Skip to content

Commit a4a3a5c

Browse files
vsilentvsilentCopilot
authored
master-> dev (#95)
* RUSTSEC-2026-0049 (rustls-webpki) — fixed by upgrading 0.103.8 -> 0.103.10 * capture probe samples * update notifications implemented, clippy fix, cargo fmt * AlertManager + TokenProvider * cargo clippy --no-default-features --features minimal fixes * trigger pipe command * fmt all * feat: add real WebSocket and gRPC streaming transports - Replace WS stub with real tokio-tungstenite client (ws_fetch_source, ws_send_target, connect_and_stream) - Add gRPC client transport (grpc_fetch_source, grpc_send_target) with tonic/prost and JSON↔prost_types conversion - Add proto/pipe.proto with PipeService (Send + Subscribe RPCs) - Add build.rs for tonic-build protobuf compilation - Route ws:// and grpc:// target URLs in handle_trigger_pipe to appropriate streaming transports - Add tokio-tungstenite, tonic, prost, prost-types dependencies - All 371 lib tests + 19 integration tests passing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * .claude/settings.local.json appears to be a local, developer-specific tool-permissions file. Committing it can unintentionally standardize local permissions or leak workflow assumptions. Consider removing it from version control and adding .claude/ (or at least settings.local.json) to .gitignore, or rename to a non-local template. Fix * ignore claude files * fix reviewer comments * protoc deps * clippy blockers fix * Feature/streaming pipes (#91) * RabbitMQ/AMQP source support is now wired into the agent pipe runtime with new source contract fields, worker support, and activation validation. - The external pipe path no longer depends on Docker-only compilation. Default and minimal builds both support activate_pipe, trigger_pipe, signed webhook ingress, and advertised pipe capabilities; only container-local fetch/send remains Docker-gated. * more tests * shared cross-repo contracts * cross-repo contract json between stacker and status for pipe feature * copy build.rs and proto * PIPE_POLL_INTERVAL_SECS to a minimum of 1s, stops writing the pipe runtime file on every trigger/failure, redacts URL credentials before persistence, writes the state file with 0600 on Unix, vendors the pipe contract fixtures into tests/fixtures/pipe-contract, removes the external fixture clone from CI, and drops the unused shared_fixtures build context from Dockerfile.prod * get fixtures from external repo * status --version now prints the build version with the git short hash, e.g. 0.1.7 (a8ac35f). * workflow fix attempt * ci fixtures * actions fix --------- Co-authored-by: vsilent <jabberroid@gmail.com> * Feature/streaming pipes (#93) * RabbitMQ/AMQP source support is now wired into the agent pipe runtime with new source contract fields, worker support, and activation validation. - The external pipe path no longer depends on Docker-only compilation. Default and minimal builds both support activate_pipe, trigger_pipe, signed webhook ingress, and advertised pipe capabilities; only container-local fetch/send remains Docker-gated. * more tests * shared cross-repo contracts * cross-repo contract json between stacker and status for pipe feature * copy build.rs and proto * PIPE_POLL_INTERVAL_SECS to a minimum of 1s, stops writing the pipe runtime file on every trigger/failure, redacts URL credentials before persistence, writes the state file with 0600 on Unix, vendors the pipe contract fixtures into tests/fixtures/pipe-contract, removes the external fixture clone from CI, and drops the unused shared_fixtures build context from Dockerfile.prod * get fixtures from external repo * status --version now prints the build version with the git short hash, e.g. 0.1.7 (a8ac35f). * workflow fix attempt * ci fixtures * actions fix * fixture repo/dir access --------- Co-authored-by: vsilent <jabberroid@gmail.com> * chore(release): v0.1.8 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: vsilent <jabberroid@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 3860564 commit a4a3a5c

39 files changed

Lines changed: 9882 additions & 971 deletions

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ jobs:
1717
build-and-test:
1818
name: Build & Test (features=${{ matrix.features }})
1919
runs-on: ubuntu-latest
20+
env:
21+
CONFIG_FIXTURES_TOKEN: ${{ secrets.CONFIG_FIXTURES_TOKEN }}
2022
strategy:
2123
fail-fast: false
2224
matrix:
@@ -25,6 +27,30 @@ jobs:
2527
steps:
2628
- name: Checkout repository
2729
uses: actions/checkout@v4
30+
- name: Checkout shared pipe fixtures repo
31+
id: checkout_shared_fixtures
32+
if: ${{ env.CONFIG_FIXTURES_TOKEN != '' }}
33+
continue-on-error: true
34+
uses: actions/checkout@v4
35+
with:
36+
repository: trydirect/config
37+
ref: main
38+
token: ${{ env.CONFIG_FIXTURES_TOKEN }}
39+
path: config-fixtures-repo
40+
fetch-depth: 1
41+
persist-credentials: false
42+
sparse-checkout: |
43+
shared-fixtures
44+
- name: Shared pipe fixtures unavailable
45+
if: ${{ env.CONFIG_FIXTURES_TOKEN == '' || steps.checkout_shared_fixtures.outcome != 'success' }}
46+
run: |
47+
echo "::notice::Shared pipe fixtures are unavailable for this workflow run; shared-fixture tests will be skipped."
48+
- name: Link shared pipe fixtures
49+
if: ${{ env.CONFIG_FIXTURES_TOKEN != '' && steps.checkout_shared_fixtures.outcome == 'success' }}
50+
run: |
51+
rm -rf "${GITHUB_WORKSPACE}/../config" "${GITHUB_WORKSPACE}/../shared-fixtures"
52+
ln -sfn "${GITHUB_WORKSPACE}/config-fixtures-repo/shared-fixtures" "${GITHUB_WORKSPACE}/../shared-fixtures"
53+
test -d "${GITHUB_WORKSPACE}/../shared-fixtures/pipe-contract"
2854
2955
- name: Setup Rust toolchain (${{ matrix.rust }})
3056
uses: dtolnay/rust-toolchain@stable

