kforbus3 / Fleet-Terminal

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "devops",
        "golang",
        "pam",
        "privileged-access-management",
        "react",
        "security",
        "ssh"
      ],
      "is_fork": false,
      "size_kb": 9324,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 2043900,
        "CSS": 43570,
        "HCL": 1402,
        "HTML": 529972,
        "Shell": 9520,
        "Python": 19625,
        "PLpgSQL": 5256,
        "Makefile": 8593,
        "Dockerfile": 10732,
        "JavaScript": 25519,
        "TypeScript": 826974,
        "Go Template": 3501
      },
      "pushed_at": "2026-07-23T23:58:59Z",
      "created_at": "2026-06-30T15:45:35Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T23:59:02Z",
      "description": "Browser-only privileged access management (PAM) for Linux fleets — SSH through a jump host with ephemeral SSH certificates, session recording, and tamper-evident audit.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "TypeScript",
        "HTML"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "User",
      "login": "kforbus3",
      "company": null,
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/123222302?v=4",
      "created_at": "2023-01-21T03:10:22Z",
      "is_verified": null,
      "public_repos": 5,
      "account_age_days": 1280
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.58.3",
          "kind": "patch",
          "published_at": "2026-07-23T23:58:59Z"
        },
        {
          "tag": "v0.58.2",
          "kind": "patch",
          "published_at": "2026-07-23T23:30:07Z"
        },
        {
          "tag": "v0.58.1",
          "kind": "patch",
          "published_at": "2026-07-23T23:19:55Z"
        },
        {
          "tag": "v0.58.0",
          "kind": "minor",
          "published_at": "2026-07-23T23:10:59Z"
        },
        {
          "tag": "v0.57.0",
          "kind": "minor",
          "published_at": "2026-07-23T23:04:33Z"
        },
        {
          "tag": "v0.56.0",
          "kind": "minor",
          "published_at": "2026-07-23T22:02:23Z"
        },
        {
          "tag": "v0.55.5",
          "kind": "patch",
          "published_at": "2026-07-23T00:41:22Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "81adcd56a5bf1be62eb3123316191d60fbf49ccb",
          "body": "… insights fix (v0.58.3)\n\n- Route open-ended health questions (\"any problems?\", \"anything wrong?\", \"morning\n  report\", \"does anything need my attention?\") to fleet_insights as a single\n  grounded call. The model answered these correctly but sometimes made an extra\n  unrelated tool call (e.g. list_sc\n[…]\nt-insights table attached (previously a Schedules table), and\nthe updates surface for a host seeded with inventory but no metrics.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(assistant): health questions attach insights (not a stray table);…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T23:58:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "14304e2a061c95d6718d75e7be275f7c37ab0e35",
          "body": "….58.2)\n\n- Route \"what runs on a schedule / when does it fire next / what's scheduled\"\n  deterministically to list_schedules and answer from that data, instead of the\n  model occasionally looping to the iteration cap and returning \"I couldn't fully\n  resolve that\" with a bare table. History/failure \n[…]\ninst gemma4:26b: the schedule questions now narrate the schedules\nand their next fire times (previously hit the give-up fallback).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(assistant): reliable schedule answers + narrate-on-exhaustion (v0…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T23:30:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "13b73b5d43d5cf307e19c3840931d0b85c8af4ed",
          "body": "…(v0.58.1)\n\nThe assistant answers in a background context (LLM inference outlives the HTTP\nrequest), which carried no tenant scope. Under FLEET_MULTI_TENANCY the pool's RLS\nhook then saw an unmarked context and denied every row (fail-closed), so Ask\nreturned nothing. Capture the caller's tenant from\n[…]\norced: unmarked context -> 0\nrows (fail-closed), tenant A context -> only A's rows, tenant B -> only B's, no\ncross-tenant leakage.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(assistant): scope Ask to the caller's tenant under multi-tenancy …",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T23:19:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2285d3937f255f1cfc0a5fd27a8aab3601ff8a80",
