame is removed)
- Draft networks (panel template + editor inline-create) use the
frame rendering: header with name/NEW badge/routing traffic light,
"No resources yet" hint, floating Add Routing Peer button
- The draft resource node mirrors the placeholder-peer card: derived
type icon box, NEW badge, dimmed "x.x.x.x" address placeholder;
left-click and context-menu Edit open the resource editor
- Resources carry a single LEFT connect handle — dragging into a
policy sets it as the destination (source side rejected); network
assignment reparents into frames instead of membership edges
- Auto-arrange is parent-aware: child connectivity resolves onto the
frame, children keep their relative positions
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implements specs/draft-networks-resources.md (v1):
- Networks drop with a create-network change (unique auto-name,
deployable immediately); NetworkNode is draft-aware — NEW badge,
draft resource count/previews, routing-peer traffic light from
routing edges, floating "Add Routing Peer" button at 0 routers,
Rename / Add Routing Peer / Remove context menu (removal cascades
to dependent resource/router changes)
- Resources drop + open the new DraftResourceEditorModal (unique
name, validated address, network selector with API + draft
networks and inline create, optional groups/description);
incomplete resources carry an amber "Set up" affordance and stay
out of the changeset; completing one re-runs referencing policies
- Routing peers: peer/group → network connects (and the Add Routing
Peer install flow) draw "routes" edges and record create-router;
placeholder routers gate until install, then the upgrade sweep
records them with the real peer id
- Resources are destinations-only (hard-rejected as connect
sources); draft resources participate in policies with new-… ids
via additionalResources, join groups (deploy fans membership out
through the resource's own groups field)
- Deploy: groups → networks → resources → routers → policies with
networkClientToId / resourceClientToId resolution and live-modal
router defaults; Review & Deploy shows non-blocking warnings for
router-less networks and policy-less resources
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
User Device placeholder:
- Drops a canvas node like Server/Agent, rendered as a live-style
peer-select dropdown ("Select user device..."); choosing a peer
upgrades the node in place and keeps the dropdown so the selection
can be switched — policies and edges follow the new peer
- Install buttons float top-left above all placeholder nodes (inside
the node so they zoom with the canvas), secondary styling
- Placeholder ids renamed new-<uuid> → draft-<uuid>
Group membership follow-through:
- Grouping/dragging placeholders records them as members with their
draft ids; on install/select the id is renamed across the changeset
(replacePeerIdInGroups) and group nodes' addedMembers; deploy
filters never-installed draft ids
- Group counts/addedMembers update on every canvas instance of a
group (source node + destination copies)
- Policies referencing a grouped or removed peer/resource are rewired
(group takes the side) or cleared (side emptied) — an incomplete
policy drops its pending create/update so broken state never deploys
Other:
- Peer view → draft: the picked peer is skipped when a canvas group
already contains it (was overlapping the group node)
- Auto-arrange vertical spacing increased (160/80/160)
- Connect rules extracted to utils/draft-connect.ts and capability
predicates to utils/node-capabilities.ts (pure, unit-testable),
wired into NodeContextMenu + useDragToGroup
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Components panel & context menus:
- Panel not-found state matches the global search modal styling
- Context menus (canvas + node) flip away from viewport edges
- User Device template delays panel close so its modal opens first
- Template icon boxes match existing entities (solid bg)
Placeholder peers (Server / Agent):
- Node mirrors the real peer card (layout, text sizes, truncation);
IP slot shows a dimmed placeholder from the account network range
- Unique per-drop names ("Agent", "Agent (1)", ...), renamable via
context menu with uniqueness check across draft peers
- Selectable in policy modals (additionalPeers in PeerGroupSelector)
and connectable like real peers via their draft-<uuid> ids
- Install modal suggests a unique hostname (netbird up --hostname),
stamped on the node; useDraftPeerUpgrade watches the peers list and
swaps installed placeholders for real peers in place, re-recording
their policies into the changeset
Policies in draft:
- Policy template drops a blank policy node (no modal) named
"Policy" / "Policy (1)"; blank/undeployable policies stay out of
the changeset until they have both sides and no placeholder refs
- Peers can be dragged onto policy sides (single-peer XOR groups)
- Connect prefills the create modal (peers as peer resource, groups
as lists) and resets stale prefill state on every connect
- Peer selector dropdown opens on the tab of the current selection
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Migrate peer/group/user/network view policy edges from the DirectionIn
edge type to SmartEdge, enabling bidirectional rendering and dynamic
side selection in live mode. DirectionIn and BidirectionalEdges remain
registered but unused.
- Persist draft changes and canvas to localStorage, restored on mount
- Snapshot-based undo/redo for canvas and changeset (DraftHistoryContext)
- Review & deploy modal with grouped changes and deploy changeset hook
- Discard draft flow and leave guard for unsaved drafts
- Group rename modal and draft node creation hooks
- Move components panel into draft/ and adjust related UI
In live mode on the networks tab, the header network selector now only
renders when there is at least one network, matching the empty state
shown by ControlCenterEmptyStates.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make Agent Network menu available via dashboard_features.agent_network
Wire the new dashboard_features account setting into the dashboard at the API
level: add it to the Account settings interface (so settings updates round-trip
it) and have useAgentNetworkMode treat dashboard_features.agent_network === true
as enabling the Agent Network menu alongside the full dashboard. Unlike
agent_network_only it does not focus the dashboard, and it does not trigger the
onboarding flow. No settings-menu UI yet; the field is set via the API.
* Add e2e coverage for dashboard_features.agent_network menu availability
* Set dashboard_features for existing netbird.ai accounts
The signup-source flow only handled new accounts (agent_network_only) and
discarded the source for existing accounts, so nothing set dashboard_features.
