Dashboard: replace HealthStatusBar + ActionQueue with consolidated
DashboardHero, add CompositionPanel for infrastructure/workload
breakdown, switch to 4-column grid layout, prevent flicker on
background refetches via initialLoadComplete guard.
AI Chat: migrate from legacy useAIChatResources() to unified
useResources() hook with proper platformData unwrapping and vmid
parsing.
Storage: extend StorageFilter with richer status/group-by options
and leading filters slot, add StorageHero component.
Backend: mark multi_tenant as implemented in MSP tier feature map.
Infra: update certification trackers GO_WITH_CONDITIONS → GO
(conditions resolved), update devcontainer Go refs to 1.25.7,
update validate-release.sh for embedded docker-agent binary,
add integration perf measurement utility, guard CSRF fetch in
test mode.
The legacy /api/resources endpoint was deleted in LEX-04, making the "v2"
prefix vestigial. This purely mechanical rename converges naming across
backend, frontend, tests, and docs with no behavioral changes.
Upgrades from go1.24.x to go1.25.7 across all surfaces:
- go.mod, Dockerfile, devcontainer, CI workflows, installer, build scripts
- govulncheck now exits 0 (was exit 3 with 3 reachable P1 findings)
- Zero remaining references to old toolchain version
- Close stdin with </dev/null when starting background Pulse process
- Prevents pipe fd leaks when function is called from piped while-read loops
- Apply fix to all three process start locations
Migrated all hardcoded paths to reference the NVMe drive directly
instead of relying on the ~/Development symlink. Also adds hot-dev-bg.sh
background runner script.
The previous commit added FreeBSD binaries to the Docker build and
release directory but didn't update the manifest generator or validation
script. Without this, FreeBSD binaries would be built but not tracked
or validated, and release validation would fail on the new entries.
Related to #1051
Two fixes for FreeBSD agent support:
1. The Docker image never built or included FreeBSD agent binaries, causing
404 errors when FreeBSD clients requested the download. Added FreeBSD
amd64/arm64 cross-compilation for both host-agent and unified-agent,
plus COPY statements to include them in the image. Also added bare
FreeBSD binaries to GitHub release assets for the redirect fallback.
2. pfSense does not use the standard FreeBSD rc.d boot system — scripts
in /usr/local/etc/rc.d/ must end in .sh to run at boot. The installer
now detects pfSense and creates a .sh boot wrapper alongside the
standard rc.d script. Also added -r flag to daemon for auto-restart.
Related to #1051
Restored original license signing key from backup - key was never
compromised (private repo). Removes unnecessary dual-key complexity:
- Remove legacyPublicKey and SetLegacyPublicKey from license.go
- Simplify signature verification to single key
- Remove EmbeddedLegacyPublicKey from pubkey.go
- Remove PULSE_LICENSE_LEGACY_PUBLIC_KEY from Dockerfile and workflows
- Remove dual-key test
- Simplify mock.env
The UI only showed a bash uninstall command which doesn't work on Windows.
Added PULSE_UNINSTALL env var support to install.ps1 and updated the UI
to display platform-specific uninstall commands for both Linux/macOS and
Windows.
Related to #1176
Replace bash associative arrays with parallel indexed arrays to ensure
the build script works on systems with older bash versions or when run
under /bin/sh.
Changes:
- Replace host_agent_builds associative array with host_agent_envs indexed array
- Replace builds associative array with build_envs indexed array
- Add array length validation to catch config mismatches early
- Use index-based iteration instead of key-based lookup
- Fixed --disable-docker not being passed to systemd service file. Related to #1151
- Added init: true requirement to HTTPS/TLS docs for Docker. Related to #1166
- Added --kube-include-all-pods and --kube-include-all-deployments flags
- Added --help support to install.sh
- Moved root check in install.sh to allow viewing help as non-root
When scripts/watch-backup.sh exists (gitignored, local only), hot-dev
automatically starts a file watcher that backs up source files on every
save to ~/.pulse-backups/. Protects against accidental data loss from
git checkout or other mishaps, regardless of what tool makes the change.
- hot-dev.sh: Fix hostname -I for macOS, use ifconfig instead
- hot-dev.sh: Fix PULSE_AUDIT_DIR for mock mode
- hot-dev.sh: Use PULSE_REPOS_DIR for Pro module detection
- dev-check.sh: Fix pgrep -c (not supported on macOS)
- dev-check.sh: Use /tmp/pulse-debug.log on macOS instead of journalctl
- Update internal/api docs to use env var paths
The sensor proxy approach for temperature monitoring has been superseded
by the unified agent architecture where host agents report temperature
data directly. This removes:
- cmd/pulse-sensor-proxy/ - standalone proxy daemon
- internal/tempproxy/ - client library
- internal/api/*temperature_proxy* - API handlers and tests
- internal/api/sensor_proxy_gate* - feature gate
- internal/monitoring/*proxy_test* - proxy-specific tests
- scripts/*sensor-proxy* - installation and management scripts
- security/apparmor/, security/seccomp/ - proxy security profiles
Temperature monitoring remains available via the unified agent approach.
Finds commits referencing GitHub issues (#xxx) and verifies the
fix is still present in the final diff before including it.
This prevents mentioning features/fixes that were later reverted.
The previous approach used commit messages which could include changes
that were later reverted. Now the script analyzes actual git diffs
between versions to identify user-facing changes.
