- GET /system/health splits processes into current instances (hosts with
a beat in the last 10 min, newest per host+kind, not stopped) and
retiredProcesses[]; 45s stale and level only consider current ones
- heartbeat writer marks stopped_at on graceful exit (migration 0043),
upsert clears it; pure api role now stops its writer on SIGTERM
- scheduled job system.heartbeat_cleanup (maintain, 1h) deletes rows
without a beat for 24h and samples older than 7 days
- status page: per-role alarms ("io worker 45 秒没有心跳"), collapsible
retired instances; glossary/runbook updated
- bump all members to 0.2.2, CHANGELOG [0.2.2]
Co-Authored-By: Claude Opus 5.5 <[email protected]>
shadcn (web devDependency) pulled a second peer copy of
@modelcontextprotocol/[email protected].1 (zod@3), so the server's zod@4 copy
lived in the npm cache as sdk/1.30.1_1. `deno compile --exclude-unused-npm`
embeds that _1 folder but the pruned snapshot resolves it as sdk/1.30.1,
so every SDK import failed at startup with ERR_MODULE_NOT_FOUND.
- drop the shadcn CLI dependency; vendor its tailwind.css (the only
runtime use) as apps/web/app/shadcn-tailwind.css, removing the duplicate
- scripts/check-compiled-binary.sh: run the compiled binary with an empty
env and `--role preflight`; it must load the full module graph and exit 2
on config validation. Wired into `deno task ci` (check:binary) and the
Dockerfile build stage.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- GET /auth/totp/setup returns the pending secret and otpauth URL (created
on first call, reused on refresh) for the console to render as a QR code.
- Enabling TOTP issues 8 one-time recovery codes (argon2id hashes in
admin_recovery_code); login accepts recoveryCode in place of totpCode,
disable accepts either, and recovery_codes regenerates with the password.
- Passkeys via @simplewebauthn/server: register/list/rename/delete under
the console session, public login options/verify that reuse the login
rate limit and session cookies. Challenges are one-time rows in
webauthn_challenge; RP ID and origins come from WEBAUTHN_RP_ID /
WEBAUTHN_ORIGINS, falling back to the request host. Signature counter
regressions are rejected. SessionInfo gains passkeyEnabled.
- --role rotate-master-key re-encrypts the secret table from
SECRET_MASTER_KEY to SECRET_MASTER_KEY_NEW one row per transaction,
skips rows already on the new key (resumable, swap keys to roll back),
logs progress and audits secret.master_key_rotate. Secrets now record
the master key fingerprint in kdf_params.kid.
- Runbook: recovery codes, passkey configuration, rotation steps and
rollback.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- POST /organization-records: sourcePaths must resolve (realpath) under a
registered library_root or downloader path-mapping host path; `..` and
symlink escapes rejected (400), dryRun included. Move requires an admin
session, or an API key with an automation_grant covering the entity or a
matching one-time approval (consumed on use), else 403. Manual Move from a
managed download_task with unsatisfied H&R returns 409 and opens a
decision; never silently downgraded to Copy.
- Series slot completion: total episode count is unknown while units are
provisional, so the slot is not satisfied and the subscription keeps
tracking; coverage is registered per actual file (creating provisional
episode units), and already_in_library files count as verified presence.
- POST /engine/runs/{id}/retry (admin): re-enqueue by original task name and
raw input with idempotency key retry:<id>:<n>, audited; retry button on
the run detail page.
- E7 regular series e2e, E8 AT24 tag removal / task disappearance e2e.
- All workspace members and root set to version 0.1.0; CHANGELOG.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