Branch on account existence: new accounts get the focused view, existing
accounts get the Agent Network menu made available via
dashboard_features.agent_network. Adds e2e coverage for the existing-account
write.
* Also enable Agent Network menu for new netbird.ai accounts
New accounts got agent_network_only (focused) but not
dashboard_features.agent_network, so turning the focused view off later would
remove the Agent Network menu entirely. Set both on new accounts so disabling
focus degrades to menu-available rather than losing access.
* Match badged nav labels by substring in dashboard_features e2e
* Treat agent network deployment config as a floor over account setting
* Add agent network env x signup-source e2e matrix with a config override
Accounts that sign up through netbird.ai are focused on the Agent Network
surface and taken through the Agent Network onboarding. Reversible by the user
and a no-op for every other account.
- Capture ?signup_source=netbird.ai pre-auth (survives the OIDC redirect); once
authenticated, mark new accounts with settings.agent_network_only, awaiting
/accounts revalidation before clearing the source so the view never flips.
- useAgentNetworkMode() resolves the mode with nullish semantics: an explicit
account setting (true or false) wins over deployment config; when absent, a
pending netbird.ai signup or NETBIRD_AGENT_NETWORK_ONLY/_ENABLED decides.
Purely additive — unchanged behavior when the setting is absent.
- Navigation, the agent-network route guard, control-center, and fetch gates
read the resolver instead of the config flags.
- Onboarding: the form is chosen from signup_source synchronously, so netbird.ai
arrivals see the Agent Network signup form (now shown on cloud) and never the
regular form, even under a slow backend.
- Client Settings gains an "Agent Network focused view" opt-out toggle.
- E2E coverage for focused-view menu/routes and onboarding form selection.
* feat: default billing to EUR only, preserve USD for active subscribers
Removes the USD/EUR currency selector from Plans & Billing. New
subscriptions, MSP tenants, and distributor customers now default to
EUR; any existing active USD subscription keeps its real currency so
its price stays accurate.
Also fixes a latent bug where MSP/distributor per-tenant pricing was
computed off the admin's own account currency instead of each
tenant's, pins AWS Marketplace checkout to USD since it's a separate
billing rail, and removes an unused dead TotalCost stub from the MSP
Tenants table.
* move currency helper into provider
* force usd for aws
* fix flaky setup key test
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Show management API request id in error notifications
Newer management servers return an X-Request-Id header on every response,
including errors. Surface it in the error toast so it can be quoted in
support tickets.
- api.tsx: read X-Request-Id from the response and attach it to the
rejected ErrorResponse (both the JSON-body and status-text paths).
- Notification.tsx: render a copyable "Request ID" line whenever an error
carries one, covering the promise-based mutation notifications.
- ErrorBoundary.tsx: thread the request id through for GET/fetch errors.
The line is only shown when the header is present, so older servers that
do not send it are unaffected. Adds an e2e spec covering both cases.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* docs: add request-id error toast screenshots for PR
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: expose X-Request-Id via CORS in e2e mock
The dashboard reads the request id from a cross-origin response, so the
browser only surfaces the header to JS when the response lists it in
Access-Control-Expose-Headers. Mirror a CORS-enabled management server in
the mock so the test exercises the dashboard logic rather than the header
being filtered out cross-origin.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: assert error toast via data-testid instead of text
Add a notification-title testid to the toast and target it with
getByTestId in the request-id spec, following the repo convention of
selecting by data-testid rather than brittle visible text.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Overlays feature/control-center-edit's control-center paths onto main:
new draft/ mode with canvas toolbar, keyboard shortcuts, drag-to-group,
create-group modal, connect-handles for drawing policies, SmartEdge
routing, and refactored ControlCenterContext into CanvasState + UI +
Policy providers. Adds hooks/views split (peer/group/user/network).
AccessControlModal + useAccessControl gain initialSourceGroups /
initialSourceResource so draft-mode policy creation can seed the source
side (previously only destination could be pre-filled).
Unrelated cloud-repo changes (data-testid -> data-cy renames, DNS,
reverse-proxy, integrations, etc.) are excluded.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add Metrics settings tab with metrics push toggle
Add a dedicated Metrics tab to Settings with a toggle for enabling
anonymous performance metrics collection. Moves metrics out of the
Clients tab into its own tab with description and docs link.
* Update docs link
* fix(docker): reload nginx after patching CSP header
nginx is started by supervisord (priority 100) before init_react_envs.sh
(priority 201) and is never reloaded afterwards, so it keeps serving the
static default.conf CSP that has no connect-src. Over plain HTTP this blocks
OIDC discovery and the management API, breaking browser SSH/RDP auth.
Reload nginx at the end of the init script so the dynamically built CSP
header takes effect.
* Update docker/init_react_envs.sh
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(docker): log nginx -t output on failed CSP reload
When the reload never succeeds, run nginx -t before exiting so the logs show
whether the patched config is invalid or nginx never came up.
* conditionally emit `upgrade-insecure-requests` in CSP
---------
Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Gate premium endpoints so the open-source dashboard stops calling
endpoints the open-source management server does not serve:
- MSP/Distributor: only fetch /integrations/msp, /integrations/msp/switcher
and /integrations/msp/reseller on NetBird Cloud
- EDR bypass: only fetch /peers/edr/bypassed when licensed
- Event Streaming: gate /integrations/event-streaming GETs on the license
in addition to the existing permission check
- useIsLicensed: cache the licensed-only probe result (per API origin, 1h
TTL) so it no longer re-fires on every page load
- Team > Users: show the Identity Provider Sync tile in open-source mode so
IdP sync remains discoverable
Brings the unified dashboard into the open-source repo. Premium features
ship in the open code, gated at runtime via NETBIRD_CLOUD and
NETBIRD_LICENSED, with upgrade prompts for unlicensed self-hosted
deployments. Adds the cloud-only feature areas (billing, integrations,
MSP, traffic events, notifications) and the Playwright e2e suite.
