Fimeg
0d908ba512
feat: zero-sudo agent, helper self-upgrade, OSV expansion, docker handler rewrite, staging UI
Agent privilege reduction:
- apt discovery unprivileged (sandbox opts like dnf)
- docker commands use group membership, no sudo
- agent self-upgrade delegated to helper via agent-self capability token
- sudoers template stripped to single systemd-run helper line
Helper (Rust):
- agent-self package type: stage, hash-verify, backup, install, chmod, restart
- TOCTOU-safe: copy-then-hash, never hash a path re-read later
- --no-block restart so helper finishes before agent SIGTERM
Server:
- mintAgentSelfToken signs agent-self tokens for manual and bulk update paths
- OSV.dev checks at discovery time (async, deduped) + startup backfill
- apt/dnf added to OSV ecosystem mapping
- docker handler rewritten against DockerQueries (proper image/container split)
- status filter server-side on aggregated packages (HAVING clause)
- dead code removed: UpdatePackage model, UpsertUpdate, ListUpdates
Frontend:
- LiveOperations -> Staging with staged-packages section
- Docker severity from data, not hardcoded
- Updates status filter delegated to server
|
2026-05-30 12:56:40 -04:00 |
| .. |
|
public
|
ui: replace stale vite.svg reference with RedFlag favicon
|
2026-05-22 14:20:26 -04:00 |
|
src
|
feat: zero-sudo agent, helper self-upgrade, OSV expansion, docker handler rewrite, staging UI
|
2026-05-30 12:56:40 -04:00 |
|
.env.example
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
Dockerfile
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
index.html
|
ui: replace stale vite.svg reference with RedFlag favicon
|
2026-05-22 14:20:26 -04:00 |
|
nginx.conf
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
package-lock.json
|
fix(web): TypeScript errors for Vite 8 + Rolldown
|
2026-05-24 20:18:16 -04:00 |
|
package.json
|
fix(web): TypeScript errors for Vite 8 + Rolldown
|
2026-05-24 20:18:16 -04:00 |
|
postcss.config.js
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
tailwind.config.js
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
tsconfig.json
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
tsconfig.node.json
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
vite.config.ts
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |