-
+
);
diff --git a/packages/vitnode/src/tanstack/admin/queue/index.ts b/packages/vitnode/src/tanstack/admin/queue/index.ts
index 38b374b550..49389f8ac9 100644
--- a/packages/vitnode/src/tanstack/admin/queue/index.ts
+++ b/packages/vitnode/src/tanstack/admin/queue/index.ts
@@ -1,6 +1,4 @@
export { queueQuery } from "./query";
-export type { AdminQueueRouteData } from "./route";
-export { ADMIN_QUEUE_NAMESPACES, loadAdminQueueRoute } from "./route";
export type { QueueRouteSearch, UncheckedQueueSearch } from "./route-search";
export {
normalizeQueueRouteSearch,
@@ -8,8 +6,6 @@ export {
queueSearchFrom,
queueSearchParams,
} from "./route-search";
-export type { AdminQueueRouteProps } from "./screen";
-export { AdminQueueRouteContent } from "./screen";
export type {
QueueOrderBy,
diff --git a/packages/vitnode/src/tanstack/admin/queue/route.tsx b/packages/vitnode/src/tanstack/admin/queue/route.tsx
deleted file mode 100644
index 79bc015714..0000000000
--- a/packages/vitnode/src/tanstack/admin/queue/route.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import type { PluginRouteTranslator } from "@/routing";
-import type { QueueParams } from "@/views/admin/views/core/advanced/queue/queue-query";
-
-import type { AdminScreenContext } from "../screen";
-
-import { requireAdminPermission } from "../screen";
-import { queueQuery } from "./query";
-
-/**
- * `/admin/core/advanced/queue`, as everything a TanStack Start route needs and
- * nothing a route owns.
- */
-
-export const ADMIN_QUEUE_NAMESPACES = [
- "admin.advanced.queue",
- "core.global",
-] as const;
-
-/** What {@link loadAdminQueueRoute} returns, and therefore what `head` receives. */
-export interface AdminQueueRouteData {
- description: string;
- params: QueueParams;
- title: string;
-}
-
-const QUEUE_VIEW_PERMISSION = {
- module: "queue",
- permission: "can_view",
-} as const;
-
-export const loadAdminQueueRoute = async ({
- adminAccess,
- params,
- queryClient,
- t,
-}: AdminScreenContext & {
- params: QueueParams;
- t: PluginRouteTranslator;
-}): Promise
=> {
- requireAdminPermission(adminAccess, QUEUE_VIEW_PERMISSION);
-
- await queryClient.query({
- ...queueQuery({ params }),
- staleTime: "static",
- });
-
- return {
- description: t("admin.advanced.queue.desc"),
- params,
- title: t("admin.advanced.queue.title"),
- };
-};
diff --git a/packages/vitnode/src/tanstack/admin/queue/screen.tsx b/packages/vitnode/src/tanstack/admin/queue/screen.tsx
deleted file mode 100644
index 65b9091b45..0000000000
--- a/packages/vitnode/src/tanstack/admin/queue/screen.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import { useSuspenseQuery } from "@tanstack/react-query";
-import React from "react";
-
-import type { DataTableNavigation } from "@/components/table/navigation";
-
-import { DataTableNavigationProvider } from "@/components/table/navigation";
-import { PageTitle } from "@/components/ui/page-title";
-import { QueueTableContent } from "@/views/admin/views/core/advanced/queue/queue-table-content";
-
-import type { AdminTableNavigate } from "../table-search";
-import type { AdminQueueRouteData } from "./route";
-import type { QueueRouteSearch, UncheckedQueueSearch } from "./route-search";
-
-import { RouteMessages } from "../../i18n/route-messages";
-import { queueQuery } from "./query";
-import { ADMIN_QUEUE_NAMESPACES } from "./route";
-import { queueSearchFrom, queueSearchParams } from "./route-search";
-
-export interface AdminQueueRouteProps extends AdminQueueRouteData {
- navigate: AdminTableNavigate;
- search: UncheckedQueueSearch;
-}
-
-export const AdminQueueRouteContent = ({
- description,
- navigate,
- params,
- search,
- title,
-}: AdminQueueRouteProps) => {
- const { data } = useSuspenseQuery(queueQuery({ params }));
-
- const navigation = React.useMemo(
- () => ({
- navigate: async nextSearch => {
- await navigate({
- resetScroll: false,
- search: queueSearchFrom(nextSearch),
- });
- },
- searchParams: queueSearchParams(search),
- }),
- [navigate, search],
- );
-
- return (
-
-
-
- );
-};
diff --git a/packages/vitnode/src/tanstack/admin/search-index/index.ts b/packages/vitnode/src/tanstack/admin/search-index/index.ts
index 2d57beeced..80f04038d6 100644
--- a/packages/vitnode/src/tanstack/admin/search-index/index.ts
+++ b/packages/vitnode/src/tanstack/admin/search-index/index.ts
@@ -3,11 +3,6 @@ export {
searchIndexQuery,
useSearchIndexActions,
} from "./query";
-export type { AdminSearchIndexRouteData } from "./route";
-export {
- ADMIN_SEARCH_INDEX_NAMESPACES,
- loadAdminSearchIndexRoute,
-} from "./route";
export type {
SearchIndexRouteSearch,
UncheckedSearchIndexSearch,
@@ -17,8 +12,6 @@ export {
searchIndexSearchFrom,
searchIndexSearchParams,
} from "./route-search";
-export type { AdminSearchIndexRouteProps } from "./screen";
-export { AdminSearchIndexRouteContent } from "./screen";
export type {
ClearSearchCollection,
diff --git a/packages/vitnode/src/tanstack/admin/search-index/route.tsx b/packages/vitnode/src/tanstack/admin/search-index/route.tsx
deleted file mode 100644
index 863c174747..0000000000
--- a/packages/vitnode/src/tanstack/admin/search-index/route.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-import type { PluginRouteTranslator } from "@/routing";
-
-import type { AdminScreenContext } from "../screen";
-
-import { requireAdminPermission } from "../screen";
-import { searchIndexQuery } from "./query";
-
-/**
- * `/admin/core/advanced/search`, as everything a TanStack Start route needs and
- * nothing a route owns.
- */
-
-export const ADMIN_SEARCH_INDEX_NAMESPACES = [
- "core.global",
- "core.search",
-] as const;
-
-/** What {@link loadAdminSearchIndexRoute} returns - and what `head` receives. */
-export interface AdminSearchIndexRouteData {
- description: string;
- title: string;
-}
-
-const SEARCH_INDEX_PERMISSION = {
- module: "system",
- permission: "can_view",
-} as const;
-
-export const loadAdminSearchIndexRoute = async ({
- adminAccess,
- queryClient,
- t,
-}: AdminScreenContext & {
- t: PluginRouteTranslator;
-}): Promise => {
- requireAdminPermission(adminAccess, SEARCH_INDEX_PERMISSION);
-
- await queryClient.query({
- ...searchIndexQuery(),
- staleTime: "static",
- });
-
- return {
- description: t("core.search.admin.desc"),
- title: t("core.search.admin.title"),
- };
-};
diff --git a/packages/vitnode/src/tanstack/admin/search-index/screen.tsx b/packages/vitnode/src/tanstack/admin/search-index/screen.tsx
deleted file mode 100644
index 3c918cb031..0000000000
--- a/packages/vitnode/src/tanstack/admin/search-index/screen.tsx
+++ /dev/null
@@ -1,76 +0,0 @@
-import { useSuspenseQuery } from "@tanstack/react-query";
-import React from "react";
-
-import type { DataTableNavigation } from "@/components/table/navigation";
-
-import { AdminStaffPermissionGate } from "@/components/staff-permission/provider";
-import { DataTableNavigationProvider } from "@/components/table/navigation";
-import { PageTitle } from "@/components/ui/page-title";
-import { SearchHeaderActions } from "@/views/admin/views/core/advanced/search/search-header-actions";
-import { SearchIndexContent } from "@/views/admin/views/core/advanced/search/search-index-content";
-import { ADMIN_SEARCH_PERMISSIONS } from "@/views/admin/views/core/shared/admin-permissions";
-
-import type { AdminTableNavigate } from "../table-search";
-import type { AdminSearchIndexRouteData } from "./route";
-import type {
- SearchIndexRouteSearch,
- UncheckedSearchIndexSearch,
-} from "./route-search";
-
-import { RouteMessages } from "../../i18n/route-messages";
-import { searchIndexQuery, useSearchIndexActions } from "./query";
-import { ADMIN_SEARCH_INDEX_NAMESPACES } from "./route";
-import { searchIndexSearchFrom, searchIndexSearchParams } from "./route-search";
-
-export interface AdminSearchIndexRouteProps extends AdminSearchIndexRouteData {
- collectionLabels?: Map;
- navigate: AdminTableNavigate;
- search: UncheckedSearchIndexSearch;
-}
-
-export const AdminSearchIndexRouteContent = ({
- collectionLabels,
- description,
- navigate,
- search,
- title,
-}: AdminSearchIndexRouteProps) => {
- const { data } = useSuspenseQuery(searchIndexQuery());
- const actions = useSearchIndexActions();
-
- const navigation = React.useMemo(
- () => ({
- navigate: async nextSearch => {
- await navigate({
- resetScroll: false,
- search: searchIndexSearchFrom(nextSearch),
- });
- },
- searchParams: searchIndexSearchParams(search),
- }),
- [navigate, search],
- );
-
- return (
-
-
-
- );
-};
diff --git a/packages/vitnode/src/tanstack/admin/tab-presence.test.tsx b/packages/vitnode/src/tanstack/admin/tab-presence.test.tsx
index f2a88cca2f..98c22de7e4 100644
--- a/packages/vitnode/src/tanstack/admin/tab-presence.test.tsx
+++ b/packages/vitnode/src/tanstack/admin/tab-presence.test.tsx
@@ -69,7 +69,7 @@ describe("isAdminSessionStillInUse", () => {
it("is in use while a quiet background tab still answers", async () => {
localStorage.setItem(
ADMIN_TAB_HEARTBEAT_KEY,
- String(Date.now() - 10 * 60_000),
+ String(Date.now() - ADMIN_TAB_HEARTBEAT_FRESH_MS - 60_000),
);
const stop = answerAdminTabPings();
@@ -80,7 +80,7 @@ describe("isAdminSessionStillInUse", () => {
it("is abandoned once every AdminCP tab was closed", async () => {
localStorage.setItem(
ADMIN_TAB_HEARTBEAT_KEY,
- String(Date.now() - 10 * 60_000),