* feat: private service expose
Dashboard surface for the netbird private-service feature: the
reverse-proxy modal gains a Private toggle and the target modal gains
a Direct-upstream option with custom upstream host, both feeding the
backend's Service.private + target.direct_upstream / target.host
fields. The Proxy Events page wraps its table in PeersProvider so
peer-name fallback resolution works for tunnel-peer callers.
Reverse-proxy modal changes (ReverseProxyModal.tsx):
- Private toggle that pivots the modal between standalone and cluster
target types and auto-injects the cluster target.
Reverse-proxy target modal changes:
- Direct upstream toggle (target dials via the host stack instead of
the embedded NetBird client).
- Custom upstream host input revealed when Direct upstream is on.
- New ReverseProxyClusterTargetSelector + ReverseProxyAddressInput.
- useReverseProxyTargetOptions updated for the new option shape.
Proxy Events table:
- Reuses across the reverse-proxy events surface; UserCell falls back
to the peer name when no user is attached to the call.
* feat(reverse-proxy): move NetBird-only access to auth tab + access groups
Restructures the Private (NetBird-only) flow so the auth model is
clearer:
- Removes the 'Private (NetBird-only)' toggle from the Service main
page. Service mode is the only primary choice now.
- Adds a 'NetBird-only access' toggle on the Authentication tab, gated
on serviceMode=HTTP and selectedDomain.supports_private===true. When
the cluster doesn't support it, the toggle is disabled with an
inline note explaining why.
- Adds an Access Groups picker (PeerGroupSelector) inline on the auth
tab when NetBird-only is on. Replaces the previous bearer-auth
distribution_groups overload — these groups go on the new
service.access_groups field on the wire.
- When NetBird-only is enabled, all other auth modes (SSO, password,
PIN, headers, link) are hidden — the inbound peer's WireGuard
identity is the only auth path.
- Adds a 'Direct upstream' toggle to the Advanced settings tab,
gated on isPrivate + cluster supports private. The toggle is
service-level in the UI; on save it patches the (single) cluster
target's options.direct_upstream.
- togglePrivate now also clears bearer/password/pin/header/link
state when entering private mode (strict mutual exclusivity).
* fix(reverse-proxy): tighten NetBird-only flow per review
Five fixes from the first cut:
1. Auth-tab design mismatch. The NetBird-only block was an inline
FancyToggleSwitch + inline PeerGroupSelector. It now follows the
same SettingCard.Item pattern as SSO/Password/PIN/Headers: a
clickable row showing enabled state that opens a dedicated modal
(AuthNetBirdOnlyModal) where the access groups are picked.
2. Trimmed wordy NetBird-only description down to one line.
3. Trimmed wordy Direct upstream help text.
4. Removed the per-target Direct upstream toggle from the target
modal. Direct upstream now lives only at the service level (under
Advanced settings) for private services. Cluster targets still
imply direct_upstream via the existing sanitizeTargets path, so
the wire stays correct.
5. togglePrivate no longer drops the user's existing targets when
entering private mode. The previous behavior silently dropped any
non-cluster targets the operator had configured, leaving the
targets list empty and the Save button disabled. Now: targets
stay put, canSaveService gates on 'all targets are cluster type'
so the Save button accurately reflects what the backend will
accept, and an inline warning explains what to fix when the
constraint isn't met.
The AuthNetBirdOnlyModal requires at least one access group before
Enable becomes clickable, mirroring the SSO modal's pattern.
* fix(reverse-proxy): allow any target type on private services
The cluster-target restriction was a holdover from the previous
auth-by-bearer-groups model where only cluster targets exposed a
proxy peer that could host the ACL. With the new access_groups path
the ACL is server-side and works regardless of how the proxy reaches
the upstream.
- Drop the inline 'Private services only support cluster targets'
warning.
- canSaveService no longer requires all targets to be cluster type.
- Service-level Direct upstream now applies to every target (cluster,
peer, host, domain) when private, so the operator can mix target
types and still control the dial path globally.
- Tightened NetBird-only description to '...connected peers in the
selected NetBird groups.' (per review).
- Tightened Direct upstream help to '...reachable without a Wireguard
connection.' (per review).
A future iteration may add a dedicated cluster-only mode with its own
guided flow; for now the operator picks whatever target types suit
their topology.
* fix(reverse-proxy): count NetBird-only access as protection
The 'No Protection Configured' popup fired even on private services
because isUnprotected only checked the password/PIN/bearer/header/link
auth modes. NetBird-only access is also a form of protection (tunnel
identity + access groups), so include isPrivate in the gate.
* fix(reverse-proxy): show NetBird-only auth and resolve access group names
Two display bugs for private services:
- ReverseProxyModal seeded accessGroups with {id}-only stubs, which
made useGroupHelper skip its ID→Group resolution and render empty
pills in the NetBird-only modal when editing an existing service.
Pass the raw string[] so useGroupHelper resolves full Group objects
with names against the GroupsProvider.
- ReverseProxyAuthCell only inspected password/pin/bearer/headers
auth flags, so a NetBird-only service displayed "No Auth" in the
services table. Add a NetBird-only entry that counts toward the
auth badge, renders as "NetBird Only" with the CircleUser icon
when it's the single auth, and lists the access groups (name +
user count) in the hover.
* feat(reverse-proxy): unify proxy-cluster target into the peer/resource selector
Operators picking a target for a service now see Proxy Clusters as a
third tab alongside Peers and Resources, gated on at least one cluster
advertising supports_private. When the service already has a proxy
cluster the tab lists only that cluster; when it doesn't, picking a
cluster commits it as the service's domain. The dedicated private-mode
cluster picker is removed in favour of this unified flow.