          "body": "Expand the diagnostic set the support bundle collects so a support agent's first\ndownload usually has what they'd ask for. Added alongside the existing outputs:\nPSI pressure, swap, ulimits/open-file handles, kernel modules; filesystem details\n(blkid/fstab), SMART health, RAID (mdstat/zpool), I/O sta\n[…]\nDebian container: exits clean, no errors, produces\na valid archive with all files populated (and absent tools degrade gracefully).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(support): fuller per-host support bundle (v0.58.0)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T23:10:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3d3bace5acfb17d47e86e0f01dcc6c98f3b8a069",
          "body": "…0.57.0)\n\nNew answerable areas:\n- capacity_outlook: \"will any host run out of disk/memory this week\" now filters\n  the insights engine to disk-runway + memory signals and answers plainly when\n  nothing is at risk, instead of returning unrelated items (pending updates).\n- security_events: failed logi\n[…]\nll\nroute and narrate correctly, including graceful declines for data Fleet does not\ncollect (SMART, host TLS certs, host backups).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(assistant): capacity + login-security tools, reliable routing (v…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T23:04:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "55298feb9cf4db9645b9b87a6f372ae723cc628f",
          "body": "Coverage pass over the Ask assistant so it answers the questions an IT\nadmin / sysadmin actually asks. Six data areas that had no tool are now\nanswerable, plus two accuracy fixes.\n\nNew tools (each RBAC- and host-access-scoped like the existing ones):\n- host_availability: online<->offline transition \n[…]\nres (migration + RLS/tenant_id + host-access scoping + all new\nqueries); fast-path + disk-reconciliation unit tests; frontend tsc.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(assistant): six new answerable areas + accuracy fixes (v0.56.0)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T22:02:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "da53c815f97f22959eff1380c8dca05d0b8ce59e",
          "body": "….55.4)\"\n\nThis reverts the v0.55.4 org-placeholder change (v0.55.5). The clone / go get /\ngo install references are the repository's real GitHub path, so replacing them with\na generic placeholder made those commands non-functional. Restores the real module\npath across the SDK, Terraform provider, docs, and the assistant's embedded docs.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Revert \"chore: use generic org placeholder in module paths + docs (v0…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T00:40:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "073713b22f2cdecdcf39e3359bd0c2317a739816",
          "body": "Replace the specific GitHub account in the Go SDK and Terraform provider module\npaths (and the clone / go get / go install examples in the docs + the assistant's\nembedded docs) with a generic `your-org` placeholder\n(github.com/your-org/Fleet-Terminal/...).\n\nBuilding from this repo is unaffected: the\n[…]\n provider, and backend all build/vet clean. SDK and\nTerraform users substitute their own org in the import path / provider source.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: use generic org placeholder in module paths + docs (v0.55.4)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-23T00:26:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8bedd8b576a0c32faed8d00d93c54059ae6eb942",
          "body": "Extends v0.55.2 to the in-terminal view (/terminals/:hostId). The header showed\nonly the terminal CONNECTION status; it now also shows the host's monitor\nonline/offline status as its own chip. The app-wide host.status subscription now\ninvalidates the single-host detail query ([\"host\", ...]) in addit\n[…]\nalidation only touches the lightweight single-host detail\nqueries; [\"host-software\"]/[\"host-scans\"] (different key) are untouched.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(ui): live host online/offline chip on the terminal view (v0.55.3)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T23:46:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ca72ab5d330121d4a4303982098fb7a73014cc65",