+ String(Date.now() - ADMIN_TAB_HEARTBEAT_FRESH_MS - 60_000),
);
await expect(isAdminSessionStillInUse()).resolves.toBe(false);
diff --git a/packages/vitnode/src/tanstack/admin/tab-presence.ts b/packages/vitnode/src/tanstack/admin/tab-presence.ts
index 801f10ae9f..359c4e6765 100644
--- a/packages/vitnode/src/tanstack/admin/tab-presence.ts
+++ b/packages/vitnode/src/tanstack/admin/tab-presence.ts
@@ -4,7 +4,7 @@ export const ADMIN_TAB_CHANNEL = "vitnode:admin-tabs";
export const ADMIN_TAB_HEARTBEAT_INTERVAL_MS = 5_000;
-export const ADMIN_TAB_HEARTBEAT_FRESH_MS = 15_000;
+export const ADMIN_TAB_HEARTBEAT_FRESH_MS = 60 * 60_000;
export const ADMIN_TAB_PING_TIMEOUT_MS = 750;
diff --git a/packages/vitnode/src/tanstack/admin/user-bar.tsx b/packages/vitnode/src/tanstack/admin/user-bar.tsx
index d9f1306180..e85db0233b 100644
--- a/packages/vitnode/src/tanstack/admin/user-bar.tsx
+++ b/packages/vitnode/src/tanstack/admin/user-bar.tsx
@@ -1,4 +1,5 @@
import { useQueryClient } from "@tanstack/react-query";
+import React from "react";
import { toast } from "sonner";
import { useTranslations } from "use-intl";
@@ -9,6 +10,10 @@ import { LanguageSwitcher } from "../layout/language-switcher";
import { useAdminUser } from "./permissions";
import { removeAdminIdentityQueries } from "./queries";
+const DebugStatus = React.lazy(async () =>
+ import("./debug/status").then(module => ({ default: module.DebugStatus })),
+);
+
export const AdminUserBar = () => {
const user = useAdminUser();
const signOut = useSignOutAction();
@@ -33,6 +38,11 @@ export const AdminUserBar = () => {
return (
+ | void;
user: AdminUserBarUser;
@@ -69,7 +71,10 @@ export const UserBarAdminContent = ({
}
>
+ {canViewDebug ? debugStatus : null}
+
- {t("list.lastRun.never")}
+
+
+
+ {row.schedule}
+
+
- ),
- },
- {
- accessorKey: "nextRun",
- header: t("list.nextRun.title"),
- cell: ({ row }) =>
- row.nextRun ? (
-
- {t("list.nextRun.never")}
+
+ {t.rich("list.time.last", {
+ date: () =>
+ row.lastRun ? (
+
- ),
+
+ ),
},
{
id: "actions",
@@ -132,10 +127,10 @@ export const CronTableContent = ({
edges={data.edges}
id="cron-table"
order={{
- columns: ["lastRun", "createdAt", "nextRun"],
+ columns: ["nextRun"],
defaultOrder: {
- column: "lastRun",
- order: "desc",
+ column: "nextRun",
+ order: "asc",
},
}}
pageInfo={data.pageInfo}
diff --git a/packages/vitnode/src/views/admin/views/core/debug/health/health.ts b/packages/vitnode/src/views/admin/views/core/debug/health/health.ts
new file mode 100644
index 0000000000..08fe58c657
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/debug/health/health.ts
@@ -0,0 +1,503 @@
+import type { DebugTab } from "@/tanstack/admin/debug/route-search";
+import type { DebugSystemTab } from "@/tanstack/admin/debug/tabs";
+import type { CronHealth } from "@/views/admin/views/core/advanced/cron/cron-query";
+import type { SearchIndexStatus } from "@/views/admin/views/core/advanced/search/search-index-query";
+import type { AdminIntegrations } from "@/views/admin/views/core/system/integrations/integrations-query";
+import type {
+ AdminComponentUpdate,
+ AdminPluginUpdates,
+} from "@/views/admin/views/core/system/plugins/plugin-updates-query";
+import type {
+ AdminInstalledPlugin,
+ AdminInstalledPlugins,
+} from "@/views/admin/views/core/system/plugins/plugins-query";
+
+import type { DebugQueueSnapshot } from "../debug-query";
+
+export type DebugTone = "critical" | "off" | "ok" | "warn";
+
+export interface DebugSources {
+ cronHealth?: CronHealth;
+ installed?: AdminInstalledPlugins;
+ integrations?: AdminIntegrations;
+ queue?: DebugQueueSnapshot;
+ search?: SearchIndexStatus;
+ updates?: AdminPluginUpdates;
+}
+
+export const PLUGIN_PROBLEMS = [
+ "security_update",
+ "version_mismatch",
+ "update_available",
+ "source_unreachable",
+] as const;
+
+export type PluginProblemKind = (typeof PLUGIN_PROBLEMS)[number];
+
+export const DEBUG_SERVICES = [
+ "email",
+ "storage",
+ "ai",
+ "captcha",
+ "websocket",
+] as const;
+
+export type DebugService = (typeof DEBUG_SERVICES)[number];
+
+export type DebugMessageKey =
+ | "cache.memory"
+ | "cache.redis_connected"
+ | "cache.redis_down"
+ | "cache.subtitle_memory"
+ | "cache.subtitle_redis"
+ | "cron.failed_tasks"
+ | "cron.insecure_secret"
+ | "cron.ok"
+ | "cron.overdue"
+ | "cron.stopped"
+ | "cron.subtitle_adapter"
+ | "cron.subtitle_external"
+ | "plugins.ok"
+ | "plugins.subtitle"
+ | "search.engine_down"
+ | "search.incomplete"
+ | "search.ok"
+ | "search.subtitle"
+ | "search.sync_errors"
+ | "services.subtitle"
+ | "vitnode.not_checked"
+ | "vitnode.security_update"
+ | "vitnode.source_unreachable"
+ | "vitnode.subtitle"
+ | "vitnode.up_to_date"
+ | "vitnode.update_available"
+ | `plugins.problem.${PluginProblemKind}`
+ | `plugins.summary.${PluginProblemKind}`
+ | `services.${DebugService}`;
+
+export interface DebugMessage {
+ key: DebugMessageKey;
+ values?: Record;
+}
+
+export interface DebugCheck {
+ area: DebugSystemTab;
+ detail?: string;
+ id: string;
+ message: DebugMessage;
+ tab: DebugTab;
+ tone: DebugTone;
+}
+
+export interface DebugArea {
+ checks: DebugCheck[];
+ id: DebugSystemTab;
+ subtitle: DebugMessage;
+ tone: DebugTone;
+}
+
+export interface DebugHealth {
+ areas: DebugArea[];
+ issues: DebugCheck[];
+}
+
+const TONE_RANK: Record = {
+ off: 0,
+ ok: 1,
+ warn: 2,
+ critical: 3,
+};
+
+export const isProblem = (tone: DebugTone): boolean =>
+ tone === "critical" || tone === "warn";
+
+const worstTone = (tones: DebugTone[]): DebugTone =>
+ tones.reduce(
+ (worst, tone) => (TONE_RANK[tone] > TONE_RANK[worst] ? tone : worst),
+ "off",
+ );
+
+export const coreSecurityUpdate = (updates: AdminPluginUpdates | undefined) => {
+ const result = updates?.core.result;
+ const [securityUpdate] = result?.securityUpdates ?? [];
+ if (!result || !securityUpdate) return null;
+
+ return {
+ count: result.securityUpdates.length,
+ fixedVersion: result.latest?.version ?? securityUpdate.fixed,
+ latest: result.latest,
+ securityUpdate,
+ };
+};
+
+const vitnodeChecks = (
+ installed: AdminInstalledPlugins,
+ updates: AdminPluginUpdates | undefined,
+): DebugCheck[] => {
+ const check = (
+ id: string,
+ tone: DebugTone,
+ message: DebugMessage,
+ detail?: string,
+ ): DebugCheck => ({
+ area: "vitnode",
+ detail,
+ id,
+ message,
+ tab: "vitnode",
+ tone,
+ });
+ const core = updates?.core;
+ const security = coreSecurityUpdate(updates);
+
+ if (security) {
+ return [
+ check(
+ "vitnode-security-update",
+ "critical",
+ {
+ key: "vitnode.security_update",
+ values: { version: security.fixedVersion ?? "" },
+ },
+ security.securityUpdate.id,
+ ),
+ ];
+ }
+ if (core?.result?.status === "update_available") {
+ return [
+ check("vitnode-update", "warn", {
+ key: "vitnode.update_available",
+ values: { version: core.result.latest?.version ?? "" },
+ }),
+ ];
+ }
+ if (core?.lastError) {
+ return [
+ check(
+ "vitnode-source",
+ "warn",
+ { key: "vitnode.source_unreachable" },
+ [core.lastError.code, core.lastError.detail].filter(Boolean).join(" "),
+ ),
+ ];
+ }
+ if (!core || core.state !== "checked") {
+ return [
+ check("vitnode-not-checked", "off", { key: "vitnode.not_checked" }),
+ ];
+ }
+
+ return [
+ check("vitnode-latest", "ok", {
+ key: "vitnode.up_to_date",
+ values: { version: installed.core.version },
+ }),
+ ];
+};
+
+export interface PluginProblem {
+ kind: PluginProblemKind;
+ tone: "critical" | "warn";
+ values?: Record;
+}
+
+export const pluginProblem = (
+ plugin: AdminInstalledPlugin,
+ update: AdminComponentUpdate | undefined,
+): null | PluginProblem => {
+ if (update?.result?.securityUpdates.length) {
+ return { kind: "security_update", tone: "critical" };
+ }
+ if (plugin.versionMismatch) {
+ return { kind: "version_mismatch", tone: "warn" };
+ }
+ if (update?.result?.status === "update_available") {
+ return {
+ kind: "update_available",
+ tone: "warn",
+ values: { version: update.result.latest?.version ?? "" },
+ };
+ }
+ if (update?.lastError) {
+ return { kind: "source_unreachable", tone: "warn" };
+ }
+
+ return null;
+};
+
+const pluginChecks = (
+ installed: AdminInstalledPlugins,
+ updates: AdminPluginUpdates | undefined,
+): DebugCheck[] => {
+ const grouped = new Map<
+ PluginProblemKind,
+ { names: string[]; tone: DebugTone }
+ >();
+ for (const plugin of installed.plugins) {
+ const problem = pluginProblem(
+ plugin,
+ updates?.plugins.find(update => update.id === plugin.id),
+ );
+ if (!problem) continue;
+ const group = grouped.get(problem.kind) ?? {
+ names: [],
+ tone: problem.tone,
+ };
+ group.names.push(plugin.title);
+ grouped.set(problem.kind, group);
+ }
+
+ if (grouped.size === 0) {
+ return [
+ {
+ area: "plugins",
+ id: "plugins-ok",
+ message: {
+ key: "plugins.ok",
+ values: { count: installed.plugins.length },
+ },
+ tab: "plugins",
+ tone: "ok",
+ },
+ ];
+ }
+
+ return [...grouped.entries()].map(([kind, group]) => ({
+ area: "plugins",
+ detail: group.names.join(", "),
+ id: `plugins-${kind}`,
+ message: {
+ key: `plugins.summary.${kind}`,
+ values: { count: group.names.length },
+ },
+ tab: "plugins",
+ tone: group.tone,
+ }));
+};
+
+const cronChecks = (
+ cronHealth: CronHealth,
+ integrations: AdminIntegrations | undefined,
+ queue: DebugQueueSnapshot | undefined,
+): DebugCheck[] => {
+ const checks: DebugCheck[] = [];
+ const check = (