Selecting a cluster target now also auto-flips the service to
NetBird-only, since cluster targets are only reachable over the
WireGuard overlay and SSO/password/PIN advertise an auth path no
public client could exercise. The Access Control tab carries a note
explaining that an allow rule for the account's NetBird network range
is applied automatically alongside any operator-configured rules.
PeerGroupSelector gains opt-in showClusters/clusters/selectedCluster/
onClusterChange props plus a Proxy Clusters tab in its TabsList; the
tabOrder union widens to include "clusters". All call sites that don't
pass showClusters render unchanged.
* fix(reverse-proxy): polish private-service copy and lock Direct Upstream for cluster targets
Title-case NetBird-Only Access and Direct Upstream so the labels read
consistently across the auth tab, the dedicated modal, and the
services-table auth cell.
Cluster targets are reached via the embedded proxy's host network
stack and have no WireGuard endpoint to fall back to, so toggling
Direct Upstream off would silently break them. When any target is a
cluster the toggle is forced on, the FancyToggleSwitch is disabled,
and the helper text explains why. The save path writes the locked-on
value to every target's options.direct_upstream so the persisted
state matches what the UI shows.
* fix(reverse-proxy): support dynamic placeholder and restrict input to IPv4 or IPv6 when required
* fix(reverse-proxy): rename "Agent" to "Peer" in events user cell tooltip
* feat(reverse-proxy): gate NetBird-Only + Direct Upstream on cluster capability
When the selected cluster doesn't have at least one connected embedded
proxy (`netbird proxy`), the NetBird-Only Access and Direct Upstream
controls are visually disabled with a tooltip explaining why, instead of
silently no-op (NetBird-Only) or hidden (Direct Upstream).
- ReverseProxyCluster interface gains the optional `private` flag that
the management API now exposes on /api/reverse-proxies/clusters.
- ClustersFeaturesCell renders a new "Private" badge for clusters whose
`private === true`, matching the other capability badges.
- SettingCard.Item gains a `disabled` prop: opacity-50 + cursor-not-allowed,
click/keyboard guarded, Add/Edit button greyed out. No visual change
for existing usages (default false).
- ReverseProxyModal:
- NetBird-Only Access card is now wrapped in a FullTooltip that
activates only when the cluster lacks support; the SettingCard.Item
is rendered with `disabled` in that case. Description text stops
switching based on cluster state — the tooltip explains the gate.
- Direct Upstream toggle is no longer hidden when supports_private is
false; it stays visible and disabled (alongside the existing
hasClusterTarget locked-on case), wrapped in a tooltip explaining
the cluster requirement. Existing private services whose cluster
lost the capability now show the control disabled rather than
vanishing.
* disable button when no group were selected
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Feature/private service expose update (#651)
* feat(reverse-proxy): refine UI state and copy for NetBird-Only and Direct Upstream controls
- Default `Direct Upstream` to `false` for peer/resource targets; enhance tooltip descriptions.
- Improve conditional rendering of `NetBird-Only Access` setting with appropriate tooltips for unsupported clusters.
- Add cluster badge interaction in `PeerGroupSelector` and dynamic placeholder handling.
- Simplify `ReverseProxyTargetSelector` messaging for proxy forwarding options.
- Enhance `ClustersFeaturesCell` with richer description for the "Private" badge.
* refactor(reverse-proxy): improve tooltip and modal text for clarity
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Splits the Peers sidebar entry into User Devices (/peers/users) and Servers (/peers/servers), with /peers redirecting to User Devices and a shared kind filter splitting peers
by whether the owner is a real user vs a service/no-user. The Servers page description and an inline link replace what was the old "Setup Keys" sidebar item under Peers.
* feat(reverse-proxy): rebuild self-hosted page as Clusters with type + features
The Self-Hosted Proxies page was account-only by design but the
underlying API already returned every cluster the account could see.
Lifting that filter and renaming the page surfaces shared clusters
too — operators can see what NetBird-deployed clusters are reachable
alongside their own self-hosted ones, with online status and feature
support visible per row.
ReverseProxyCluster matches the new backend shape: `type`
(account/shared), `online`, and the three capability flags. The
`isSelfHostedCluster` provider hook now compares against `type ===
account` instead of a deprecated boolean.
Page folder renamed self-hosted-proxies → clusters (history-preserving
git mv). Table columns: Cluster (with an EphemeralPeerIndicator-style
icon next to the name marking account vs shared and a colored dot for
online status), Connected Proxies (plain numeric), Features (one
tooltip-backed badge per supported capability), Actions (Delete only
on account-owned rows; shared clusters render an empty action cell).
Empty state shows when the list is fully empty with a doc link in the
page header. Sidebar entry restored under Reverse Proxy.
* Update record in modal, update doc link, update modal title
* update reverse proxy documentation links to latest anchors
* update cluster modal description to "proxy cluster" instead of "self-hosted cluster"
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Add new pull request template + enforce documentation acknowledgement in new workflow
* fix docs-ack workflow: pass PR number via env and simplify checkbox validation
* Add layer 4 proto support
* Fix initialResource fallback and UDP session_idle_timeout
* Fix tlsResourceId init for resource-driven create flows, UDP timeout label
* Address PR review: ServiceMode enum, resource init fix, modal title, a11y
* Add L4 protocol values to ReverseProxyTargetProtocol, remove unsafe double cast
* Add aria-labels to L4 port/host inputs
* Unify domain input for all service modes including L4
* Support L4 proxy events
* Fix custom port reset on edit and show port in L4 service link
* Remove redundant listen port from L4 target cell
* Show link only for HTTP/TLS services, copy-on-click for TCP/UDP
* Move mode badge before domain and use fixed width for alignment
* Fix HTTP services to open as link instead of copy
* Hide old proxy clusters from L4 domain selector
* Move service type inside modal
* Update auth cell
* Add target selector component
* Extract into separate components
* hide services types for not supported clusters
* Remove advanced settings tab in http targetmodal and use accordion instead
* Update advanced settings
* Update target device row
* Update text
* Add type cell
* Fix flat target name cell
* Update modal title
* Fix edit target in flat table
* Remove unused proxycluster interface
* Move proxy type icon into type component
* sync cloud
* use emptyrow
* fix l4 type
* fix duplicate error notification
* Set the correct target type
* Fix subnet host editable
* Fix subnet host editable
* hide selector when initial resource or peer
* Rename dropdown
* Update text
* update status cell
* merge cloud
* Update tooltips
* Address coderabbit comments
* Fix skeleton device card
* Update listen port tooltip
* Adjust padding
* update package-lock.json
* bump next to 16.1.7
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* [dashboard] feat: add auto_update_always toggle to client settings
Add "Always Update" toggle to the Clients settings tab that controls
whether updates are installed automatically in the background or require
user interaction from the UI. Includes a warning icon and caution callout
when enabled to highlight the risk of disrupting active connections.
