Fimeg
86da7471ec
feat: install/sync/RL hardening + upstream version sync subsystem
...
Agent + install:
- linux installer adds redflag-agent to docker group (idempotent;
unblocks container scanner detection)
- install.sh / linux.sh.tmpl / windows.ps1.tmpl: detect existing
refresh_token and skip --register (Flow 2: upgrade in place)
- agent_update.go: remove dead post-restart watchdog; add
CleanupPostUpdateBackup() called after first successful check-in
Server + token model:
- 409 machine-already-registered now returns existing_agent_id,
hostname, last_seen, remediation guidance
- RevokeAgent admin handler (invalidates refresh_tokens only)
- GetAgentsBoundToToken query + no-cascade invariant test
- Two-axis revocation locked in: registration_token revoke does NOT
cascade to agent refresh_tokens
Supply chain (Shai-Hulud defense feature 1):
- services/package_age.go: npm + PyPI registry probes,
EvaluatePackageAgeGate decision matrix (warn/block/off x
above/below/unknown)
- ApproveUpdate / ApproveUpdates wired to age gate; stores
package_published_at + supply_chain_age_check in metadata
- security_settings_service: supply_chain category defaults
(min_package_age_hours=24, gate_enforcement=warn)
Rate limiting UI rewrite:
- Frontend was expecting per-endpoint configs + usage/summary
routes that don't exist; backend has 6 named categories
- Rewrote RateLimiting.tsx, useRateLimits.ts, api.ts, types,
Settings overview card to the real shape (Requests + Window in
seconds + Enabled per category)
Agent Management UI:
- Replaced auto-pick-first-token with explicit dropdown showing
prefix, label, seats_used/max_seats, expiry
- One-liner panel only renders when a token is selected; no more
YOUR_REGISTRATION_TOKEN placeholder in copyable command
- Zero-token state surfaces "Generate Registration Token" CTA
Upstream version sync (new subsystem):
- Migration 035: tracked_software + upstream_drift_events
- ReleaseSource interface + Registry + Repology adapter +
endoflife.date adapter
- Periodic Syncer goroutine with on-demand SyncOne; classifies
drift severity (minor/major/eol); appends drift events
- /admin/upstream CRUD + drift + sync-now routes
- Dashboard "Stack Drift" panel (count + worst-3 + EOL flag)
Migration 035 runs idempotently on next startup.
2026-05-23 15:12:20 -04:00
