From 134bbc991edc47926e41e3c9e2c864dc42ac244c Mon Sep 17 00:00:00 2001 From: Mitchell-Johnson Date: Tue, 13 Oct 2026 17:56:16 -0700 Subject: [PATCH] PLAN.md: the whole-console sweep Co-Authored-By: Claude Fable 5.1 --- PLAN.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/PLAN.md b/PLAN.md index 4c48af9..68c4a1a 100644 --- a/PLAN.md +++ b/PLAN.md @@ -793,6 +793,23 @@ something long in one, switch away and back, refresh — it's all still there. empty file; the upload toast counted intentions; the viewer called a pipe a binary file. Not bugs, left alone: `rm -rf` of a mount point empties it (the console is root-capable by design); a folder of ten thousand rows is slow (no virtual list). +- **Whole-console sweep** — **2026-10-13** (v0.1.0-216), asked for as "a full sweep of + Ham Lab again, look for any bugs and fix them". Four nets, then reading: the Go race + detector over the whole suite (clean), staticcheck's development build (the release does + not know Go 1.26; it found only dead code and one capitalised error string), a + garbage-in battery over every route safe to poke — 202 routes, bad identifiers, empty + and malformed bodies, with the destructive ones held back — and a headless Chromium pass + through all twenty tabs on the hub and on `grid`, collecting exceptions, console errors + and failed requests (none). By hand: the auth middleware and sessions, token issue, the + hub→node and KVM proxies, every validation regex before a shell, the cron and cron.d + writers, config and state atomicity, every WebSocket and SSE loop's exit, the terminal + manager, the task manager, and every destructive confirmation in the UI. Fixed, all + small: docker inspect/health of a missing container was a 500 (404 now, a daemon that + is down 503), `/api/virt/instances/{name}` without Incus was a 502 (409 like its + siblings), a ZFS snapshot delete with a bad name was a 500 (400; 404 for one that does + not exist), the task list read a task's Running flag outside its lock (a real data race, + never seen), the Virtualization export config was written in place rather than + atomically, and the dead code. Nothing in auth, the proxies or the shell boundaries. - **Docker read-only view** — `docker ps`/logs; dockhand stays the source of truth. - **Notifications** — push on service failure / SMART warning / UPS event. - **Terminal extras** — search, copy-mode, font/theme, split panes, upload via