+ id: string,
+ tone: DebugTone,
+ message: DebugMessage,
+ tab: DebugTab = "cron",
+ ) => {
+ checks.push({ area: "cron", id, message, tab, tone });
+ };
+
+ if (cronHealth.secretRejected || integrations?.cron.secure === false) {
+ check("cron-secret", "critical", { key: "cron.insecure_secret" });
+ }
+ if (cronHealth.stale) {
+ check("cron-stopped", "critical", { key: "cron.stopped" });
+ }
+ if (cronHealth.overdueJobs > 0) {
+ check("cron-overdue", "warn", {
+ key: "cron.overdue",
+ values: { count: cronHealth.overdueJobs },
+ });
+ }
+ if (queue && queue.counts.failed > 0) {
+ check(
+ "queue-failed",
+ "warn",
+ { key: "cron.failed_tasks", values: { count: queue.counts.failed } },
+ "queue",
+ );
+ }
+ if (checks.length === 0) {
+ check("cron-ok", "ok", {
+ key: "cron.ok",
+ values: { count: cronHealth.jobs },
+ });
+ }
+
+ return checks;
+};
+
+const cacheChecks = (integrations: AdminIntegrations): DebugCheck[] => {
+ const check = (
+ id: string,
+ tone: DebugTone,
+ key: DebugMessageKey,
+ ): DebugCheck[] => [
+ { area: "cache", id, message: { key }, tab: "cache", tone },
+ ];
+
+ if (integrations.redis.configuredButDown) {
+ return check("cache-redis-down", "critical", "cache.redis_down");
+ }
+
+ return integrations.redis.active
+ ? check("cache-redis", "ok", "cache.redis_connected")
+ : check("cache-memory", "off", "cache.memory");
+};
+
+const searchChecks = (search: SearchIndexStatus): DebugCheck[] => {
+ const checks: DebugCheck[] = [];
+ const check = (
+ id: string,
+ tone: DebugTone,
+ message: DebugMessage,
+ detail?: string,
+ ) => {
+ checks.push({ area: "search", detail, id, message, tab: "search", tone });
+ };
+
+ if (!search.healthy) {
+ check("search-down", "critical", {
+ key: "search.engine_down",
+ values: { engine: search.engine },
+ });
+ }
+ const incomplete = search.collections.filter(
+ collection =>
+ collection.total !== null && collection.indexed < collection.total,
+ );
+ if (incomplete.length > 0) {
+ check(
+ "search-incomplete",
+ "warn",
+ { key: "search.incomplete", values: { count: incomplete.length } },
+ incomplete
+ .map(
+ collection =>
+ `${collection.itemType} ${String(collection.indexed)}/${String(collection.total)}`,
+ )
+ .join(" · "),
+ );
+ }
+ if (search.syncErrors.length > 0) {
+ check("search-sync", "warn", {
+ key: "search.sync_errors",
+ values: { count: search.syncErrors.length },
+ });
+ }
+ if (checks.length === 0) {
+ check("search-ok", "ok", {
+ key: "search.ok",
+ values: { count: search.total },
+ });
+ }
+
+ return checks;
+};
+
+export const isServiceActive = (
+ integrations: AdminIntegrations,
+ service: DebugService,
+): boolean => integrations[service].active;
+
+const serviceChecks = (integrations: AdminIntegrations): DebugCheck[] =>
+ DEBUG_SERVICES.map(service => ({
+ area: "services",
+ id: `service-${service}`,
+ message: { key: `services.${service}` as const },
+ tab: "services",
+ tone: isServiceActive(integrations, service) ? "ok" : "off",
+ }));
+
+const area = (
+ id: DebugSystemTab,
+ subtitle: DebugMessage,
+ checks: DebugCheck[],
+): DebugArea => ({
+ checks,
+ id,
+ subtitle,
+ tone: worstTone(checks.map(check => check.tone)),
+});
+
+export const debugHealth = ({
+ cronHealth,
+ installed,
+ integrations,
+ queue,
+ search,
+ updates,
+}: DebugSources): DebugHealth => {
+ const areas: DebugArea[] = [];
+
+ if (installed) {
+ areas.push(
+ area(
+ "vitnode",
+ {
+ key: "vitnode.subtitle",
+ values: { version: installed.core.version },
+ },
+ vitnodeChecks(installed, updates),
+ ),
+ area(
+ "plugins",
+ {
+ key: "plugins.subtitle",
+ values: { count: installed.plugins.length },
+ },
+ pluginChecks(installed, updates),
+ ),
+ );
+ }
+ if (cronHealth) {
+ areas.push(
+ area(
+ "cron",
+ {
+ key: cronHealth.active
+ ? "cron.subtitle_adapter"
+ : "cron.subtitle_external",
+ },
+ cronChecks(cronHealth, integrations, queue),
+ ),
+ );
+ }
+ if (integrations) {
+ areas.push(
+ area(
+ "cache",
+ {
+ key: integrations.redis.active
+ ? "cache.subtitle_redis"
+ : "cache.subtitle_memory",
+ },
+ cacheChecks(integrations),
+ ),
+ );
+ }
+ if (search) {
+ areas.push(
+ area(
+ "search",
+ { key: "search.subtitle", values: { engine: search.engine } },
+ searchChecks(search),
+ ),
+ );
+ }
+ if (integrations) {
+ const active = DEBUG_SERVICES.filter(service =>
+ isServiceActive(integrations, service),
+ ).length;
+ areas.push(
+ area(
+ "services",
+ {
+ key: "services.subtitle",
+ values: { active, total: DEBUG_SERVICES.length },
+ },
+ serviceChecks(integrations),
+ ),
+ );
+ }
+
+ const issues = areas
+ .flatMap(entry => entry.checks)
+ .filter(check => isProblem(check.tone))
+ .sort((a, b) => TONE_RANK[b.tone] - TONE_RANK[a.tone]);
+
+ return { areas, issues };
+};
diff --git a/packages/vitnode/src/views/admin/views/core/debug/nav/debug-nav.tsx b/packages/vitnode/src/views/admin/views/core/debug/nav/debug-nav.tsx
new file mode 100644
index 0000000000..414b2b63fc
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/debug/nav/debug-nav.tsx
@@ -0,0 +1,218 @@
+import {
+ BoxIcon,
+ ClockIcon,
+ DatabaseZapIcon,
+ LayoutGridIcon,
+ ListTodoIcon,
+ MenuIcon,
+ PlugIcon,
+ PuzzleIcon,
+ ScrollTextIcon,
+ SearchIcon,
+ SparklesIcon,
+ XIcon,
+} from "lucide-react";
+import React from "react";
+import { useTranslations } from "use-intl";
+
+import type { DebugTab } from "@/tanstack/admin/debug/route-search";
+
+import {
+ SideNav,
+ SideNavGroup,
+ SideNavLink,
+ SideNavList,
+} from "@/components/side-nav";
+import { Button } from "@/components/ui/button";
+import {
+ Drawer,
+ DrawerClose,
+ DrawerContent,
+ DrawerTitle,
+ DrawerTrigger,
+} from "@/components/ui/drawer";
+import { debugTabPath } from "@/tanstack/admin/debug/route-search";
+import {
+ DEBUG_DIAGNOSTIC_TABS,
+ DEBUG_SYSTEM_TABS,
+} from "@/tanstack/admin/debug/tabs";
+
+import type { DebugHealth } from "../health/health";
+
+import { isProblem } from "../health/health";
+import { TONE_TEXT } from "../tone";
+
+export const DEBUG_TAB_ICONS: Record<
+ DebugTab,
+ React.ComponentType<{ className?: string }>
+> = {
+ ai: SparklesIcon,
+ cache: DatabaseZapIcon,
+ cron: ClockIcon,
+ logs: ScrollTextIcon,
+ overview: LayoutGridIcon,
+ plugins: PuzzleIcon,
+ queue: ListTodoIcon,
+ search: SearchIcon,
+ services: PlugIcon,
+ vitnode: BoxIcon,
+};
+
+const NavItem = ({
+ active,
+ count,
+ countTone,
+ onNavigate,
+ tab,
+}: {
+ active: boolean;
+ count?: number;
+ countTone?: "critical" | "warn";
+ onNavigate?: () => void;
+ tab: DebugTab;
+}) => {
+ const t = useTranslations("admin.debug.nav");
+
+ return (
+
+
+
+
+ {groups
+ .filter(group => group.tabs.length > 0)
+ .map(group => (
+
+
+ {group.tabs.map(tab => {
+ const area = health.areas.find(entry => entry.id === tab);
+ const issues =
+ area?.checks.filter(check => isProblem(check.tone)) ?? [];
+
+ return (
+
+
+ ))}
+
+ );
+};
+
+export const DebugNav = ({
+ active,
+ health,
+ tabs,
+}: {
+ active: DebugTab;
+ health: DebugHealth;
+ tabs: DebugTab[];
+}) => {
+ const t = useTranslations("admin.debug");
+ const tGlobal = useTranslations("core.global");
+ const [isOpen, setIsOpen] = React.useState(false);
+
+ return (
+ <>
+
+
+
+
+ {t("nav.menu")}
+ {t(`nav.${active}`)}
+
+
+
+
+
+ {t("title")}
+
+
+
+
+
+
+
+ {
+ setIsOpen(false);
+ }}
+ tabs={tabs}
+ />
+
+
+
+
+
+
+ );
+};
diff --git a/packages/vitnode/src/views/admin/views/core/debug/queue/queue-view-content.tsx b/packages/vitnode/src/views/admin/views/core/debug/queue/queue-view-content.tsx
deleted file mode 100644
index 4b29a70ecc..0000000000
--- a/packages/vitnode/src/views/admin/views/core/debug/queue/queue-view-content.tsx
+++ /dev/null
@@ -1,83 +0,0 @@
-import { useTranslations } from "use-intl";
-
-import { DateFormat } from "@/components/date-format";
-import {
- Table,
- TableBody,
- TableCell,
- TableHead,
- TableHeader,
- TableRow,
-} from "@/components/ui/table";
-import { QueueStatusBadge } from "@/views/admin/views/core/advanced/queue/badges/status-badge";
-
-import type { DebugQueueSnapshot } from "../debug-query";
-
-/** The four counters, in the order the debug panel shows them. */
-const COUNT_STATUSES = [
- "pending",
- "processing",
- "completed",
- "failed",
-] as const;
-
-export const QueueViewContent = ({ data }: { data: DebugQueueSnapshot }) => {
- const t = useTranslations("admin.debug.queue");
-
- return (
-
-
- {COUNT_STATUSES.map(status => (
-
-
- {t(`counts.${status}`)}
-
-
{data.counts[status]}
-
- ))}
-
-
- {data.active.length === 0 ? (
-
{t("empty")}
- ) : (
-
-
-
-
- {t("list.name")}
- {t("list.queue")}
- {t("list.status")}
- {t("list.attempts")}
- {t("list.availableAt")}
-
-
-
- {data.active.map(task => (
-
-
-
- {task.name}
-
- {task.pluginId}
-
-
-
- {task.queue}
-
-
-
- {task.attempts}/{task.maxAttempts}
-
-
-
-
- ))}
-
-
-
- )}
-
+ {children}
+
+);
+
+export const FactRow = ({
+ label,
+ value,
+}: {
+ label: string;
+ value: React.ReactNode;
+}) => (
+
+ {label}
+ {value}
+
+);
+
+export const CheckRow = ({ check }: { check: DebugCheck }) => {
+ const t = useTranslations("admin.debug.health");
+ const loud = isProblem(check.tone);
+
+ return (
+
+
+
+ {t(check.message.key, check.message.values)}
+
+ {check.detail ? (
+
+ {check.detail}
+
+ ) : null}
+
+
+ );
+};
+
+export const SectionHeader = ({
+ action,
+ badge,
+ description,
+ title,
+}: {
