Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

web/src/Files.tsx

@@ -157,9 +157,14 @@ export default function Files({ onOpenInTerminal }: { onOpenInTerminal?: (cmd: s
     const list = Array.from(files)
     for (let i = 0; i < list.length; i++) {
       const f = list[i]
+      let overwrite = false
+      if ((entries ?? []).some((e) => e.name === f.name)) {
+        if (!window.confirm(`"${f.name}" already exists here. Replace it?`)) continue
+        overwrite = true
+      }
       setUpload({ name: f.name, pct: 0, n: i + 1, of: list.length })
       try {
-        await api.fileUpload(path, f, sudo, (pct) => setUpload({ name: f.name, pct, n: i + 1, of: list.length }))
+        await api.fileUpload(path, f, sudo, (pct) => setUpload({ name: f.name, pct, n: i + 1, of: list.length }), overwrite)
       } catch (e) { toast(`upload ${f.name} — ${e instanceof Error ? e.message : 'failed'}`, 'err'); break }
     }
     setUpload(null)

web/src/Login.tsx

@@ -11,7 +11,7 @@ export default function Login({ onLogin }: { onLogin: () => void }) {
     e.preventDefault()
     setBusy(true); setErr('')
     try { await api.login(pw); onLogin() }
-    catch (e) { setErr(e instanceof Error ? e.message : 'login failed'); setBusy(false) }
+    catch (e) { setErr((e instanceof Error && e.message) || 'login failed'); setBusy(false) }
   }
 
   return (

web/src/Machines.tsx

@@ -96,7 +96,7 @@ export default function Machines({ hub, onChanged, onOpen }: { hub: Me; onChange
 
       <div className="dash-bar"><h2 className="section">Add a machine</h2></div>
       <form className="card addform" onSubmit={add}>
-        <label>Name <input value={name} onChange={(e) => setName(e.target.value)} placeholder="grid" pattern="[a-z0-9][a-z0-9-]*" required /></label>
+        <label>Name <input value={name} onChange={(e) => setName(e.target.value)} placeholder="grid" pattern="[a-z0-9][a-z0-9\\-]*" required /></label>
         <label>Address <input value={url} onChange={(e) => setUrl(e.target.value)} placeholder="https://10.0.0.214:8100" required /></label>
         <label>Its Ham Lab password <input type="password" value={pw} onChange={(e) => setPw(e.target.value)} autoComplete="off" required /></label>
         {addErr && <div className="error">{addErr}</div>}

web/src/Updates.tsx

@@ -75,7 +75,7 @@ export default function Updates() {
       <div className="kpis">
         <div className="tile"><div className="label">Upgradable</div><div className="value">{st.packages.length}</div><div className="sub">{st.security_count ? `${st.security_count} security` : 'no security updates'}</div></div>
         <div className="tile"><div className="label">Index refreshed</div><div className="value">{ago(st.last_refresh)}</div><div className="sub">{st.manager}</div></div>
-        <div className="tile"><div className="label">Last upgrade</div><div className="value">{ago(st.last_upgrade)}</div><div className="sub">from apt history</div></div>
+        <div className="tile"><div className="label">Last upgrade</div><div className="value">{ago(st.last_upgrade)}</div><div className="sub">from {st.manager} history</div></div>
         <div className="tile"><div className="label">Unattended</div><div className="value">{st.auto_upgrades ? 'on' : 'off'}</div><div className="sub">automatic upgrades</div></div>
       </div>
 

web/src/api.ts

@@ -1,4 +1,4 @@
-export class Unauthenticated extends Error {}
+export class Unauthenticated extends Error { constructor(msg = 'unauthenticated') { super(msg) } }
 
 // Which machine the console is looking at. '' is this host; otherwise every /api/… call
 // is rewritten to /api/nodes/<name>/… and the hub proxies it. Hub-only calls (login,
@@ -28,7 +28,11 @@ async function req<T>(method: string, path: string, body?: unknown, local = fals
     throw new Error('network error')
   }
   track(-1)
-  if (r.status === 401) throw new Unauthenticated()
+  if (r.status === 401) {
+    let msg = 'unauthenticated'
+    try { msg = (await r.json()).error ?? msg } catch { /* ignore */ }
+    throw new Unauthenticated(msg)
+  }
   if (!r.ok) {
     let msg = r.statusText
     try { msg = (await r.json()).error ?? msg } catch { /* ignore */ }
@@ -111,9 +115,9 @@ export const api = {
     if (r.status === 401) throw new Unauthenticated()
     if (!r.ok) { let m = r.statusText; try { m = (await r.json()).error ?? m } catch { /* */ } throw new Error(m) }
   },
-  fileUpload: (dir: string, file: File, sudo: boolean, onProgress: (pct: number) => void) => new Promise<void>((resolve, reject) => {
+  fileUpload: (dir: string, file: File, sudo: boolean, onProgress: (pct: number) => void, overwrite = false) => new Promise<void>((resolve, reject) => {
     const x = new XMLHttpRequest()
-    x.open('PUT', apiPath(`/api/files/upload?${q(dir, sudo)}&name=${encodeURIComponent(file.name)}`))
+    x.open('PUT', apiPath(`/api/files/upload?${q(dir, sudo)}&name=${encodeURIComponent(file.name)}${overwrite ? '&overwrite=1' : ''}`))
     x.upload.onprogress = (e) => { if (e.lengthComputable) onProgress(Math.round((e.loaded / e.total) * 100)) }
     x.onload = () => { if (x.status >= 200 && x.status < 300) resolve(); else { let m = x.statusText; try { m = JSON.parse(x.responseText).error ?? m } catch { /* */ } reject(new Error(m)) } }
     x.onerror = () => reject(new Error('network error'))

web/src/prefs.ts

@@ -14,6 +14,7 @@ export function getRefreshMs(): number {
 }
 
 export function setRefreshMs(ms: number) {
+  if (!(ms >= 100 && ms <= 60000)) return // never accept a nonsense rate, wherever it came from
   localStorage.setItem(KEY, String(ms))
   window.dispatchEvent(new CustomEvent('hamlab:refresh', { detail: ms }))
 }

web/src/themes.ts

@@ -73,7 +73,7 @@ export function currentThemeId(): string {
 // applyTheme sets the variables on <html>, remembers the choice, and tells open
 // terminals to repaint. Cheap enough to call on every load before first render.
 export function applyTheme(id: string) {
-  const t = themeById(id)
+  const t = themeById(id) // unknown ids fall back to the default
   const root = document.documentElement
   for (const [k, v] of Object.entries(t.vars)) root.style.setProperty(k, v)
   root.dataset.theme = t.id