          "body": "….55.2)\n\nHost online/offline changes were only reflected without a manual refresh on the\nDashboard; the Terminals launcher and Hosts grid never updated live.\n\nThe backend already broadcasts host.status on every monitor probe over the events\nWebSocket. This moves that subscription from the Dashboard \n[…]\nagainst the running stack: the events WS emits host.status\nframes (host-ubuntu, host-rocky -> online) that drive the invalidation.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(ui): live host status across Dashboard, Terminals, and Hosts (v0…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T23:41:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cef82110e90ec20fd4597acbf93a0db58038f197",
          "body": "Review-backlog cleanup pass. Four of the five items were already addressed in\nprior work: B13 (interval-schedule drift is now documented as intentional in\nstore/schedules.go), B14 (playbook NDJSON scanner buffer raised to the 4 MiB\noutput budget with an explicit truncation marker), B15 (the empty in\n[…]\nical set (and none may be silently renamed away). This\nprevents the ambiguity from growing without touching any applied migration.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(db): guard migration naming + ordinal collisions (B16 cleanup)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T23:10:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6268731f6a803113994b8f4ff21e0d7c78cc0a4f",
          "body": "…sts (v0.55.1)\n\nFollows up v0.54.1 (Debian/Ubuntu) with the dnf/yum path.\n\nThe dnf branch hard-coded every pending package to non-security in the per-package\nlist (only the aggregate count used updateinfo), so on RHEL/Rocky/Alma/Fedora no\nindividual package was ever shown as a security update, and c\n[…]\na real Rocky Linux 9 host: 108 pending / 56 security, per-package flags\nconsistent with the count and matching `dnf check-update`.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(monitor): correct pending-update security flags on RHEL-family ho…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T22:59:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6baae7ea7534270198076e3cc316579c81521f02",
          "body": "…est stack (v0.55.0)\n\nCloses the last HA gap. Live session shadowing (Session.Watch on an in-progress\nsession) now works from any instance, not only the one that owns the PTY.\n\n- livesessions.Broker gains a cluster bridge: a watcher on instance B announces\n  interest over the existing Postgres LISTE\n[…]\ncal; and the live\nHA stack (leader-kill failover + dead-owner reconciliation sparing live peers) from the\nprior verification pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(ha): cross-instance live session shadowing + self-contained HA t…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T22:26:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a90c61c8e455b01fc288a3a6d7e154a7758458cf",
          "body": "Three user-reported fixes.\n\n1) Pending updates missed phased / kept-back packages. The monitor collected\n   updates with `apt-get -s upgrade`, which holds back packages needing new\n   dependencies and Ubuntu phased updates — so a host whose only pending updates\n   were phased showed nothing pending \n[…]\nimes into\n   that zone in the model payload, and states the display timezone in the system\n   prompt so all reported times use it.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: accurate pending updates + Ask-AI timezone reporting (v0.54.1)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T21:28:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5035a2c971da4bed635ade821cc55039e1c9dae1",
          "body": "Completes federation key lifecycle. A site can now rotate its own identity key\nin place (mirror of the existing hub-key rotation), with no re-enrollment and no\nlink downtime, using the pre-existing pending_public_key column.\n\n- POST /api/v1/federation/site/rotate-key (System.Configure): the site gen\n[…]\npromotion lands within ~3s; link stays active/up; a unit test\nlocks the signed-message wire contract (bound to site+newkey+nonce).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "federation: site-initiated key rotation + transport honesty (v0.54.0)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T20:58:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f2e9540810294007f485e18757778d80865af1ac",
          "body": "A multi-tenant hub now isolates federated sites per tenant. A site belongs\nto the tenant of the operator who minted its join token; the site, its\naggregated read-cache, and its sync state are owned by that tenant and\nenforced by Postgres row-level security.\n\n- migration 0062 adds tenant_id + forced \n[…]\ntenant proxy\nlookup returns 0 rows (404) while same-tenant returns the site; full non-MT\njoin->link->proxy flow intact end-to-end.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "federation: site-as-tenant tenancy isolation (v0.53.0)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T20:43:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c852199b27bac14f68701de189579079a14d59b9",