+ action?: React.ReactNode;
+ badge?: React.ReactNode;
+ description: React.ReactNode;
+ title: React.ReactNode;
+}) => (
+
+
+
+ {title}
+ {badge}
+
+
+ {description}
+
+
+);
diff --git a/packages/vitnode/src/views/admin/views/core/debug/sections/overview.tsx b/packages/vitnode/src/views/admin/views/core/debug/sections/overview.tsx
new file mode 100644
index 0000000000..2713888450
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/debug/sections/overview.tsx
@@ -0,0 +1,153 @@
+import { Link } from "@tanstack/react-router";
+import { ChevronRightIcon, RefreshCwIcon } from "lucide-react";
+import { useTranslations } from "use-intl";
+
+import type { AdminPluginUpdates } from "@/views/admin/views/core/system/plugins/plugin-updates-query";
+
+import { AdminStaffPermissionGate } from "@/components/staff-permission/provider";
+import { Button } from "@/components/ui/button";
+import {
+ Frame,
+ FrameAction,
+ FrameDescription,
+ FrameHeader,
+ FramePanel,
+ FrameTitle,
+} from "@/components/ui/frame";
+import { debugTabPath } from "@/tanstack/admin/debug/route-search";
+import { ADMIN_DEBUG_PERMISSIONS } from "@/views/admin/views/core/shared/admin-permissions";
+
+import type { DebugHealth } from "../health/health";
+
+import { ClearCacheAction } from "../actions/clear-cache/clear-cache";
+import { DEBUG_TAB_ICONS } from "../nav/debug-nav";
+import { ToneIcon } from "../tone";
+import { FRAME_ACTION_STACKED } from "./frame-row";
+import { SecurityUpdateAlert } from "./security";
+
+const ROW_LINK =
+ "hover:bg-muted/50 focus-visible:bg-muted/50 flex items-center gap-3 px-4 py-3 text-start transition-colors outline-none";
+
+export const DebugOverview = ({
+ health,
+ isRechecking,
+ onClearCache,
+ onRecheck,
+ updates,
+ version,
+}: {
+ health: DebugHealth;
+ isRechecking: boolean;
+ onClearCache: () => Promise;
+ onRecheck: () => void;
+ updates: AdminPluginUpdates | undefined;
+ version: null | string;
+}) => {
+ const t = useTranslations("admin.debug");
+ const tHealth = useTranslations("admin.debug.health");
+ const critical = health.issues.filter(issue => issue.tone === "critical");
+ const warnings = health.issues.length - critical.length;
+
+ return (
+
+ {version ? (
+
+ ) : null}
+
+
+
+
+ {health.issues.length > 0
+ ? t("overview.attention", { count: health.issues.length })
+ : t("overview.healthy")}
+
+
+ {t("overview.summary", {
+ critical: critical.length,
+ warnings,
+ })}
+
+
+
+ {isRechecking ? null :
+
+
+ {health.issues.length > 0 ? (
+
+ {health.issues.map(issue => (
+
+
+ {tHealth(issue.message.key, issue.message.values)}
+
+ {issue.detail ? (
+
+ {issue.detail}
+
+ ) : null}
+
+
+ ) : null}
+
+
+ {health.areas.length > 0 ? (
+
+
+ {t("overview.systems.title")}
+ {t("overview.systems.desc")}
+
+
+
+
+
+
+ {health.areas.map(area => {
+ const Icon = DEBUG_TAB_ICONS[area.id];
+
+ return (
+
+ {t(`nav.${area.id}`)}
+
+
+ {tHealth(area.subtitle.key, area.subtitle.values)}
+
+
+
+ ) : null}
+
+
+
+
+
+ {t("alert.title", { version: security.fixedVersion ?? "" })}
+
+
+ {t("alert.desc", { version })}
+
+
+
+ {t("alert.review")}
+
+
+
+
+
+
+
+ {fixed
+ ? t("panel.desc", { fixed, version })
+ : t("panel.desc_no_fix", { version })}
+
+
+
+
+
+ {securityUpdate.id}
+
+
+
+
+
+ {version}
+
+ {fixed ? (
+ <>
+ {fixed}
+
+ ) : null}
+ {latest?.publishedAt ? (
+
+ {t.rich("panel.released", {
+ date: () =>
+ ) : null}
+
+
+ {latest?.url ? (
+
+ ) : null}
+
+
+ );
+};
diff --git a/packages/vitnode/src/views/admin/views/core/debug/sections/systems.tsx b/packages/vitnode/src/views/admin/views/core/debug/sections/systems.tsx
new file mode 100644
index 0000000000..ab77b169dd
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/debug/sections/systems.tsx
@@ -0,0 +1,290 @@
+import { cn } from "cn";
+import { ExternalLinkIcon } from "lucide-react";
+import { useTranslations } from "use-intl";
+
+import type { AdminIntegrations } from "@/views/admin/views/core/system/integrations/integrations-query";
+import type { AdminPluginUpdates } from "@/views/admin/views/core/system/plugins/plugin-updates-query";
+import type { AdminInstalledPlugins } from "@/views/admin/views/core/system/plugins/plugins-query";
+
+import { DateFormat } from "@/components/date-format";
+import { AdminStaffPermissionGate } from "@/components/staff-permission/provider";
+import { buttonVariants } from "@/components/ui/button";
+import {
+ Frame,
+ FrameAction,
+ FrameDescription,
+ FrameHeader,
+ FramePanel,
+ FrameTitle,
+} from "@/components/ui/frame";
+import { DOCS_URLS } from "@/lib/docs-links";
+import { ADMIN_DEBUG_PERMISSIONS } from "@/views/admin/views/core/shared/admin-permissions";
+import { SendTestEmailAction } from "@/views/admin/views/core/system/integrations/send-test-email/send-test-email";
+import { sendTestEmailInBrowser } from "@/views/admin/views/core/system/integrations/send-test-email/send-test-email-mutation";
+import { TestAIAction } from "@/views/admin/views/core/system/integrations/test-ai/test-ai";
+import { TestStorageAction } from "@/views/admin/views/core/system/integrations/test-storage/test-storage";
+import { CheckUpdatesButton } from "@/views/admin/views/core/system/plugins/check-updates-button";
+import { checkPluginUpdates } from "@/views/admin/views/core/system/plugins/plugin-updates-query";
+
+import type { DebugArea, DebugService } from "../health/health";
+
+import { ClearCacheAction } from "../actions/clear-cache/clear-cache";
+import {
+ DEBUG_SERVICES,
+ isServiceActive,
+ pluginProblem,
+} from "../health/health";
+import { TONE_TEXT, ToneBadge, ToneIcon } from "../tone";
+import { CheckRow, FactRow, FRAME_ACTION_STACKED, FrameRow } from "./frame-row";
+import { SecurityUpdatePanel } from "./security";
+
+const SystemHeader = ({
+ action,
+ area,
+}: {
+ action?: React.ReactNode;
+ area: DebugArea;
+}) => {
+ const t = useTranslations("admin.debug");
+ const tHealth = useTranslations("admin.debug.health");
+
+ return (
+
+
+ {t(`nav.${area.id}`)}
+ {area.tone === "off" ? null :
+
+ {tHealth(area.subtitle.key, area.subtitle.values)}
+
+ {action ? (
+ {action}
+ ) : null}
+
+ );
+};
+
+export const VitnodeSection = ({
+ area,
+ installed,
+ updates,
+}: {
+ area: DebugArea;
+ installed: AdminInstalledPlugins;
+ updates: AdminPluginUpdates | undefined;
+}) => {
+ const t = useTranslations("admin.debug.sections.vitnode");
+ const core = updates?.core;
+ const lastChecked = core?.lastSuccessAt ?? core?.lastAttemptAt;
+
+ return (
+
+
+ {area.checks
+ .filter(check => check.id !== "vitnode-security-update")
+ .map(check => (
+
+
+
+ );
+};
+
+export const PluginsSection = ({
+ area,
+ installed,
+ updates,
+}: {
+ area: DebugArea;
+ installed: AdminInstalledPlugins;
+ updates: AdminPluginUpdates | undefined;
+}) => {
+ const tHealth = useTranslations("admin.debug.health");
+
+ return (
+
+ {installed.plugins.map(plugin => {
+ const problem = pluginProblem(
+ plugin,
+ updates?.plugins.find(update => update.id === plugin.id),
+ );
+
+ return (
+
+
+ {plugin.title}
+
+ {plugin.id}
+
+
+ {problem ? (
+
+
+ ) : null}
+
+ {plugin.version ?? "—"}
+
+
+ );
+ })}
+
+
+ );
+};
+
+export const CacheSection = ({
+ area,
+ integrations,
+ onClearCache,
+}: {
+ area: DebugArea;
+ integrations: AdminIntegrations;
+ onClearCache: () => Promise;
+}) => {
+ const t = useTranslations("admin.debug.sections.cache");
+
+ return (
+
+
+ {area.checks.map(check => (
+
+
+ );
+};
+
+const SERVICE_DOCS: Record = {
+ ai: DOCS_URLS.ai,
+ captcha: DOCS_URLS.captcha,
+ email: DOCS_URLS.email,
+ storage: DOCS_URLS.storage,
+ websocket: DOCS_URLS.websocket,
+};
+
+const ServiceTest = ({
+ integrations,
+ service,
+}: {
+ integrations: AdminIntegrations;
+ service: DebugService;
+}) => {
+ if (service === "email") {
+ return (
+
+
+ );
+ }
+ if (service === "storage") {
+ return (
+
+
+ );
+ }
+ if (service === "ai") {
+ return (
+
+
+ );
+ }
+
+ return null;
+};
+
+export const ServicesSection = ({
+ area,
+ integrations,
+}: {
+ area: DebugArea;
+ integrations: AdminIntegrations;
+}) => {
+ const t = useTranslations("admin.debug.sections.services");
+ const tHealth = useTranslations("admin.debug.health");
+
+ return (
+
+ {DEBUG_SERVICES.map(service => {
+ const active = isServiceActive(integrations, service);
+
+ return (
+
+
+
+ {tHealth(`services.${service}`)}
+
+
+ {active ? t("active") : t("not_configured")}
+
+
+ {active ? (
+
+ {t("set_up")}
+
+ )}
+
+ );
+ })}
+
+
+ );
+};
diff --git a/packages/vitnode/src/views/admin/views/core/debug/system-logs/system-logs-content.tsx b/packages/vitnode/src/views/admin/views/core/debug/system-logs/system-logs-content.tsx
index 4180d553da..ad3b160d49 100644
--- a/packages/vitnode/src/views/admin/views/core/debug/system-logs/system-logs-content.tsx
+++ b/packages/vitnode/src/views/admin/views/core/debug/system-logs/system-logs-content.tsx
@@ -6,7 +6,6 @@ import { ContentDataTable } from "@/components/table/content";
import type { DebugLogRow, DebugLogsPage } from "../debug-query";
import { MoreActionSystemLogs } from "./actions/more/more";
-import { BadgeStatus } from "./badges/badge-status";
import { BadgeTypeLog } from "./badges/badge-type-log";
/** How much of a log line is shown before it is cut. */
@@ -28,12 +27,6 @@ export const SystemLogsContent = ({ data }: { data: DebugLogsPage }) => {
header: t("type"),