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ __pycache__
44
.DS_Store
55
.ai
66
target
7-
.env
7+
.env
8+
.claude

‎CHANGELOG.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog
22

3+
## 0.1.8 — 2026-04-21
4+
### Added
5+
- `status --version` now includes the git short hash (for example `0.1.8 (abc1234)`) so production builds can be identified instantly.
6+
7+
### Changed
8+
- Docker builds now include the protobuf build inputs required for gRPC client code generation in musl/release images.
9+
- Pipe-contract fixtures remain sourced from `trydirect/config`, while fork PRs and unauthorized CI runs now skip only the shared-fixture tests instead of failing the entire workflow.
10+
311
## 0.1.7 — 2026-04-10
412
### Security — OWASP Top 10 Hardening
513

@@ -207,4 +215,3 @@ This is a **security release** addressing 6 Critical and 5 High severity finding
207215
- Planned: align build and runtime images to avoid glibc drift; keep the musl-based build variant as the default container target.
208216
- Planned: update CI to build and test using the production base image so linker/runtime errors are caught early.
209217
- Planned: add a container startup smoke check to surface missing runtime dependencies before release.
210-

‎CLAUDE.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Status Panel
2+
3+
On-server status panel agent. Runs on deployed servers to report health metrics, manage containers, handle self-updates, and provide a WebSocket interface for real-time monitoring.
4+
5+
## Tech Stack
6+
- **Language**: Rust (2021 edition)
7+
- **Framework**: Axum 0.8 (with WebSocket support)
8+
- **Async**: Tokio (full features)
9+
- **Docker**: Bollard 0.19 (Docker API via Unix socket, optional)
10+
- **HTTP Client**: reqwest 0.12 (rustls-tls)
11+
- **System Metrics**: sysinfo 0.30
12+
- **Security**: HMAC-SHA256, ring 0.17
13+
- **Daemonization**: daemonize 0.5
14+
- **Testing**: assert_cmd, tokio-test, mockito, tower
15+
16+
## Project Structure
17+
```
18+
src/
19+
main.rs # Binary entry point
20+
lib.rs # Library root (core logic)
21+
test_utils.rs # Shared test utilities
22+
tests/
23+
http_routes.rs # HTTP route integration tests
24+
security_integration.rs # Security/auth integration tests
25+
self_update_integration.rs # Self-update mechanism tests
26+
examples/
27+
command_execution.rs # Command execution example
28+
```
29+
30+
## Features
31+
- `default = ["docker"]` — includes Docker management via Bollard
32+
- `docker` — Docker container management (Unix socket)
33+
- `minimal` — builds without Docker support
34+
35+
## Commands
36+
```bash
37+
# Build
38+
cargo build
39+
40+
# Build minimal (without Docker)
41+
cargo build --no-default-features --features minimal
42+
43+
# Run tests
44+
cargo test
45+
46+
# Run tests without Docker feature
47+
cargo test --no-default-features --features minimal
48+
49+
# Format & lint
50+
cargo fmt
51+
cargo clippy -- -D warnings
52+
53+
# Run
54+
cargo run --bin status
55+
```
56+
57+
## Critical Rules
58+
- NEVER expose system commands without HMAC authentication
59+
- NEVER trust incoming WebSocket data without signature verification
60+
- ALWAYS validate self-update binary integrity before replacing
61+
- Docker socket access is privileged — validate all container operations
62+
- System metrics collection must not block the async runtime
63+
- Test both `docker` and `minimal` feature configurations
64+
- Test with `cargo test` after every change
65+
- DO NOT yet add to repo .claude CLAUDE.md .copilot directories and files
66+
67+
## Agents
68+
- Use `planner` before any feature work
69+
- Use `tester` after every code change (must run cargo test)
70+
- Use `code-reviewer` before commits — focus on security and system safety

0 commit comments

Comments
 (0)