* [dashboard] fix: improve auto-update UI clarity and toggle label
Clarify that automatic updates require user interaction by updating the
description. Rename "Always Update" to "Force Automatic Updates" for
clarity. Move warning callout below the toggle switch instead of inside it.
* Update src/modules/settings/ClientSettingsTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Add acl tooltips
* Adjust resource modal and add tooltips
* Prevent nextjs navigation trigger on tab change
* Update wording
* add acl into resource
* Refactor resource policies
* Add prop to hide group edit and disable redirect
* Add skeleton loader to network page
* Create policy for new resources
* Show existing policies if groups are matching
* Add confirm dialog after creating resource without policy
* Add dialog if user edits policy that is used in multiple resources
* Add callout when selecting resource groups containing policies
* Add dialog if deleting policies containing resources
* Fix stale policies and new group creation in resource modal
* Remove whitespace
* Fix sort
* Cleanup
* Address coderabbit comments
* Fix policy alignment
* Fix initial resource
* disable selector if user did not select resource groups
* Consider current resource when editing / deleting policy
* Remove unused mutate
* Fix dot position
* Remove ask for policy
* Fix policy index
* Fix multiple resource confirm dialog on policy cell
* add draft
* add reverse proxy activities
* move peer expose settings into client settings tab and fix activity descriptions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* prevent false positive group report
* add docs link
* allow save when groups are added to the setting
* Add loading skeleton to client settings, update icon, use grouphelper to allow creating new groups, remove .patch
* mv expose settings from extra settings
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Remove architecture info tooltip for MacOS
Previously, this tooltip helped users determine which binary to download. Since #501, there is only one universal binary download link, so keeping the tooltip explaining how to determine the CPU architecture is unnecessary.
* fix: Remove unused imports
* implement debug ui
* update job ui
* Add type cell, show tooltip if peer is offline, add copy to clipboard for upload key, show error reason in tooltip
* update job event description
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Redirect /setup to /peers if not setup is required
* Fix bad state while redirect
* Prevent redirect to /setup if already on /setup
* Fix loading state
* Add user creation with password copy
* Add initial identity provider view
* Add IdP logos
* Add IdP id to user
* Add IdP logo to user obj
* Fix okta icon
* Return callback URL when creating an IdP
* Create user for self-hosted
* Clear up password from the state
* Show IdPs and create user when enabled
* Fetch IdPs only when embedded idp is enabled
* Update src/app/(dashboard)/settings/page.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/app/(dashboard)/settings/page.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProvidersTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProviderModal.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProvidersTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProviderModal.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Rename IdentityProvider to SSOIdentityProvider
* Fix build and extract icons
* Fix initial onboarding
* Add icons
* Move name to the top
* Fix setup wizard background color
* Update instance setup ui
* Update instance setup ui
* Use input component
* Move idp label and icons
* Fix setup wizard width
* Add authentik and keycloak
* Add idp hints
* Handle idp permissions
* Consider selfhosted instances when checking if netbird is hosted
* Update redirect
* Add max retries to redirect
* Require new secret when clientid changed
* Add callback URL on the idp creation step
* Add idp activity events
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* move our group membership from the settings menu, into the Team menu
* add action to the table and new group page
* update group page and return group settings to settings menu
* new update
* fix bug
* group action: add peer to group
* group action: add user to group
* Update wording, redirect to group page after creation
* Add better table loading skeleton
* Adjust group name cell
* Update wording
* Update sort order
* Refactor
* Merge main
* Fix button height
* Fix resources table
* Adjust table loading skeleton
* Adjust table loading skeleton
* Add loading to tab triggers
* Update meta
* Update group location
* Fix rename
* Refactor group details
* Fix linked peers
* Fix group usage
* Fix incrementing peer count
* Prevent renaming to already existing group
* Fix group name click
* Update group nav
* Make group table cells clickable
* Fix breadcrumbs
* Update wording
* Add confirmation before removing users from group
* Add permissions
* Add initial group for network routes
* Add acl and routing peer groups
---------
Co-authored-by: aliamerj <aliamer19ali@gmail.com>
* fix: add multi-group support for JWT allow groups with tag system
* Update src/modules/settings/GroupsTab.tsx to use the Badge component
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* chore(GroupsTab): import Badge components
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
implements a "Sync with cloud" functionality that includes various UI improvements, code refactoring, and component extractions. The changes focus on enhancing the user interface, improving code organization, and adding new features for remote access and activity tracking.
- Refactors inline components into reusable shared components
- Adds new activity tracking for group operations
- Updates remote access configuration and UI components
- Enhances styling and layout for better user experience
implements a user approval feature that allows administrators to manually approve new users before they can access the system. The feature adds approval workflow controls and error handling for blocked/pending users.