          "body": "Refresh docs/federation.md (present-tense feature doc; add a \"Federation and\nmulti-tenancy\" section explaining they are orthogonal and compose — site-as-tenant\nfor MSPs — and the per-site autonomy/audit trust boundaries). Expose FLEET_MODE /\nFLEET_HUB_* in the reference compose and .env.example. Add federation.md to the in-app\nhelp and cross-reference it from the Admin and Security guides. CHANGELOG v0.52.0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "federation M5: docs, compose config, in-app help",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T12:45:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "091dc494eac9f80fc65b79bf0570ac9da930b7bc",
          "body": "MountHub/MountSite register their own /api/v1/federation group plus top-level\nsite-facing /federation/join|link, so they must be mounted on the TOP-LEVEL router,\nnot the already-/api/v1-scoped router inside registerRoutes (which double-prefixed to\n/api/v1/api/v1/federation and 404'd). Move the call \n[…]\n the site active/up, and a\nproxied request truly reaches the site (proxied /federation/mode returns \"site\"); site\nrevoke drops it.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "federation M1: fix mount path + verify end-to-end (hub+site)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T12:42:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6fb93a81203f12e28873fab39adc7d7a5dc7b3dd",
          "body": "Bring the complete F0–F5 federation implementation (internal/federation package,\nstore/federation, hub/site model, Ed25519 acting-user assertions, site-initiated\nWSS+yamux tunnel, hub proxy, Sites UI + global site selector) forward onto current\nmain. Renumber migrations 0021/0022 -> 0060/0061. Hand-\n[…]\nd. Also fix a stale dbbroker test that predated the MongoDB engine.\n\nBackend build/vet/tests, frontend tsc/build, gofmt all clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "federation M0: port feature/multi-site-federation onto current main",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T12:30:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bebf0ce2bcf6f401c0cc7ac352ae2a5405101295",
          "body": "Write the approval decision back to the linked ITSM ticket: on approve/deny, Fleet\nposts a ServiceNow work note or a Jira comment recording the outcome, decider, and\ngranted duration (audited approval.ticket_update). Best-effort — a decision is never\nblocked on the ITSM; closing/transitioning stays \n[…]\n the approval decide handler.\n\nVerified end-to-end vs a mock ServiceNow: request opened a ticket, approval wrote a\nwork note back.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.51.0 — ITSM two-way sync",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:39:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3f76cba215dfe4b2416b6ab6613409cab668b45b",
          "body": "Add AWS Secrets Manager to the external secrets manager (vault-of-record) alongside\nHashiCorp Vault KV. A credential references an AWS secret (name/ARN, optionally #field\nfor a JSON key); Fleet fetches it on demand via a SigV4-signed GetSecretValue with no\nAWS SDK and no local copy. Refactor the Sig\n[…]\nicker.\n\nVerified end-to-end against LocalStack: reveal returns the live value (with #field JSON\nextraction), no local blob stored.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.50.0 — external secrets: AWS Secrets Manager",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:33:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6540416745ce846d334d3b5720ed8c150b0c9743",
          "body": "Add the external secrets manager and ITSM pointers to the Security and Admin guides,\ndocument MongoDB in the database-broker guide, and add itsm.md / external-secrets.md to\nthe in-app help. Final PII/branch sweep of docs + generated help is clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: cross-reference external-secrets, ITSM & MongoDB in the guides",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:20:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d9ef6eb07a3272f9dd64ab36795fb1f30326c5a2",