Extracts diffs from:
- API handlers (new endpoints)
- Frontend components (new features)
- Config options (new settings)
- Alerts/notifications (webhook changes)
- Agent code (host/docker features)
- Install scripts
Passes structured diffs to LLM with instructions to write plain,
factual release notes without marketing language.
- Make URL validation case-insensitive to accept Http://, HTTP://, etc.
- Replace nohup with shell backgrounding for QNAP platform compatibility
- Add disown for SIGHUP protection where available
fix: AI chat mobile responsiveness. Related to #1131
- Use responsive width (full on mobile, 480px on larger screens)
- Add flex-wrap to header for better mobile layout
Implements exponential backoff restart loop in the wrapper script
for Unraid/Slackware installations. When the agent exits unexpectedly,
it will automatically restart with increasing delays (5s -> 60s max).
This improves reliability for users who don't have systemd for
automatic service restarts.
The agent was crashing with 'fatal error: concurrent map writes' when
handleCheckUpdatesCommand spawned a goroutine that called collectOnce
concurrently with the main collection loop. Both code paths access
a.prevContainerCPU without synchronization.
Added a.cpuMu mutex to protect all accesses to prevContainerCPU in:
- pruneStaleCPUSamples()
- collectContainer() delete operation
- calculateContainerCPUPercent()
Related to #1063
Add ability for users to describe what kind of agent profile they need
in natural language, and have AI generate a suggestion with name,
description, config values, and rationale.
- Add ProfileSuggestionHandler with schema-aware prompting
- Add SuggestProfileModal component with example prompts
- Update AgentProfilesPanel with suggest button and description field
- Streamline ValidConfigKeys to only agent-supported settings
- Update profile validation tests for simplified schema
Update the "Kiosk / Dashboard" token preset description to mention
the ?kiosk=1 URL parameter that hides navigation and filter panels,
making it clearer how to set up a wall display.
Addresses feedback from #1102
Allow users to set custom disk usage thresholds per mounted filesystem
on host agents, rather than applying a single threshold to all volumes.
This addresses NAS/NVR use cases where some volumes (e.g., NVR storage)
intentionally run at 99% while others need strict monitoring.
Backend:
- Check for disk-specific overrides before using HostDefaults.Disk
- Override key format: host:<hostId>/disk:<mountpoint>
- Support both custom thresholds and disable per-disk
Frontend:
- Add 'hostDisk' resource type
- Add "Host Disks" collapsible section in Thresholds → Hosts tab
- Group disks by host for easier navigation
Closes#1103
Major changes:
- Add audit_logging, advanced_sso, advanced_reporting features to Pro tier
- Persist session username for RBAC authorization after restart
- Add hot-dev auto-detection for pulse-pro binary (enables SQLite audit logging)
Frontend improvements:
- Replace isEnterprise() with hasFeature() for granular feature gating
- Update AuditLogPanel, OIDCPanel, RolesPanel, UserAssignmentsPanel, AISettings
- Update AuditWebhookPanel to use hasFeature('audit_logging')
Backend changes:
- Session store now persists and restores username field
- Update CreateSession/CreateOIDCSession to accept username parameter
- GetSessionUsername falls back to persisted username after restart
Testing:
- Update license_test.go to reflect Pro tier feature changes
- Update session tests for new username parameter
1. Add IPOverride field to ClusterEndpoint struct
- Allows users to specify a custom IP that takes precedence over auto-discovered IPs
- Fixes#929 and #1066 where Pulse used internal cluster IPs instead of management IPs
- Added EffectiveIP() method to cleanly handle the override logic
2. Update connection code to use EffectiveIP()
- monitor.go: Use override when building endpoint URLs
- temperature_proxy.go: Use override for proxy connections
3. Add bare Windows EXE files to GitHub releases
- Fixes#1064 where LXC/barebone installs couldn't download Windows agents
- Modified build-release.sh to copy EXEs alongside ZIPs
- Added EXEs to checksum generation
1. Use correct mutex (diagMu) in cleanupDiagnosticSnapshots to prevent
"concurrent map iteration and map write" panics (Fixes#1063)
2. Use cluster name for storage instance comparison in UpdateStorageForInstance
to prevent storage duplication in clustered Proxmox setups (Fixes#1062)
3. Fix KUBECONFIG unbound variable error in install.sh by using ${KUBECONFIG:-}
default parameter expansion (Fixes#1065)
macOS ships with bash 3.2 (GPLv2) which has a bug where expanding
an empty array like ${array[@]} with set -u enabled throws an
"unbound variable" error, even when the array is initialized.
Use ${arr[@]+"${arr[@]}"} pattern to safely handle empty arrays.
Related to #1046
Added FreeBSD amd64 and arm64 build targets to the release process:
- Build host-agent and unified agent binaries for FreeBSD
- Package FreeBSD tarballs in releases
- Include FreeBSD binaries in universal tarball for download endpoint
Updated agent install script with FreeBSD support:
- Fixed architecture detection (FreeBSD reports 'amd64' not 'x86_64')
- Added FreeBSD rc.d service handler with proper daemon management
- Automatic service enabling via rc.conf
This enables users to run the Pulse agent on FreeBSD-based systems
like OPNsense, pfSense, and vanilla FreeBSD.
Fixes#1041