Adds user approval toggle in authentication settings
Implements approve/reject actions for pending users in the users table
Creates error page for blocked/pending approval scenarios
* Add display of ID if user does not have email
* Update PeerNameCell.tsx
* Add more possible id parameters
* Hide user if there is nothing
* change id order
* Keep default behavior
* Add resource description, add single resource for acl, add icons for group badges, add inactivity expiration
* Add extra dns labels, remove routing restriction
* display serial number on peer information and on peers table
* add serial on peers list (included in OS information to minimize informations)
* permit a lookup via serial number
* add serial on peer information
* Update os icon to match existing one and hide serial if it does not exist
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Fix wrong ui state for routing peer modal in networks
* Add confirmation dialog when blocking users
* Keep peer sort order when switching pages
* Update sidebar navigation order and remove deprecation notice
* Fix issue when hovering over truncated text in a group badge closes the multiple groups popover
* Update group text in network resource modal
* Update networks page text
* Fix line height
* Add search to resource table
* Switch networks flow to create first resources and then add routers
* Add enabled toggle to routing peers
* Add enabled toggle to network resources
* Add resource group modal and adjust tables
* Clarify networks
* Fix not properly aligned horizontal scroll bar
* Add option to install netbird after creating a setup key
* Fix text for install netbird modal
* Show resources count in group settings
* Fix "no results" and "no routing peers" text showing at the same time
* Fix wording
* Fix resource policy count
* Hide resource count when selection source groups
* Extend networks routing peer modal with option to create a setup key and install netbird
* Add option for horizontal stepper
* Generate setup key when installing netbird from routing peer modal
* Add confirm dialog to let the user know a one-off setup-key will be created. This avoids accidental clicking and later confusion on the setup keys page
---------
Co-authored-by: Misha Bragin <bangvalo@gmail.com>
* Add admin-url to the add-peer dialogue
* Missed "let" from defining the variable
* Update netbird.ts
Fix isNetBirdHosted check
---------
Co-authored-by: Eduard Gert <eduard@netbird.io>
* Update axa oidc library and package.json
* Update ACL port state to show correct value
* Filter user groups by unique groups only
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add try catch block for global search
* Add fallback for group name
* Add fallback for setup key name
* Do not load setup key modal if it's not open
* Check if auto_groups actually exists for the setup keys
* Add fallback for group names in setup keys table
* Add fallback for group names in peers table
* Change icon size
* Remove integrations
* Add no cache header
* Add analytics event tracking
* Add small announcement improvements
* Remove peer approval setting
* Do not load countries when user has no permission
* Add tab query params to settings
* Decrease navigation font size
* Change order of providers
* Increase padding for modals
* Show page only when user is fully loaded and found
* Remove unused state
* Remove integrations page
* Fix group badge icon size
* Fix copy icon size
* Add region information to peer table and single peer view
* Push to docker
* Change login expired icon size
* Fix country flag in single peer view
* Change country flag size in peer table
* Disable revalidation for countries
* Fix icon size on peer detail view
* Rollback workflow
* Revert login expiration
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
support to routes with peer group
updated the view logic to support the new type
updated peer view as well
for now, we are supporting a single group, but that can be extended
* add last login to user overview for regular entries without tag
* add backward compatability to properly show with older version of management
* Merge main and update delete user popup messages
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
Fixed flaky test by changing the way to access
Access Control Page and add some test ids of Add Rules buttons.
Temporary removed tests for Firefox and webkit(safari)
Add tests with playwright for:
- add peer modal on first access
- add peer modal on empty peer list
- test install buttons and instructions for Linux,
Docker, macOS, Windows and Android
- check default ACL
The tests are using a modified version of the getting
started scripts to run a local environment of
management services and run the dashboard from the current version
Todo:
- run tests before create docker container
- add more tests
Changes:
user tab was split in service users and regular users
user edit view was reworked:
shows PAT box for service users and self (hides for rest)
hides email and groups for service users as no usage
reverted settings tab to only contain account settings + hide for normal users
Use navbar avatar dropdown to link to users list and open user edit page for self
extend api-client to handle requests with query parameters
use popup form for PAT creation, user invite and service user creation
validate all form fields before trying to send API call and show faulty fields
Additional fixes:
groups popup was only visible after 2nd hover after tab switch on every view, fixed to also show on first hover
fix setup keys page throwing errors from time to time and not loading
peers view was sending getRoute requests that are only allowed for admins which was throwing errors (only console) for normal users -> disabled requests for non-admin users
* Add working UI + API calls [missing token popup]
* use popup view to add new token
* show userID if user name not available
* switch from description to name
* show "Me" instead of own name
* removed created_by column
* update add token explanation
* use object instead of plain text for token create response
* some style changes
* disable information button for tokens
* last_used can contain nil
* fix delete popups
* lower case letters for dates
* add activity and fix visibility
* show settings tab for non admins
* remove spaces on top of setting tabs
* fix copy button size and position
* fix list footers
* continue merge changes to new files
On many IDP providers, the access token
is used to access the IDP's own API
With these changes, we allow users to define the proper token to be used for
management API calls
Reduce duplicated code with single helper for pagination
On larger deployments we should allow for larger pages
fix popover key issue and vertical spacing
update deprecated keys
New Settings tab added to the dashboard.
It is possible to enable or disable peer login expiration globally for an account.
As well as defining the expiration time period.
Users can add distribution groups to network routes
Groups can be added to individual network routes or to all routes in the group
Adding a new group in the modal is restricted to individual network route operations
Validate if the users state is empty and issue a GET call to /api/users
We check if the call was issued and if not on tabs that already does such a call
Check if domains is not empty when primary is false
Validate domain and primary fields before submit
Display validation errors as message too
Reload groups on failure too
Display API call error
Added call to action message when nameserver is empty
Added DNS tab for managing Nameservers.
