Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.
Заголовок деталей — как на досках (20px, действия справа), полоса показателей списка дополнена «Обновлён».
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Карточка агента — отдельная страница вместо Sheet: заголовок с действиями, ошибка применения, полоса показателей и линейные вкладки (политика, хост-фаервол, правила портов, заблокированное). Ссылки ?agent= ведут на страницу.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Заголовок страницы как на досках (20px), панель: быстрые действия, график и таблицы «Агенты» и «Требует внимания» в раскладке MikrotikManager (новый SimpleGrid). Статистика: пояснение, KPI с подсказками и линейные вкладки «Активность» и «Samples».
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Контент на всю ширину с отступами p-6 и gap-5 вместо max-w 1480; токены светлой и тёмной тем (фон, карточки, muted, accent, border, ring, sidebar, chart) взяты из globals.css MikrotikManager.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Боковое меню, шапка, монитор системы и палитра Ctrl+K переведены на общие блоки макета, данные из живых запросов (агенты, списки, наборы правил). KPI стали полосой в одном Frame, таблицы ResourcePage получили тулбар как в MikrotikManager (сегменты, фильтры, поиск, счётчик), подложку шапки и ячейки py-3. Старая оболочка удалена.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
tsc в apps/api резолвит @evofw/db и @evofw/shared через dist/*.d.ts —
прямой запуск до сборки падает с Cannot find module. Задача typecheck
добавлена в turbo.json с dependsOn ^build; CI запускает её через turbo
push с несколькими коммитами: before_sha лежит глубже fetch-depth:2 и
git diff падает bad object. Теперь checkout с полной историей; плюс
защитный fallback на HEAD~1, если before_sha не резолвится
- genReqId (uuid) + x-request-id в каждом ответе и request_id в error
envelope — корреляция ошибок между клиентом и логами
- RBAC: /agents/:id/(stats|blocked-ips|blocked-ports) классифицируются
как fw:stats:read (reset остаётся под fw:agents:write)
- web: test-скрипт + 10 unit-тестов (filter-utils, fleet-kpis, parseClaims, nav)
- typecheck-скрипты для api/shared/db; CI: тесты shared и web, typecheck
всех пакетов
- гигиена: .node-version (22), актуальный .dockerignore, drizzle out →
./migrations, удалены 12 лишних .gitkeep и пустой apps/api/test
- retention: ежедневный cron (03:17) + запуск на старте удаляет сырые
agent_stats_samples старше STATS_RETENTION_DAYS (по умолчанию 30);
lifetime-итоги на агенте и агрегаты сохраняются
- N+1 на поллинг-пути агента: evaluateAgentPolicy теперь делает по одному
батч-запросу на записи списков / резолвы hostname / имена списков вместо
запроса на каждое правило; mapPolicyRules и port-rules GET — аналогично
- пагинация: GET /agents, /lists, /rules, /install-links принимают
limit/offset и возвращают total; без параметров — прежнее поведение
- openapi.yaml: approve-bulk, PUT /policy-sets/{id}/agents, параметры
пагинации (redocly lint OK); тесты (47 passed)
- RouteErrorComponent/RouteNotFoundComponent на root-маршруте (RU-копирайт,
retry + переход на главную; redirect в портал не мигает ошибкой)
- settings: форма инициализируется один раз — фоновый refetch больше не
затирает ввод пользователя
- code splitting: autoCodeSplitting роутов + manualChunks (react/router/query/
charts/dnd); вход ~507KB вместо единого чанка 1.57MB, recharts (330KB) грузится
лениво; версия recharts в packages/ui выровнена с apps/web (3.8.0)
- bulk-эндпоинты: POST /agents/approve-bulk и PUT /policy-sets/:id/agents —
назначение набора агентам одним запросом вместо N×(GET+PUT)
- оптимистичные обновления с rollback: approve, approve-bulk, удаление агента,
переключение набора
- тесты bulk-операций (45 passed)
- прод-режим отказывается стартовать без AUTH_REQUIRED и реальных секретов
(opt-out через EVOFW_ALLOW_UNSAFE)
- CORS: whitelist через CORS_ORIGINS вместо origin:true; CSP для раздаваемого SPA
- транзакции для setAgentPolicySets, reorderPolicyRules, replaceResolvedForRule,
replaceIpListEntries
- install-скрипты: Zod-валидация имени ссылки, экранирование $ и контрольных
символов в RouterOS-рендере
- constant-time сравнение enroll-seed
- опциональное шифрование токена EvoBGP в БД (EVOFW_SECRET_KEY, AES-256-GCM)
и маскирование per-list api_token в ответах
- graceful shutdown (SIGTERM/SIGINT) + тесты
- Modified the CI workflow in `quality.yaml` to use `pnpm exec turbo` for running tests and builds, improving efficiency for the @evofw/api package.