cell: ({ row }) => = {
+ critical: FEEDBACK_TONE_TEXT.destructive,
+ off: "text-muted-foreground",
+ ok: FEEDBACK_TONE_TEXT.success,
+ warn: FEEDBACK_TONE_TEXT.warning,
+};
+
+export const TONE_SURFACE: Record = {
+ critical: "bg-destructive/10 dark:bg-destructive/20",
+ off: "bg-muted",
+ ok: "bg-success/10 dark:bg-success/20",
+ warn: "bg-warn/10 dark:bg-warn/20",
+};
+
+const TONE_DOT: Record = {
+ critical: "bg-destructive",
+ off: "bg-muted-foreground/40",
+ ok: "bg-success",
+ warn: "bg-warn",
+};
+
+const TONE_ICON = {
+ critical: OctagonAlertIcon,
+ off: CircleMinusIcon,
+ ok: CircleCheckIcon,
+ warn: TriangleAlertIcon,
+} as const;
+
+const TONE_BADGE = {
+ critical: "destructive",
+ off: "secondary",
+ ok: "success",
+ warn: "warning",
+} as const;
+
+export const ToneIcon = ({
+ className,
+ tone,
+}: {
+ className?: string;
+ tone: DebugTone;
+}) => {
+ const t = useTranslations("admin.debug.tone");
+ const Icon = TONE_ICON[tone];
+
+ return (
+ {t(tone)} ;
+};
diff --git a/packages/vitnode/src/views/admin/views/core/shared/admin-permissions.ts b/packages/vitnode/src/views/admin/views/core/shared/admin-permissions.ts
index 41206a0f18..abd7a97a05 100644
--- a/packages/vitnode/src/views/admin/views/core/shared/admin-permissions.ts
+++ b/packages/vitnode/src/views/admin/views/core/shared/admin-permissions.ts
@@ -19,6 +19,19 @@ export const ADMIN_USER_PERMISSIONS = {
view: core("users", "can_view"),
} as const;
+export const ADMIN_DEBUG_PERMISSIONS = {
+ ai: core("ai", "can_view"),
+ clearCache: core("debug", "can_clear_cache"),
+ cron: core("cron", "can_view"),
+ plugins: core("plugins", "can_view"),
+ queue: core("queue", "can_view"),
+ system: core("system", "can_view"),
+ testAi: core("system", "can_test_ai"),
+ testEmail: core("system", "can_send_test_email"),
+ testStorage: core("system", "can_test_storage"),
+ view: core("debug", "can_view"),
+} as const;
+
export const ADMIN_SEARCH_PERMISSIONS = {
manage: core("system", "can_manage_search"),
} as const;
diff --git a/packages/vitnode/src/views/admin/views/core/system/plugins/check-updates-button.tsx b/packages/vitnode/src/views/admin/views/core/system/plugins/check-updates-button.tsx
new file mode 100644
index 0000000000..4896d6d410
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/system/plugins/check-updates-button.tsx
@@ -0,0 +1,83 @@
+import { useQueryClient } from "@tanstack/react-query";
+import { RefreshCwIcon } from "lucide-react";
+import { useActionState } from "react";
+import { toast } from "sonner";
+import { useTranslations } from "use-intl";
+
+import { useAdminStaffPermission } from "@/components/staff-permission/provider";
+import { Button } from "@/components/ui/button";
+import { manifest } from "@/manifest";
+
+import type { CheckPluginUpdates } from "./plugin-updates-query";
+
+import { pluginUpdatesQueryKey } from "./plugin-updates-query";
+
+export const CheckUpdatesButton = ({
+ onCheck,
+}: {
+ onCheck: CheckPluginUpdates;
+}) => {
+ const t = useTranslations("admin.system.plugins.updates.check");
+ const queryClient = useQueryClient();
+ const canCheck = useAdminStaffPermission({
+ plugin: manifest.id,
+ module: "plugins",
+ permission: "can_check_updates",
+ });
+ const [, formAction, isPending] = useActionState(async () => {
+ const result = await onCheck();
+
+ switch (result.status) {
+ case "completed":
+ await queryClient.invalidateQueries({
+ queryKey: pluginUpdatesQueryKey,
+ });
+ if (result.failedSources > 0) {
+ toast.warning(t("partial.title"), {
+ description: t("partial.desc", { count: result.failedSources }),
+ });
+ } else {
+ toast.success(t("success.title"), {
+ description: t("success.desc", {
+ securityUpdates: result.securityUpdates,
+ updates: result.updates,
+ }),
+ });
+ }
+
+ return;
+ case "cooldown":
+ toast.info(t("cooldown.title"), {
+ description: t("cooldown.desc", {
+ seconds: result.retryAfterSeconds ?? 60,
+ }),
+ });
+
+ return;
+ case "disabled":
+ toast.error(t("disabled.title"), { description: t("disabled.desc") });
+
+ return;
+ case "running":
+ await queryClient.invalidateQueries({
+ queryKey: pluginUpdatesQueryKey,
+ });
+ toast.info(t("running.title"), { description: t("running.desc") });
+
+ return;
+ case "error":
+ toast.error(t("error.title"), { description: t("error.desc") });
+ }
+ }, null);
+
+ if (!canCheck) return null;
+
+ return (
+
+ );
+};
diff --git a/packages/vitnode/src/views/admin/views/core/system/plugins/core-update-card.tsx b/packages/vitnode/src/views/admin/views/core/system/plugins/core-update-card.tsx
new file mode 100644
index 0000000000..36519f5c8f
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/system/plugins/core-update-card.tsx
@@ -0,0 +1,119 @@
+import { PackageIcon } from "lucide-react";
+import { useTranslations } from "use-intl";
+
+import { DateFormat } from "@/components/date-format";
+
+import type { AdminPluginUpdates } from "./plugin-updates-query";
+
+import { PluginUpdateStatus, SecurityUpdates } from "./plugin-update-status";
+
+const lastCheckedOf = (updates: AdminPluginUpdates): null | string =>
+ [updates.core, ...updates.plugins]
+ .map(component => component.lastSuccessAt)
+ .reduce(
+ (latest, value) =>
+ value !== null && (latest === null || value > latest) ? value : latest,
+ null,
+ );
+
+const CheckSummary = ({
+ lastChecked,
+ updates,
+}: {
+ lastChecked: null | string;
+ updates: AdminPluginUpdates;
+}) => {
+ const t = useTranslations("admin.system.plugins.updates");
+
+ if (!updates.enabled) return <>{t("summary.disabled")};
+ if (lastChecked === null) return null;
+
+ return (
+ <>
+ {t.rich("summary.last_checked", {
+ date: () =>
+ {hasSummary ? (
+
+
+ ) : null}
+ {updates.channelOverride === null ? null : (
+
+ {t("updates.summary.channel", {
+ channel: t(`updates.channel.${updates.channelOverride}`),
+ })}
+
+ )}
+
+
+
+
+
+
+ {t("core.title")}
+
+
+ {t.rich("core.version", {
+ version,
+ mono: chunks => (
+ {chunks}
+ ),
+ })}
+
+
+
+
+ );
+};
diff --git a/packages/vitnode/src/views/admin/views/core/system/plugins/plugin-update-status.test.tsx b/packages/vitnode/src/views/admin/views/core/system/plugins/plugin-update-status.test.tsx
new file mode 100644
index 0000000000..fcd569c18f
--- /dev/null
+++ b/packages/vitnode/src/views/admin/views/core/system/plugins/plugin-update-status.test.tsx
@@ -0,0 +1,198 @@
+import { render, screen, within } from "@testing-library/react";
+import { IntlProvider } from "use-intl";
+import { describe, expect, it } from "vitest";
+
+import type { AdminComponentUpdate } from "./plugin-updates-query";
+
+import { PluginUpdateStatus, SecurityUpdates } from "./plugin-update-status";
+
+const T = "admin.system.plugins.updates";
+
+const SECURITY_UPDATE = {
+ affected: "<1.1.0",
+ fixed: "1.1.0",
+ id: "ACME-1",
+ url: "https://acme.example.com/advisories/1",
+ versions: ["1.0.0"],
+};
+
+const update = (
+ overrides: Partial = {},
+ result: Partial> = {},
+): AdminComponentUpdate => ({
+ id: "@acme/blog",
+ lastAttemptAt: "2026-10-15T03:00:00.000Z",
+ lastError: null,
+ lastSuccessAt: "2026-10-15T03:00:00.000Z",
+ result: {
+ securityUpdates: [],
+ alternative: null,
+ channel: "stable",
+ compatibility: "compatible",
+ latest: {
+ publishedAt: null,
+ requiresCore: "^2.0.0",
+ url: "https://acme.example.com/releases/1.1.0",
+ version: "1.1.0",
+ },
+ status: "update_available",
+ ...result,
+ },
+ sourceUrl: "https://acme.example.com/updates.json",
+ stale: false,
+ state: "checked",
+ ...overrides,
+});
+
+const renderWithIntl = (node: React.ReactNode) =>
+ render(
+
+ {node}
+ ,
+ );
+
+const renderStatus = (value: AdminComponentUpdate, enabled = true) =>
+ renderWithIntl(
+
+ {children}
+
+ );
+};
+
+/** Which registration runs each version, for "1.0.0 (web app)". */
+export type VersionSides = Record;
+
+export const SecurityUpdates = ({
+ sides,
+ update,
+}: {
+ sides?: VersionSides;
+ update: AdminComponentUpdate | undefined;
+}) => {
+ const t = useTranslations("admin.system.plugins");
+ const securityUpdates = update?.result?.securityUpdates ?? [];
+ if (securityUpdates.length === 0) return null;
+
+ const describeVersions = (versions: readonly string[]): string =>
+ versions
+ .map(version => {
+ const labels = sides?.[version];
+ const [side] = labels ?? [];
+ if (labels?.length !== 1 || side === undefined) return version;
+
+ return t("updates.version_on_side", {
+ side: t(`updates.side.${side}`),
+ version,
+ });
+ })
+ .join(", ");
+
+ return (
+
+ {securityUpdates.map(securityUpdate => (
+
+
+
+ {t("updates.security.title", { id: securityUpdate.id })}
+
+
+ {t("updates.security.affects", {
+ range: securityUpdate.affected,
+ versions: describeVersions(securityUpdate.versions),
+ })}{" "}
+ {securityUpdate.fixed === null
+ ? t("updates.security.no_fix")
+ : t("updates.security.fixed", {
+ version: securityUpdate.fixed,
+ })}
+
+
+ {t("updates.security.details")}
+
+
+ ))}
+
+ );
+};
+
+const LINE_TONE = {
+ muted: "text-muted-foreground",
+ primary: "text-foreground",
+ success: "text-success",
+ warn: "text-warn",
+} as const;
+
+const Line = ({
+ children,
+ icon: Icon,
+ tone = "muted",
+}: {
+ children: React.ReactNode;
+ icon: React.ComponentType<{ "aria-hidden"?: boolean; className?: string }>;
+ tone?: keyof typeof LINE_TONE;
+}) => (
+
+ {children}
+
+);
+
+const CHECK_ERRORS = [