Users will be able to add multiple nameservers
and set distribution groups that dictate to which peers the settings will be applied.
With this PR we also got a set of group handlers that can be reused.
This PR brings an "Invite User" button to the Users view
and a view to creating (inviting) a new user to the account.
This function calls the Management API POST /users
endpoint that creates a new user.
* Fix popover for groups
Fixed all popover overlay when opening
update modal
also fixed group input size problem
with peers update
* remove style display flex from form tittle
* fix missing peer when disabling route
and passing peer to modal view
* group rows by HA routes
* Adjust high availability and show fields disabled
* add groupedRoutes to GroupedDataTable
* remove unused fields
* filter by grouped routes
* group routes by network id and network
* use better check for save button
Cleans up config.json providing generic OIDC properties.
This allows for using other IDP providers besides Auth0.
The change is backward compatible with the previous versions.
Init scripts will remove ports for replacement when the user
provided default HTTP and HTTPS ports.
This was causing issues with trusted domain logic from the OIDC library.
Replacing Auth0's SDK with a more generic implementation of an OIDC client.
This will allow us to use other IDP providers that follow the OIDC standards.
2022-07-26 16:13:08 +02:00
1966 changed files with 234296 additions and 17060 deletions
echo "::error::You checked 'docs added' but didn't include a valid HTTPS PR link to netbirdio/docs (e.g., https://github.com/netbirdio/docs/pull/1234)."
exit 1
fi
pr_number="$(printf '%s' "$url" | sed -E 's#.*/pull/([0-9]+)$#\1#')"
{
echo "url=$url"
echo "pr_number=$pr_number"
} >> "$GITHUB_OUTPUT"
- name:Verify docs PR exists (and is open or merged)
This Contributor License Agreement (referred to as the "Agreement") is entered into by the individual
submitting this Agreement and NetBird GmbH, Brunnenstraße 196, 10119 Berlin, Germany,
referred to as "NetBird" (collectively, the "Parties"). The Agreement outlines the terms and conditions
under which NetBird may utilize software contributions provided by the Contributor for inclusion in
its software development projects. By submitting this Agreement, the Contributor confirms their acceptance
of the terms and conditions outlined below. The Contributor further represents that they are authorized to
complete this process as described herein.
## 1 Preamble
In order to clarify the IP Rights situation with regard to Contributions from any person or entity, NetBird
must have a contributor license agreement on file to be signed by each Contributor, containing the license
terms below. This license serves as protection for both the Contributor as well as NetBird and its software users;
it does not change Contributor’s rights to use his/her own Contributions for any other purpose.
## 2 Definitions
2.1 “IP Rights” shall mean all industrial and intellectual property rights, whether registered or not registered, whether created by Contributor or acquired by Contributor from third parties, and similar rights, including (but not limited to) semiconductor property rights, design rights, copyrights (including in the form of database rights and rights to software), all neighbouring rights (Leistungsschutzrechte), trademarks, service marks, titles, internet domain names, trade names and other labelling rights, rights deriving from corresponding applications and registrations of such rights as well as any licenses (Nutzungsrechte) under and entitlements to any such intellectual and industrial property rights.
2.2 "Contribution" shall mean any original work of authorship, including any modifications or additions to an existing work, that is or previously has been intentionally Submitted by Contributor to NetBird for inclusion in, or documentation of any Work.
2.3 "Contributor" shall mean the copyright owner or legal entity authorized by the copyright owner that is concluding this Agreement with NetBird. For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
2.4 "Submitted" shall mean any form of electronic, verbal, or written communication sent to NetBird or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, NetBird for the purpose of discussing and improving the Work, but excluding communication that is marked or otherwise designated in writing by Contributor as "Not a Contribution".
2.5 "Work" means any of the products owned or managed by NetBird, in particular, but not exclusively, software.
## 3 Licenses
3.1 Subject to the terms and conditions of this agreement, Contributor hereby grants to NetBird and to recipients of software distributed by NetBird a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce by any means and in any form, in whole or in part, permanently or temporarily, the Contributions (including loading, displaying, executing, transmitting or storing works for the purpose of executing and processing data or transferring them to video, audio and other data carriers), including the right to distribute, display and present such Contributions and make them available to the public (e.g. via the internet) and to transmit and display such Contributions by any means. The license also includes the right to modify, translate, adapt, edit and otherwise alter the Contributions and to use these results in the same manner as the original Contributions and derivative works. Except for licenses in patents acc. to Sec. 3, such license refers to any IP Rights in the Contributions and derivative works. The Contributor acknowledges that NetBird is not required to credit them by name for their Contribution and agrees to waive any moral rights associated with their Contribution in relation to NetBird or its sublicensees.
3.2 Subject to the terms and conditions of this agreement, Contributor hereby grants to NetBird and to recipients of software distributed by NetBird a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license in the Contributions to make, have made, use, sell, offer to sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by the Contributor which are necessarily infringed by Contributor‘s Contribution(s) alone or by combination of Contributor’s Contribution(s) with the Work to which such Contribution(s) was Submitted.
3.3 NetBird hereby accepts such licenses.
## 4 Contributor’s Representations
4.1 Contributor represents that Contributor is legally entitled to grant the above license. If Contributor’s employer has IP Rights to Contributor’s Contributions, Contributor represent that he/she has received permission to make Contributions on behalf of such employer, that such employer has waived such IP Rights to the Contributions of Contributor to NetBird, or that such employer has executed a separate contributor license agreement with NetBird.
4.2 Contributor represents that any Contribution is his/her original creation.
4.3 Contributor represents to his/her best knowledge that any Contribution does not violate any third party IP Rights.
4.4 Contributor represents that any Contribution submission includes complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which Contributor is personally aware and which are associated with any part of the Contribution.