- Added a new export for development in `package.json` of the db package, allowing direct access to the source TypeScript file.
These changes enhance the CI process and improve the development experience for the db package.
- Added .release-version, CHANGELOG.md, and deploy/docker/docker-bake.override.hcl to .gitignore.
- Removed Dockerfile as part of the cleanup.
- Updated AGENTS.md and README.md to include new documentation on CI/Docker processes and deployment instructions.
- Enhanced package.json with new devDependencies for commit linting and semantic release.
- Updated pnpm-lock.yaml to reflect new dependencies and versions.
These changes streamline the project structure and improve documentation clarity.
- Updated the `evofw-firewall.sh` script to clarify the handling of incoming traffic for port ACLs, ensuring accurate rule application for Docker NAT and local addresses.
- Enhanced the UI description for port ACLs to specify that only incoming traffic is affected, improving user understanding of the firewall behavior.
- Revised documentation to reflect the updated logic for port ACLs, emphasizing the distinction between incoming and outgoing traffic and the implications for service accessibility.
These changes improve the clarity and functionality of port ACL management, enhancing user experience and system reliability.
- Refined the `collect_nft_stats` function in `evofw-firewall.sh` to iterate over multiple chains, improving packet counting accuracy for dropped and accepted packets.
- Updated the port ACL handling to include new chains in the firewall rules, ensuring comprehensive coverage for input, forward, and prerouting.
- Enhanced the UI to clarify the behavior of port ACLs, emphasizing the distinction between EvoFW and system rules, and the implications of open ports.
- Improved documentation to reflect the updated port ACL logic and its interaction with Docker NAT, ensuring users understand the new behavior.
These changes enhance the functionality and clarity of port ACL management, improving user experience and system reliability.
- Updated the `evofw-firewall.sh` script to refine the port ACL logic, ensuring the correct order of operations for deny and allow rules.
- Introduced a new structure for port ACL rows in the UI, allowing for better management of system and EvoFW rules.
- Enhanced the documentation to clarify the new port ACL behavior, including implicit drops for open ports and the distinction between EvoFW and system rules.
- Improved the handling of port ranges and source addresses in the UI, ensuring accurate representation of firewall rules.
These changes improve the functionality and clarity of port ACL management, enhancing user experience and system reliability.
- Added a `maybe_self_update` function in `evofw-firewall.sh` to allow agents to pull the latest version of the sync script from the server, enhancing the agent's ability to stay updated.
- Updated the `/v1/agent/sync-script` endpoint to return ETag and script SHA256 headers, enabling efficient caching and conditional requests.
- Modified the agent policy response to include `script_sha256`, providing visibility into the current version of the sync script.
- Enhanced tests to verify the self-update functionality and ensure correct behavior of the sync script endpoint.
These changes improve the maintainability and reliability of Linux agents by enabling automatic updates of critical scripts.
- Introduced a new `sanitizeHostFirewall` function to filter and validate host firewall rules and listeners, ensuring only valid entries are processed.
- Updated the `apply-report` endpoint to prevent overwriting existing host firewall snapshots with empty payloads, improving data integrity.
- Enhanced the `applyReportHostFirewallSchema` to define the expected structure for host firewall data, allowing for better validation and error handling.
- Added tests to verify the behavior of the new sanitization logic and the preservation of existing snapshots, ensuring robustness in the API's handling of firewall data.
These changes improve the reliability and accuracy of host firewall data management within the API, enhancing overall monitoring capabilities.
- Improved the `collect_host_firewall` function in `evofw-firewall.sh` to utilize temporary files for better handling of large rule sets, avoiding ARG_MAX limitations.
- Updated the JSON output structure to omit null/empty optional fields, ensuring compatibility with historical data formats.
- Enhanced error handling and logging for the firewall collection process, providing clearer diagnostics in case of failures.