+ "blocked_address",
+ "http_error",
+ "invalid_json",
+ "invalid_manifest",
+ "invalid_url",
+ "network",
+ "timeout",
+ "too_large",
+ "too_many_redirects",
+ "unsupported_schema",
+] as const;
+
+const errorCode = (
+ error: NonNullable,
+): (typeof CHECK_ERRORS)[number] =>
+ CHECK_ERRORS.find(entry => entry === error.code) ?? "network";
+
+const ResultLines = ({
+ coreVersion,
+ update,
+}: {
+ coreVersion: string;
+ update: AdminComponentUpdate;
+}) => {
+ const t = useTranslations("admin.system.plugins");
+ const result = update.result;
+ if (result === null) return null;
+
+ switch (result.status) {
+ case "channel_missing":
+ return (
+
+ {t("updates.status.channel_missing", {
+ channel: t(`updates.channel.${result.channel ?? "stable"}`),
+ })}
+
+ );
+ case "package_missing":
+ return (
+ {t("updates.status.package_missing")}
+ );
+ case "unknown_channel":
+ return (
+
+ {t("updates.status.unknown_channel")}
+
+ );
+ case "up_to_date":
+ return (
+
+ {t("updates.status.up_to_date")}
+
+ );
+ case "update_available": {
+ const latest = result.latest;
+ if (latest === null) return null;
+
+ return (
+ <>
+
+
+ {t("updates.status.update_available", {
+ version: latest.version,
+ })}
+
+ {latest.publishedAt === null ? null : (
+
+ {" "}
+ {t.rich("updates.released", {
+ date: () => (
+
+ )}{" "}
+
+ {t("updates.release_notes")}
+
+
+ {result.compatibility === "incompatible" ? (
+
+ {t("updates.compatibility.incompatible", {
+ core: coreVersion,
+ range: latest.requiresCore ?? "",
+ })}
+
+ ) : null}
+ {result.compatibility === "unknown" ? (
+
+ {t("updates.compatibility.unknown")}
+
+ ) : null}
+ {result.compatibility === "compatible" ? (
+
+ {t("updates.compatibility.compatible", {
+ range: latest.requiresCore ?? "",
+ })}
+
+ ) : null}
+ {result.alternative === null ? null : (
+
+ {t("updates.compatibility.alternative", {
+ version: result.alternative.version,
+ })}{" "}
+
+ {t("updates.release_notes")}
+
+
+ )}
+
+ );
+ }
+ case "version_unknown":
+ return (
+
+ {t("updates.status.version_unknown")}
+
+ );
+ }
+};
+
+/**
+ * Update availability, compatibility and check health - each its own line.
+ * Security findings are rendered apart, by `SecurityUpdates`, and never
+ * folded into "update available".
+ */
+export const PluginUpdateStatus = ({
+ coreVersion,
+ enabled,
+ showCheckedAt = true,
+ update,
+}: {
+ coreVersion: string;
+ enabled: boolean;
+ /** Off where the same date is already shown nearby. */
+ showCheckedAt?: boolean;
+ update: AdminComponentUpdate | undefined;
+}) => {
+ const t = useTranslations("admin.system.plugins");
+
+ if (update === undefined) return null;
+ if (!enabled) {
+ return {t("updates.status.disabled")} ;
+ }
+ if (update.state === "unavailable") {
+ return {t("updates.status.unavailable")} ;
+ }
+
+ const lastError = update.lastError;
+ const reason =
+ lastError === null
+ ? ""
+ : t(`updates.error.${errorCode(lastError)}`, {
+ detail: lastError.detail ?? "",
+ });
+
+ return (
+
+ {update.state === "not_checked" && lastError === null ? (
+
{t("updates.status.not_checked")}
+ ) : null}
+
+
+
+ {update.stale && update.lastSuccessAt !== null ? (
+
+ {t.rich("updates.stale", {
+ date: () => (
+
+ ) : null}
+
+ {lastError === null ? null : (
+
+ {update.state === "checked" && update.lastSuccessAt !== null
+ ? t.rich("updates.failed_with_previous", {
+ date: () => (
+
+ )}
+
+ {showCheckedAt &&
+ update.state === "checked" &&
+ !update.stale &&
+ lastError === null &&
+ update.lastSuccessAt !== null ? (
+
+ {t.rich("updates.checked_at", {
+ date: () =>
+ ) : null}
+
;
+export type AdminComponentUpdate = z.infer;
+
+export type PluginUpdatesFetcher = () => Promise;
+
+export const fetchPluginUpdates: PluginUpdatesFetcher = async () => {
+ const response = await fetcher({
+ plugin: manifest.id,
+ method: "get",
+ module: "admin/plugins",
+ path: "/updates",
+ });
+
+ if (!response.ok) {
+ throw new AdminRequestError(response.status, "the plugin update status");
+ }
+
+ return await response.json();
+};
+
+export const pluginUpdatesQueryKey = [
+ ...installedPluginsQueryKey,
+ "updates",
+] as const;
+
+export const pluginUpdatesQueryOptions = () =>
+ queryOptions({
+ queryFn: async () => await fetchPluginUpdates(),
+ queryKey: pluginUpdatesQueryKey,
+ retry: false,
+ staleTime: 60_000,
+ });
+
+export type CheckPluginUpdatesResult =
+ | {
+ failedSources: number;
+ securityUpdates: number;
+ status: "completed";
+ updates: number;
+ }
+ | {
+ retryAfterSeconds: null | number;
+ status: "cooldown" | "disabled" | "running";
+ }
+ | { status: "error" };
+
+export type CheckPluginUpdates = () => Promise;
+
+export const checkPluginUpdates: CheckPluginUpdates = async () => {
+ try {
+ const response = await fetcher({
+ plugin: manifest.id,
+ method: "post",
+ module: "admin/plugins",
+ path: "/updates/check",
+ });
+
+ if (
+ response.status === 200 ||
+ response.status === 409 ||
+ response.status === 429
+ ) {
+ return await response.json();
+ }
+
+ return { status: "error" };
+ } catch {
+ return { status: "error" };
+ }
+};
diff --git a/packages/vitnode/src/views/admin/views/core/system/plugins/plugins-content.tsx b/packages/vitnode/src/views/admin/views/core/system/plugins/plugins-content.tsx
index 077c1502aa..50506b201c 100644
--- a/packages/vitnode/src/views/admin/views/core/system/plugins/plugins-content.tsx
+++ b/packages/vitnode/src/views/admin/views/core/system/plugins/plugins-content.tsx
@@ -14,6 +14,11 @@ import {
} from "@/components/table/url-state";
import { Button } from "@/components/ui/button";
+import type { VersionSides } from "./plugin-update-status";
+import type {
+ AdminComponentUpdate,
+ AdminPluginUpdates,
+} from "./plugin-updates-query";
import type {
AdminInstalledPlugin,
AdminInstalledPlugins,
@@ -21,11 +26,28 @@ import type {
import { PluginIcon } from "./plugin-icon";
import { matchesPluginSearch } from "./plugin-search";
+import { PluginUpdateStatus, SecurityUpdates } from "./plugin-update-status";
export interface PluginsContentProps {
data: AdminInstalledPlugins;
+ /** Stored update results. Left out, the catalog lists versions only. */
+ updates?: AdminPluginUpdates;
}
+/** Only worth naming the side when the API and the web app run different versions. */
+const versionSidesOf = (plugin: AdminInstalledPlugin): VersionSides => {
+ if (!plugin.versionMismatch) return {};
+
+ const sides: VersionSides = {};
+ const { api, frontend } = plugin.registrations;
+ if (api?.version) sides[api.version] = [...(sides[api.version] ?? []), "api"];
+ if (frontend?.version) {
+ sides[frontend.version] = [...(sides[frontend.version] ?? []), "frontend"];
+ }
+
+ return sides;
+};
+
const PluginVersion = ({ version }: { version: null | string }) => {
const t = useTranslations("admin.system.plugins");
@@ -40,7 +62,17 @@ const PluginVersion = ({ version }: { version: null | string }) => {
return {version} ;
};
-const PluginCell = ({ plugin }: { plugin: AdminInstalledPlugin }) => {
+const PluginCell = ({
+ coreVersion,
+ enabled,
+ plugin,
+ update,
+}: {
+ coreVersion: string;
+ enabled: boolean;
+ plugin: AdminInstalledPlugin;
+ update: AdminComponentUpdate | undefined;
+}) => {
const t = useTranslations("admin.system.plugins");
const { api, frontend } = plugin.registrations;
@@ -69,12 +101,21 @@ const PluginCell = ({ plugin }: { plugin: AdminInstalledPlugin }) => {
{t("mismatch", { api: api.version, frontend: frontend.version })}
) : null}
+
@@ -109,12 +153,31 @@ export const PluginsContent = ({ data }: PluginsContentProps) => {
id: "plugin",
header: t("list.plugin"),
className: "w-full whitespace-normal",
- cell: ({ row }) =>
+
+
);
};
diff --git a/packages/vitnode/src/views/moderation/modcp/modcp-nav.tsx b/packages/vitnode/src/views/moderation/modcp/modcp-nav.tsx
index fc9abbae15..a715b6897f 100644
--- a/packages/vitnode/src/views/moderation/modcp/modcp-nav.tsx
+++ b/packages/vitnode/src/views/moderation/modcp/modcp-nav.tsx
@@ -4,7 +4,7 @@ import { cn } from "cn";
import { ClipboardCheckIcon, FlagIcon } from "lucide-react";
import { useTranslations } from "use-intl";
-import { SideNavCard, SideNavLink, SideNavList } from "@/components/side-nav";
+import { SideNav, SideNavLink, SideNavList } from "@/components/side-nav";
import {
modcpApprovalsQueryOptions,
@@ -106,7 +106,7 @@ export const ModcpNavContent = ({ pathname }: { pathname: string }) => {
-
+
{MODCP_NAV_ITEMS.map(item => (
{
/>
))}
-
+
);
};
diff --git a/packages/vitnode/src/vitnode.config.ts b/packages/vitnode/src/vitnode.config.ts
index ac38276b8b..a8054ecfb1 100644
--- a/packages/vitnode/src/vitnode.config.ts
+++ b/packages/vitnode/src/vitnode.config.ts
@@ -26,6 +26,7 @@ import type {
import type { VitNodeMetadata } from "./lib/metadata";
import type { BuildPluginReturn } from "./lib/plugin";
import type { FrontendPluginInventory } from "./lib/plugin-manifest";
+import type { UpdateChannel } from "./lib/updates/manifest";
import type { PersonalInformationFieldsConfig } from "./lib/user-personal-information";
import type { PageCacheConfig } from "./page-cache/config";
@@ -158,6 +159,21 @@ export interface VitNodeApiConfig {
webp?: boolean;
};
};
+ /**
+ * Update and security-update checks for core and plugins, shown in
+ * AdminCP → System → Plugins. They read public JSON manifests once a day and
+ * never install anything.