4.5 The Contributor represents that their Contribution does not include any work distributed under a copyleft license.
## 5 Information obligation
Contributor agrees to notify NetBird of any facts or circumstances of which Contributor become aware that would make these representations inaccurate in any respect.
## 6 Submission of Third-Party works
Should Contributor wish to submit work that is not Contributor’s original creation, Contributor may submit it to NetBird separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which Contributor are personally aware, and conspicuously marking the work as "Submitted on behalf of a third-party: [named here]".
## 7 No Consideration
Unless compensation is mandatory under statutory law, no compensation for any license under this agreement shall be payable.
## 8 Final Provisions
8.1 Laws. This Agreement is governed by the laws of the Federal Republic of Germany.
8.2 Venue. Place of jurisdiction shall, to the extent legally permissible, be Berlin, Germany.
8.3 Severability. If any provision in this agreement is unlawful, invalid or ineffective, it shall not affect the enforceability or effectiveness of the remainder of this agreement. The parties agree to replace any unlawful, invalid or ineffective provision with a provision that comes as close as possible to the commercial intent and purpose of the original provision. This section also applies accordingly to any gaps in the contract.
8.4 Variations. Any variations, amendments or supplements to this Agreement must be in writing. This also applies to any variation of this Section 8.4.
- [React Flow](https://reactflow.dev/) for the Control Center
- Auth0
- Nginx
- Docker
- Let's Encrypt
## How to run
Disclaimer. We believe that proper user management system is not a trivial task and requires quite some effort to make it right. Therefore we decided to
use Auth0 service that covers all our needs (user management, social login, JTW for the management API).
use Auth0 service that covers all our needs (user management, social login, JWT for the management API).
Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react/01-login#configure-auth0) up until "Configure Allowed Web Origins"
To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react) up until "Configure Allowed Web Origins"
4. Wiretrustee UI Dashboard uses Wiretrustee Management Service HTTP API, so setting ```WIRETRUSTEE_MGMT_API_ENDPOINT``` is required. Most likely it will be ```http://localhost:33071``` if you are hosting Management API on the same server.
4. NetBird UI Dashboard uses NetBird's Management Service HTTP API, so setting `NETBIRD_MGMT_API_ENDPOINT` is required. Most likely it will be `http://localhost:33071` if you are hosting Management API on the same server.
5. Run docker container without SSL (Let's Encrypt):
```docker run -d --name wiretrustee-dashboard --rm -p 80:80 -p 443:443 -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> -e AUTH0_CLIENT_ID=<SET YOUR CLIENT ID> -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> -e WIRETRUSTEE_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> wiretrustee/dashboard:main```
```shell
docker run -d --name netbird-dashboard \
--rm -p 80:80 -p 443:443 \
-e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
-e AUTH0_CLIENT_ID=<SET YOUR CLIENT ID> \
-e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
netbirdio/dashboard:main
```
6. Run docker container with SSL (Let's Encrypt):
```docker run -d --name wiretrustee-dashboard --rm -p 80:80 -p 443:443 -e NGINX_SSL_PORT=443 -e LETSENCRYPT_DOMAIN=<YOUR PUBLIC DOMAIN> -e LETSENCRYPT_EMAIL=<YOUR EMAIL> -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> -e AUTH0_CLIENT_ID=<SET YOUR CLEITN ID> -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> -e WIRETRUSTEE_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> wiretrustee/dashboard:main```
```shell
docker run -d --name netbird-dashboard \
--rm -p 80:80 -p 443:443 \
-e NGINX_SSL_PORT=443 \
-e LETSENCRYPT_DOMAIN=<YOUR PUBLIC DOMAIN> \
-e LETSENCRYPT_EMAIL=<YOUR EMAIL> \
-e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
-e AUTH0_CLIENT_ID=<SET YOUR CLEITN ID> \
-e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
netbirdio/dashboard:main
```
## How to run local development
1. Install node 16
2. create and update the src/.local-config.json file. This file should contain values to be replaced from src/config.json
3. run `npm install`
4. run `npm run start dev`
1. Install [Node](https://nodejs.org/)
2. Create and update the `.local-config.json` file. This file should contain values to be replaced from `config.json`
3. Run `npm install` to install dependencies
4. Run `npm run dev` to start the development server
Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
You can start editing by modifying the code inside `src/..`
The page auto-updates as you edit the file.
## How to migrate from old dashboard (v1)
The new dashboard comes with a new docker image `netbirdio/dashboard:main`.
To migrate from the old dashboard (v1) `wiretrustee/dashboard:main` to the new one, please follow the steps below.
1. Stop the dashboard container `docker compose down dashboard`
2. Replace the docker image name in your `docker-compose.yml` with `netbirdio/dashboard:main`
3. Recreate the dashboard container `docker compose up -d --force-recreate dashboard`
Loaded 20 of 1966 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Eduard GertandClaude Opus 5
Maycon SantosandClaude Fable 5.1
Jack Carter
Pascal Fischer
Nicolas Frati
Daneyon Hansen
Brandon Hopkins
Shaban Mohammedsaani Hassan
Viktor Liu
Brad Ison
Bethuel Mmbaga
Zoltan Papp
Max Bruch
Max
raghvendra
shuuri-labs
Aaron Dewes
dependabot[bot]
Ali AmerandEduard Gert
Yanis64andEduard Gert
hakansa
Vladislav Tropnikov
Edouard VanbelleandEduard Gert
Jon "The Nice Guy" Spriggs
Tom Hubrecht
juliaroesschen
amplitudes
Fabio Fantoni
Sarooj bukhariandbraginini
Yoann N
Yulia
B. Baumgartl
Givi Khojanashvili
Crusadero
Moath Qasim
Enrico Renna
Jens L
Jens L