          "body": "Add MongoDB to the database broker. Document-oriented, so the console takes a\nMongoDB command document as JSON (e.g. {\"find\":\"users\",\"limit\":10}) and returns\nformatted JSON, with the same vaulted-credential injection and db.query auditing.\nThe Mongo driver opens several connections, so each dial get\n[…]\nive MongoDB: listDatabases and find through the broker\nwith a vaulted root credential; db.query audited (engine=mongodb, ok=true).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.49.0 — database broker: MongoDB",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:19:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d238fb2acbbefcb1ee64865c4bf18804125e163c",
          "body": "Open a change/incident ticket in ServiceNow or Jira for each just-in-time access\nrequest and attach its reference to the approval. Best-effort/non-blocking (failures\nlogged, successes audited as approval.ticket); ticket ref + link included in the\napproval notification. Settings card (System.Configur\n[…]\na mock ServiceNow: config+test, then an access request\nopened a ticket (INC…) and attached its reference; token is masked on read.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.48.0 — ITSM integration (ServiceNow / Jira)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:09:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d64f048f8a17f91082435282fda4e98723f14e35",
          "body": "Vault credentials can be external-backed: instead of storing sealed material, a\ncredential references it in an external secrets manager (HashiCorp Vault KV v2) and\nFleet fetches the value on demand at point of use. New internal/extsecret (Vault KV\nprovider, stdlib HTTP) + internal/credresolve, the s\n[…]\n changes the reveal, no local blob is stored, local rotation is refused, and a\nnormal locally-sealed secret still works unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.47.0 — external secrets manager (vault-of-record)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T03:01:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7a26337a99e8daed6f8d5ff2cfad8ae192c66628",
          "body": "Documentation audit for the recent enterprise features:\n- New dedicated docs (also added to the in-app help allow-list): database-broker.md,\n  kubernetes.md, kms.md, access-policies.md, behavior-analytics.md.\n- Cross-referenced them from the Security guide (ABAC, KMS, UEBA), User guide\n  (customizab\n[…]\ngenericized a homelab IP example, removed a\n  hypervisor-product name, and removed stale git-branch references (FIPS is released).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.46.1 — docs: cover new features + scrub setup specifics",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T02:23:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0fc677fc8e7f31c0cf6fbd7fefc26d1095181408",
          "body": "Add lightweight user-and-entity behavior analytics over Fleet's session records:\nexplainable statistics (no ML, no deps) flagging off-hours access, first access to a\nhost, a new source IP, and activity spikes vs each user's baseline. New Behavior page\n(Audit.View), GET /ueba/anomalies computed on de\n[…]\ns ssh_sessions).\n\nVerified live: off-hours + new-source-IP anomalies surfaced from seeded sessions,\nnormal activity produced none.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.46.0 — behavior analytics (UEBA)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T02:12:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9631510d6a89415f4e53517d9529e641a8daa7d2",
          "body": "Broker cluster access like SSH/RDP/databases: Fleet is an authenticating proxy that\nforwards a user's (or kubectl's) requests to the cluster API server with a vaulted\nbearer token injected, auditing every call (k8s.proxy/k8s.list). Register clusters\n(API server + vault credential + per-cluster TLS: \n[…]\nied end-to-end against a live k3s cluster: listed real pods and proxied the\nversion endpoint through Fleet with the vaulted token.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.45.0 — Kubernetes access brokering",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T02:04:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f15afedef32df92951d3a17c01b180dbb6485d51",
          "body": "Add contextual deny rules on top of RBAC. An access policy blocks a host\nconnection RBAC would otherwise allow, matching host attributes (environment,\ntags, protocol), time-of-day windows (incl. wrap-past-midnight and days of week),\nwith role exemptions. Policies only restrict; super admins are alwa\n[…]\non host with the rule's message, super-admin exempt, and disabling the\npolicy restores access; access.denied audit event recorded.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.44.0 — policy-as-code: attribute-based access control (ABAC)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:54:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b5d33574ed5dc4375010e16f4ed49554c3c8fa9d",