- Adjusted related tests to accommodate changes in the expected output format, ensuring robust validation of the host firewall snapshot functionality.
These changes enhance the reliability and clarity of the host firewall data collection process, improving overall monitoring capabilities.
- Added support for managing desired L4 port ACL rules for Linux agents, allowing for open/close actions on specified ports.
- Introduced a new endpoint for CRUD operations on port rules, enhancing the API's capabilities for agent management.
- Implemented functionality to collect and report host firewall snapshots, capturing observed rules and listeners for better monitoring.
- Updated the agent detail view to include tabs for managing port ACLs and viewing host firewall data, improving user experience.
- Enhanced documentation to reflect the new features and API changes, ensuring clarity for users and developers.
These changes significantly improve the management and visibility of firewall rules and port access control for agents.
- Implemented a reset mechanism for per-IP baselines in the agent routes, ensuring accurate tracking after policy application.
- Updated tests to simulate traffic flush scenarios, verifying that IP hit statistics reset correctly and accumulate as expected.
- Modified the UI to reflect changes in terminology from "Sync windows" to "Hits" for better clarity in agent details.
- Enhanced documentation to explain the new behavior of IP hit tracking and baseline resets, improving user understanding.
These changes improve the accuracy and usability of IP hit tracking for agents, particularly in scenarios involving policy changes.
- Updated the `client_version` in the `mikrotik-install.rsc` script from `rsc/5` to `rsc/6` to reflect the latest changes.
- Enhanced the firewall filter rule management by ensuring that new rules are added at the top of the `input` and `forward` chains using `place-before`, improving the order of execution and efficiency.
- Updated documentation in `agents.md` to clarify the new behavior of filter rules being placed at the beginning of the chains.
These changes enhance the functionality and clarity of the MikroTik installation process, improving overall firewall management.
- Updated the `evofw-firewall.sh` script to improve the handling of NFT sets, ensuring compatibility with kernel limitations on counters and enhancing logging for better diagnostics.
- Introduced a new presence mode for MikroTik, allowing for real-time tracking of IP hits with updated last seen timestamps and packet counts.
- Enhanced the API to support the new presence mode, updating the database interactions to reflect the changes in how IP hits are recorded.
- Updated the agent detail view to display sync windows for MikroTik, providing clearer insights into blocked IPs and their activity.
- Improved documentation to reflect the new features and changes in the MikroTik handling process, ensuring clarity for users and developers.
These changes significantly enhance the monitoring capabilities and user experience for agents, particularly those using MikroTik devices.
- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.
These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.
- Expanded the ReUI documentation to reflect the addition of 20 free building blocks, including new components like `icon-tile`.
- Updated descriptions and usage guidelines across various rules and components to ensure clarity and accuracy.
- Enhanced the API references and examples to align with the latest changes in the ReUI framework, including updates to the `data-grid` component.
- Improved the registry setup instructions and free vs premium component distinctions for better user guidance.
These changes enhance the overall usability and understanding of the ReUI framework, providing users with comprehensive resources for effective implementation.
- Added a new linting command for OpenAPI specifications in the package.json, improving code quality checks.
- Updated frontend documentation to clarify component usage and structure, including detailed descriptions for `SettingsShell` and `Auth callback`.
- Refactored agent-related API routes to streamline control-plane functionalities, consolidating multiple routes for better organization.
- Improved error handling in the API to provide more informative responses for validation errors, enhancing user feedback during interactions.
These changes enhance the overall development experience and improve the management of agents within the application.
- Introduced delete functionality across multiple agent components, including AgentCard, AgentCardsGrid, AgentDetailSheet, and AgentDetailView, allowing users to remove agents directly from the UI.
- Integrated a confirmation dialog to prevent accidental deletions, enhancing user experience and safety.
- Updated relevant props and handlers to manage delete actions consistently across components.
These changes improve the overall management of agents, providing users with the ability to easily delete agents while ensuring confirmation for critical actions.
- Updated the `mikrotik-install.rsc` script to include cumulative packet tracking for dropped and accepted packets, improving visibility into firewall performance.
- Adjusted the JSON report structure to reflect the new packet statistics, ensuring accurate data is sent during synchronization.
- Enhanced logging to provide detailed insights into the synchronization process, including packet counts for better monitoring.
These changes improve the overall functionality and monitoring capabilities of the agent installation and synchronization process.
Denozordec