+ */
+ updates?: {
+ /**
+ * The release channel to compare against. Defaults to the channel of the
+ * installed version: `2.1.0` follows stable, `-rc.N` rc, `-canary.N`
+ * canary. Setting it is how an installation moves channels on purpose.
+ */
+ channel?: UpdateChannel;
+ /** `false` turns checking off - for an install without outbound network access. Defaults to `true`. */
+ enabled?: boolean;
+ };
users?: {
/**
* Which personal-information fields this install offers. Every field is on
diff --git a/plugins/blog/src/manifest.gen.ts b/plugins/blog/src/manifest.gen.ts
index f4b123381d..ce45426a01 100644
--- a/plugins/blog/src/manifest.gen.ts
+++ b/plugins/blog/src/manifest.gen.ts
@@ -3,9 +3,10 @@
// This file is generated by VitNode. Do not edit it, and do not format it.
//
// It is rewritten by `vitnode build` and `vitnode dev` from this package's
-// package.json - `name`, `version`, `description`, `author` and `license` - and the title and
-// icon in `src/plugin-info.ts`. Pass `manifest` to `buildPlugin`,
-// `buildApiPlugin` and `bindApiPlugin` - it is where the plugin id lives.
+// package.json - `name`, `version`, `description`, `author` and `license` -
+// and the title, icon and update source in `src/plugin-info.ts`. Pass
+// `manifest` to `buildPlugin`, `buildApiPlugin` and `bindApiPlugin` - it is
+// where the plugin id lives.
import { pluginInfo } from "./plugin-info"
@@ -21,4 +22,5 @@ export const manifest = {
},
license: "MIT",
version: "2.0.0-canary.13",
+ updates: pluginInfo.updates ?? null,
} as const
diff --git a/plugins/blog/src/plugin-info.ts b/plugins/blog/src/plugin-info.ts
index 293aaa6fb3..0116c1e1eb 100644
--- a/plugins/blog/src/plugin-info.ts
+++ b/plugins/blog/src/plugin-info.ts
@@ -3,4 +3,7 @@ import type { PluginInfo } from "@vitnode/core/lib/plugin-manifest";
export const pluginInfo: PluginInfo = {
title: "Blog",
icon: "newspaper",
+ updates: {
+ url: "https://raw.githubusercontent.com/aXenDeveloper/vitnode/update-manifest/updates.json",
+ },
};
diff --git a/plugins/example/src/manifest.gen.ts b/plugins/example/src/manifest.gen.ts
index cff9eb31d5..9c388e423e 100644
--- a/plugins/example/src/manifest.gen.ts
+++ b/plugins/example/src/manifest.gen.ts
@@ -3,9 +3,10 @@
// This file is generated by VitNode. Do not edit it, and do not format it.
//
// It is rewritten by `vitnode build` and `vitnode dev` from this package's
-// package.json - `name`, `version`, `description`, `author` and `license` - and the title and
-// icon in `src/plugin-info.ts`. Pass `manifest` to `buildPlugin`,
-// `buildApiPlugin` and `bindApiPlugin` - it is where the plugin id lives.
+// package.json - `name`, `version`, `description`, `author` and `license` -
+// and the title, icon and update source in `src/plugin-info.ts`. Pass
+// `manifest` to `buildPlugin`, `buildApiPlugin` and `bindApiPlugin` - it is
+// where the plugin id lives.
import { pluginInfo } from "./plugin-info"
@@ -21,4 +22,5 @@ export const manifest = {
},
license: "MIT",
version: "2.0.0-canary.13",
+ updates: pluginInfo.updates ?? null,
} as const
diff --git a/plugins/forum/src/manifest.gen.ts b/plugins/forum/src/manifest.gen.ts
index 7c648daf61..b99de8a6b9 100644
--- a/plugins/forum/src/manifest.gen.ts
+++ b/plugins/forum/src/manifest.gen.ts
@@ -3,9 +3,10 @@
// This file is generated by VitNode. Do not edit it, and do not format it.
//
// It is rewritten by `vitnode build` and `vitnode dev` from this package's
-// package.json - `name`, `version`, `description`, `author` and `license` - and the title and
-// icon in `src/plugin-info.ts`. Pass `manifest` to `buildPlugin`,
-// `buildApiPlugin` and `bindApiPlugin` - it is where the plugin id lives.
+// package.json - `name`, `version`, `description`, `author` and `license` -
+// and the title, icon and update source in `src/plugin-info.ts`. Pass
+// `manifest` to `buildPlugin`, `buildApiPlugin` and `bindApiPlugin` - it is
+// where the plugin id lives.
import { pluginInfo } from "./plugin-info"
@@ -21,4 +22,5 @@ export const manifest = {
},
license: "MIT",
version: "2.0.0-canary.13",
+ updates: pluginInfo.updates ?? null,
} as const
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 45b178f23b..fb06dc9161 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -687,6 +687,9 @@ importers:
sanitize-html:
specifier: ^2.18.0
version: 2.18.0
+ semver:
+ specifier: ^7.8.5
+ version: 7.8.5
shadcn:
specifier: ^4.21.4
version: 4.21.4
@@ -748,6 +751,9 @@ importers:
'@types/sanitize-html':
specifier: ^2.16.2
version: 2.16.2
+ '@types/semver':
+ specifier: ^7.8.0
+ version: 7.8.0
'@vitejs/plugin-react':
specifier: ^6.1.2
version: 6.1.2(babel-plugin-react-compiler@1.0.0)(vite@8.3.4(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
@@ -4938,6 +4944,9 @@ packages:
'@types/sanitize-html@2.16.2':
resolution: {integrity: sha512-kuAbgDCFv418flrp3z4o/4ufLA/5ovmXRH0L419iZCPGO7w00znjeDI5Wy/KZWNIBpDQc7hucCK+J5almB6FyA==}
+ '@types/semver@7.8.0':
+ resolution: {integrity: sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==}
+
'@types/unist@2.0.11':
resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==}
@@ -12860,6 +12869,8 @@ snapshots:
dependencies:
htmlparser2: 12.0.0
+ '@types/semver@7.8.0': {}
+
'@types/unist@2.0.11': {}
'@types/unist@3.0.3': {}
diff --git a/scripts/bump-version/version-manager.ts b/scripts/bump-version/version-manager.ts
index 95a7984db2..d709634c76 100644
--- a/scripts/bump-version/version-manager.ts
+++ b/scripts/bump-version/version-manager.ts
@@ -26,6 +26,11 @@ export class VersionManager {
async init(): Promise {
if (this.env.GITHUB_OPTION_MODE === "publish") {
console.log("Skipping version bump in publish mode");
+ // The release steps and the update manifest still need the tag of what
+ // is about to be published.
+ this.exposeNewVersion(
+ `${CONFIG.TAG_PREFIX}${this.getCurrentVersion()}${CONFIG.TAG_SUFFIX}`,
+ );
return;
}
diff --git a/scripts/update-manifest/publish-update-manifest.ts b/scripts/update-manifest/publish-update-manifest.ts
new file mode 100644
index 0000000000..ff4cd95f92
--- /dev/null
+++ b/scripts/update-manifest/publish-update-manifest.ts
@@ -0,0 +1,353 @@
+import { execFileSync } from "node:child_process";
+import {
+ existsSync,
+ mkdtempSync,
+ readdirSync,
+ readFileSync,
+ rmSync,
+ writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+import type { UpdateManifest } from "../../packages/vitnode/src/lib/updates/manifest.ts";
+import type {
+ GitHubReleaseMetadata,
+ PublishedPackage,
+} from "../../packages/vitnode/scripts/update-manifest/merge.ts";
+
+import {
+ applySecurityUpdates,
+ channelForReleaseType,
+ mergeRelease,
+ parseSecurityUpdatesInput,
+ readPublishedManifest,
+ requiresCoreFrom,
+ serializeUpdateManifest,
+} from "../../packages/vitnode/scripts/update-manifest/merge.ts";
+
+/**
+ * Publishes VitNode's official update manifest to the `update-manifest` branch,
+ * served at https://raw.githubusercontent.com//update-manifest/updates.json.
+ *
+ * release after a successful npm publish: adds the published versions
+ * security-updates replaces the security updates with `security/security-updates.json`
+ * check validates `security/security-updates.json` and exits
+ *
+ * Every write fetches the branch, merges, and pushes; a push that loses a race
+ * is retried from a fresh fetch, so concurrent runs cannot overwrite each other.