          "body": "Add two more external KMS backends behind the internal/kms interface for master-key\nprotection: Azure Key Vault (wrapKey/unwrapKey RSA-OAEP-256, Azure AD client-\ncredentials auth with token caching) and GCP Cloud KMS (cryptoKey encrypt/decrypt,\nservice-account RS256-JWT auth). Both use the vendor RE\n[…]\nnstruction verifies against the SA public key; Azure config\nvalidation. (Live cloud round-trips require a real Azure/GCP account.)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.43.0 — KMS backends: Azure Key Vault & GCP Cloud KMS",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:36:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b8d20e7660240153ed92ca69a8b29018025b15b9",
          "body": "Add a reusable per-user preference store (user_preferences table, migration 0055;\nself-scoped GET/PUT /preferences/{key} with whitelisted keys) and use it to let each\nuser choose exactly which hosts — and in what order — appear in the dashboard Quick\nConnect list, via a tune-icon dialog. Empty selec\n[…]\nion restores the automatic top-6;\nunreachable pinned hosts are skipped with a hint. Preference follows the account\nacross devices.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.42.0 — customizable dashboard Quick Connect",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:30:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fde43ec7fac16875738446f1d1681a1e859ab7e6",
          "body": "The offline RDP recording player bound its drag handlers only to a small box, so a\nfile dropped elsewhere did nothing (and the browser could navigate away). Make the\nwhole window a drop target with a large, obvious full-page overlay while dragging,\nand enlarge/clarify the click-to-browse area. Edit the template; rebuild the inlined\npublic/guac-player.html.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.41.1 — offline .guac player accepts a drop anywhere on the page",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:30:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7a523035cf80d01b39d1d2145503cd734003fe21",
          "body": "Extend the database access broker beyond PostgreSQL. Register MySQL/MariaDB and\nSQL Server targets and run brokered SQL through the jump host with the same\nvaulted-credential injection, row/statement caps, and db.query auditing.\n\nEach engine runs its native driver (pgx / MySQL wire protocol / TDS) o\n[…]\nl:8 and\nmssql/server:2022 servers (SELECT grids + non-row statements), plus unit tests for\nthe statement-shape and engine helpers.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.41.0 — database broker: MySQL, MariaDB & SQL Server",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:30:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e8f92199a0674273e95b0c4a1158ac6028d455b1",
          "body": "Add pluggable envelope-encryption backends that protect the CA signing-key\npassphrase and the credential-vault passphrase with a key held in an external\nKMS/HSM (\"unseal via KMS\"). Wrapped passphrases (FLEET_CA_PASSPHRASE_WRAPPED /\nFLEET_VAULT_PASSPHRASE_WRAPPED) are unwrapped once at boot; the at-r\n[…]\n(KMS):\nprovider round-trips, the fleetctl operator workflow, and config.ResolveSecrets\nunwrapping into the real passphrase fields.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.40.0 — external KMS/HSM for master-key protection",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T01:02:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7fc7a260d9f27bf2c3646e9f6c4d839dda7a5398",
          "body": "Extends Fleet from SSH/RDP brokering to privileged DATABASE access. Register a\nPostgreSQL target (migration 0053: databases table + Database.Manage/Connect perms)\nwith a vaulted credential; the new Databases page runs SQL through the broker.\n\ninternal/dbbroker reaches the database through the jump h\n[…]\n052). Backend gofmt + vet + build clean; frontend\ntsc/build clean. First engine PostgreSQL (bundled pgx); model extends to others.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.39.0 — database access brokering (PostgreSQL)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-22T00:25:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "da48e7af968b7f9ccd9b955882f87f4ab8af7d11",
          "body": "Extends the credential vault from on-demand password rotation to automatic\nscheduled rotation. A password credential can be given a rotation interval\n(1/7/30/60/90 days) from the Credentials page; a leader-gated background loop\n(FLEET_VAULT_ROTATION_CHECK, default 30m) rotates due credentials on the\n[…]\n-backed-off. Frontend: rotation-interval dialog + an\n\"auto Nd\" chip on the credential row. gofmt + vet + go test clean on Go 1.24.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.38.0 — scheduled automatic credential rotation",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T23:56:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d282241cb00b28c7c48c7cf4547dc9c7f5e3ed26",
          "body": "AppendAudit read the previous hash (SELECT hash ... ORDER BY seq DESC LIMIT 1)\ninside the request's tenant-scoped transaction. Under multi-tenancy that read is\nRLS-filtered, so an event written while acting inside a customer tenant chained to\nthat tenant's last VISIBLE hash — often \"\" — instead of t\n[…]\nearlier testing can't be un-tampered. v0.37.0 already fixed the\nverify side (global read). gofmt + vet + go test clean on Go 1.24.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.37.1 — multi-tenancy: keep the audit hash-chain global on append",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T22:40:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "97e5b1fe37dd1f0e4b27a6d7ae212b2f5b751c39",
          "body": "…ation\n\nAdds an auditor-ready PDF to the Reports page (Audit.View), complementing the\nper-domain CSV exports. For a date range it renders, server-side as a real\npure-Go/CGO-free PDF:\n- an audit-log INTEGRITY ATTESTATION — a genesis-to-latest verification of the\n  hash-chained audit log (PASS / FAIL \n[…]\ns, attestation reflects real chain\nstate, UI card renders + downloads).\n\nNew dependency: github.com/go-pdf/fpdf (pure Go, no CGO).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.37.0 — Compliance evidence pack (PDF) + global audit-chain verific…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T22:22:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "74c3edbea40bf5cc6d2a0edd55947dc90783ed88",
          "body": "…-denied WS/streams)\n\nToken-authenticated endpoints (WebSocket terminal/watch/RDP, RDP-recording and\nscan-report streams, enrollment agent) authenticate via AuthenticateToken — which\nresolves the principal under RLS bypass — but then ran their DB work on the raw\nrequest context, never re-applying th\n[…]\nfin) audit rows are written under\nthe correct tenant_id. Cross-tenant isolation unchanged. gofmt + vet + go test\nclean on Go 1.24.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.36.5 — multi-tenancy: scope token-authenticated endpoints (fix RLS…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T21:48:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d05ba57637547ae631257aad0ddbc33f65920fa5",
          "body": "…17), CSRF cleanup (B15)\n\nA re-audit of an earlier code review found 11 of 17 items already fixed\n(including both critical ones — the terminal double-close crash and the OIDC\naccount-takeover). This lands the real remainders.\n\nB6 — retention for two still-unbounded tables. The activity-retention loo\n[…]\nmake the runner re-run them) and B13 interval-\nschedule drift (documented as intentional). gofmt + vet + go test clean on Go 1.24.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.36.4 — deep-review remainders: retention (B6), WS token off-URL (B…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T20:55:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1b1ab990810e9477ec958aa6f9acd68b1531142e",
          "body": "…rd-party CVE coverage\n\nThe curated DisplayName->CPE dictionary is the accuracy limit of Windows third-\nparty CVE scanning (installed software -> CPE -> CycloneDX SBOM -> grype/NVD).\nAdded 16 high-value, high-confidence enterprise apps: WinRAR, TeamViewer, Slack,\nOracle VirtualBox, VMware Workstatio\n[…]\nthe two products don't collide. Tests cover the new\nentries and the guarded/ordered cases. gofmt + vet + go test clean on Go 1.24.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.36.3 — expand Windows app->CPE dictionary (19 -> 35) for wider thi…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T20:24:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7f96e73635c6f017caedb5b01cfb47aea57419f3",
          "body": "…ute shadow)\n\nnginx proxies the exact path /health to the backend liveness endpoint (for infra\nand monitoring probes). That shadowed the SPA's /health route, so a hard refresh\nor direct link to the System Health page returned raw {\"status\":\"ok\"} JSON instead\nof the page. In-app (client-side) navigat\n[…]\nep working. Verified on the Docker\nfabric: GET /health -> backend JSON; GET /system-health -> the SPA page renders on\ndirect load.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.36.2 — System Health page reachable on direct load (fix /health ro…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T12:18:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f2f69231a625e27376c4f2771d838ed016c26951",