+ */
+
+const BRANCH = process.env.UPDATE_MANIFEST_BRANCH ?? "update-manifest";
+const FILE = "updates.json";
+const SECURITY_UPDATES_FILE = join("security", "security-updates.json");
+const MAX_PUSH_ATTEMPTS = 5;
+const CORE_ID = "@vitnode/core";
+
+const workspace = process.env.GITHUB_WORKSPACE ?? process.cwd();
+
+const requireEnv = (name: string): string => {
+ const value = process.env[name];
+ if (!value) throw new Error(`Missing required environment variable: ${name}`);
+
+ return value;
+};
+
+const run = (
+ command: string,
+ args: string[],
+ options: { cwd?: string; allowFailure?: boolean } = {},
+): null | string => {
+ try {
+ return execFileSync(command, args, {
+ cwd: options.cwd,
+ encoding: "utf8",
+ stdio: ["ignore", "pipe", "pipe"],
+ });
+ } catch (error) {
+ if (options.allowFailure) return null;
+ // The remote URL carries the token; never echo the arguments.
+ const stderr =
+ typeof error === "object" && error !== null && "stderr" in error
+ ? String(error.stderr).replaceAll(/x-access-token:[^@]+@/g, "***@")
+ : "";
+ throw new Error(`\`${command} ${args[0] ?? ""}\` failed. ${stderr}`.trim());
+ }
+};
+
+interface WorkspacePackage {
+ dependencies: Record;
+ dir: string;
+ name: string;
+ version: null | string;
+}
+
+const MANIFEST_FILES = ["src/manifest.gen.ts", "src/manifest.ts"];
+
+const updatesUrlOf = async (dir: string): Promise => {
+ const file = MANIFEST_FILES.map(name => join(dir, name)).find(existsSync);
+ if (file === undefined) return null;
+
+ const { manifest } = (await import(pathToFileURL(file).href)) as {
+ manifest?: { updates?: null | { url?: string } };
+ };
+
+ return manifest?.updates?.url ?? null;
+};
+
+const readWorkspacePackages = (): Map => {
+ const packages = new Map();
+
+ for (const group of ["packages", "plugins", "apps"]) {
+ const root = join(workspace, group);
+ if (!existsSync(root)) continue;
+
+ for (const dir of readdirSync(root)) {
+ const file = join(root, dir, "package.json");
+ if (!existsSync(file)) continue;
+
+ const json = JSON.parse(readFileSync(file, "utf8")) as {
+ dependencies?: Record;
+ name?: string;
+ peerDependencies?: Record;
+ version?: string;
+ };
+ if (!json.name) continue;
+
+ packages.set(json.name, {
+ dependencies: { ...json.peerDependencies, ...json.dependencies },
+ dir: join(root, dir),
+ name: json.name,
+ version: json.version ?? null,
+ });
+ }
+ }
+
+ return packages;
+};
+
+const githubReleaseFor = (
+ repository: string,
+ tag: string,
+): GitHubReleaseMetadata | null => {
+ const output = run(
+ "gh",
+ [
+ "release",
+ "view",
+ tag,
+ "--repo",
+ repository,
+ "--json",
+ "publishedAt,url,isDraft",
+ ],
+ { allowFailure: true },
+ );
+ if (output === null) return null;
+
+ const release = JSON.parse(output) as {
+ isDraft?: boolean;
+ publishedAt?: null | string;
+ url?: string;
+ };
+ if (release.isDraft || !release.publishedAt || !release.url) return null;
+
+ return { publishedAt: release.publishedAt, url: release.url };
+};
+
+/**
+ * The packages this run published that point at this feed. A package that is
+ * published but declares another update source - or none - is not ours to
+ * advertise here.
+ */
+const publishedPackages = async (
+ feedUrl: string,
+): Promise => {
+ const names = requireEnv("PUBLISHED_PACKAGES").split(/\s+/).filter(Boolean);
+ const workspacePackages = readWorkspacePackages();
+ const coreVersion = workspacePackages.get(CORE_ID)?.version ?? null;
+
+ const packages: PublishedPackage[] = [];
+ for (const name of names) {
+ const pkg = workspacePackages.get(name);
+ if (!pkg) throw new Error(`${name} is not a package in this workspace.`);
+
+ const updatesUrl = await updatesUrlOf(pkg.dir);
+ if (updatesUrl?.toLowerCase() !== feedUrl.toLowerCase()) continue;
+ if (!pkg.version) throw new Error(`${name} has no version.`);
+
+ const requiresCore =
+ name === CORE_ID || coreVersion === null
+ ? undefined
+ : requiresCoreFrom(pkg.dependencies[CORE_ID], coreVersion);
+
+ packages.push({ id: name, requiresCore, version: pkg.version });
+ }
+
+ return packages;
+};
+
+const publishToBranch = ({
+ message,
+ repository,
+ token,
+ update,
+}: {
+ message: string;
+ repository: string;
+ token: string;
+ update: (manifest: UpdateManifest) => UpdateManifest;
+}): void => {
+ const remote =
+ process.env.UPDATE_MANIFEST_REMOTE ??
+ `https://x-access-token:${token}@github.com/${repository}.git`;
+
+ for (let attempt = 1; attempt <= MAX_PUSH_ATTEMPTS; attempt++) {
+ const dir = mkdtempSync(join(tmpdir(), "vitnode-update-manifest-"));
+ try {
+ run("git", ["init", "--quiet"], { cwd: dir });
+ run("git", ["remote", "add", "origin", remote], { cwd: dir });
+ run("git", ["config", "user.name", "github-actions[bot]"], { cwd: dir });
+ run(
+ "git",
+ [
+ "config",
+ "user.email",
+ "41898282+github-actions[bot]@users.noreply.github.com",
+ ],
+ { cwd: dir },
+ );
+
+ const fetched =
+ run("git", ["fetch", "--quiet", "--depth", "1", "origin", BRANCH], {
+ allowFailure: true,
+ cwd: dir,
+ }) !== null;
+ if (fetched) {
+ run("git", ["checkout", "--quiet", "-B", BRANCH, "FETCH_HEAD"], {
+ cwd: dir,
+ });
+ } else {
+ // First publication: a branch with nothing but the manifest on it.
+ run("git", ["checkout", "--quiet", "--orphan", BRANCH], { cwd: dir });
+ }
+
+ const path = join(dir, FILE);
+ const before = existsSync(path) ? readFileSync(path, "utf8") : null;
+ const after = serializeUpdateManifest(
+ update(readPublishedManifest(before)),
+ );
+
+ if (before === after) {
+ console.log("updates.json is already up to date - nothing to push.");
+
+ return;
+ }
+
+ writeFileSync(path, after);
+ run("git", ["add", FILE], { cwd: dir });
+ run("git", ["commit", "--quiet", "-m", message], { cwd: dir });
+
+ const pushed =
+ run("git", ["push", "--quiet", "origin", `HEAD:${BRANCH}`], {
+ allowFailure: true,
+ cwd: dir,
+ }) !== null;
+ if (pushed) {
+ console.log(`Published ${FILE} to ${BRANCH}.`);
+
+ return;
+ }
+
+ console.warn(
+ `Push attempt ${String(attempt)} was rejected - another run published first. Merging again.`,
+ );
+ } finally {
+ rmSync(dir, { force: true, recursive: true });
+ }
+ }
+
+ throw new Error(
+ `Could not publish ${FILE} after ${String(MAX_PUSH_ATTEMPTS)} attempts.`,
+ );
+};
+
+const readSecurityUpdates = () =>
+ parseSecurityUpdatesInput(
+ readFileSync(join(workspace, SECURITY_UPDATES_FILE), "utf8"),
+ );
+
+const main = async () => {
+ const mode = process.argv[2];
+
+ if (mode === "check") {
+ const input = readSecurityUpdates();
+ const count = Object.values(input.securityUpdates).flat().length;
+ console.log(
+ `${SECURITY_UPDATES_FILE} is valid (${String(count)} security updates).`,
+ );
+
+ return;
+ }
+
+ const repository = requireEnv("GITHUB_REPOSITORY");
+ const token = requireEnv("GITHUB_TOKEN");
+ const feedUrl = `https://raw.githubusercontent.com/${repository}/${BRANCH}/${FILE}`;
+
+ if (mode === "security-updates") {
+ const input = readSecurityUpdates();
+ publishToBranch({
+ message: "chore: update security updates",
+ repository,
+ token,
+ update: manifest => applySecurityUpdates(manifest, input),
+ });
+
+ return;
+ }
+
+ if (mode === "release") {
+ const channel = channelForReleaseType(requireEnv("RELEASE_TYPE"));
+ const packages = await publishedPackages(feedUrl);
+ if (packages.length === 0) {
+ console.log("No published package points at this update manifest.");
+
+ return;
+ }
+
+ const coreVersion =
+ packages.find(pkg => pkg.id === CORE_ID)?.version ?? packages[0]?.version;
+ // Releases are tagged v by the bump script; a run that skipped the
+ // GitHub Release simply finds none, and the entry goes out without a date.
+ const githubRelease = coreVersion
+ ? githubReleaseFor(repository, `v${coreVersion}`)
+ : null;
+ if (githubRelease === null) {
+ console.log(
+ "No published GitHub Release for this version - publishedAt and the release URL are left out.",
+ );
+ }
+
+ publishToBranch({
+ message: `chore: publish ${packages
+ .map(pkg => `${pkg.id}@${pkg.version}`)
+ .join(", ")} to ${channel}`,
+ repository,
+ token,
+ update: manifest =>
+ mergeRelease(manifest, { channel, githubRelease, packages }),
+ });
+
+ return;
+ }
+
+ throw new Error(
+ "Usage: publish-update-manifest.ts ",
+ );
+};
+
+main().catch((error: unknown) => {
+ console.error(`❌ ${error instanceof Error ? error.message : String(error)}`);
+ process.exit(1);
+});
diff --git a/security/README.md b/security/README.md
new file mode 100644
index 0000000000..99f527ff5c
--- /dev/null
+++ b/security/README.md
@@ -0,0 +1,7 @@
+# Security updates
+
+`security-updates.json` is the maintained list of security updates for the packages VitNode publishes. The **Publish security updates** workflow validates it on every pull request and, once it lands on `canary`, copies it into the public update manifest on the `update-manifest` branch - the one every VitNode installation reads once a day.
+
+How to write an entry, how ranges match prereleases, and how to announce a vulnerability without a fix: https://vitnode.com/docs/dev/updates/security-updates
+
+Only real security updates belong here. Examples live in the documentation.
diff --git a/security/security-updates.json b/security/security-updates.json
new file mode 100644
index 0000000000..44fa4f2281
--- /dev/null
+++ b/security/security-updates.json
@@ -0,0 +1,4 @@
+{
+ "schemaVersion": 1,
+ "securityUpdates": {}
+}