          "body": "…provider view\n\nFollow-up to browser testing: while switched into a customer tenant the only\nalways-visible control was a generic \"In customer tenant\" chip that just linked\nto the Tenants console — users couldn't tell which tenant they were in, and the\nswitch-back was buried on that page.\n\nAppLayout\n[…]\nnant -> \"Tenant: Acme\" +\nExit show on Dashboard and Hosts -> Exit returns to the provider view with the\nprovider's hosts restored.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Multi-tenancy UX: show tenant name on every page + one-click Exit to …",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T12:06:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "87c55451deb7a2fa1f9a3103a218fead1b5fe0e9",
          "body": "…tenancy in compose\n\nBrowser-based end-to-end testing on the Docker fabric surfaced one real UI bug:\nwhen replaying an SSH session full-screen, the \"Exit full screen\" button was\nrendered but invisible. The replay lives in a right-anchored MUI Drawer (a modal\nwhose stacking context sits just below th\n[…]\n-superuser role: a provider admin sees 2 hosts, switching into\na customer tenant shows 0 (isolated), switching back restores them.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.36.1 — fix invisible session-replay full-screen exit + wire multi-…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T04:17:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "54b1c7b077dc7f3e6e685315b5c837b01ecd6bd3",
          "body": "…overlay\n\nMerges the FIPS work into main (v0.36.0). Opt-in via FLEET_FIPS_MODE (default off);\nnon-FIPS deployments unchanged. Brings the Go 1.24 FIPS module, ECDSA CA/identities,\npinned SSH suites, PBKDF2 KDF, the OpenVPN cert overlay (per-host selectable), the\nfleetctl fips migration toolset, and t\n[…]\nlean on go1.24; a FRESH FIPS deploy boots with\nthe module active + ECDSA CA + overlay PKI; default + multi-tenant boots unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge feature/fips-mode: FIPS 140-3 mode (opt-in) + per-host OpenVPN …",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T02:19:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "91ff1696cf107fe7f6d18707ac987ebc04da5908",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.35.0 — Multi-tenancy (MSP) release notes",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T02:13:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a0637516cf1f8b565ad77b27e256d66ce6eeee7b",
          "body": "- API client sends X-Fleet-Tenant from the active (switched-into) tenant, persisted.\n- Auth store carries multiTenancy/isProviderAdmin/tenantId/activeTenant + switchTenant();\n  a non-provider-admin can never carry a switch header.\n- TenantsPage (provider console): list/create/suspend tenants, switch\n[…]\n P0/P1 done + Enabling section (non-superuser DB role\n  requirement); .env.example flag.\n\nFrontend + backend build/vet/test clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Multi-tenancy P1: Tenants console UI + tenant switcher + docs",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T02:13:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "060706cc9d424e585163fce761a9de525bd9f6a9",
          "body": "…ant API\n\n- Principal.TenantID (from users.tenant_id); RequireAuth resolves the principal with RLS\n  bypassed (cross-tenant auth lookup) then scopes the request to the caller's tenant.\n- Provider admins (Tenant.Manage in the provider tenant) switch into a customer tenant\n  via the X-Fleet-Tenant hea\n[…]\nts returns ONLY the current\ntenant's host (provider can't see Acme's, and vice versa via the switch header). Flag\noff = unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Multi-tenancy P1: auth tenant scoping + provider context switch + ten…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T02:06:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0f3d1706b0e570e94ffd3310a322fd664a727a3e",
          "body": "FLEET_MULTI_TENANCY (default off). Row-level security enforcement:\n- internal/tenant: per-request tenant scope on context (WithID / WithBypass); unmarked\n  = deny (fail closed).\n- db.Connect BeforeAcquire hook sets app.tenant_id GUC per connection from context, so\n  every existing query is scoped wi\n[…]\nONE. Flag off = unchanged (hook sets bypass).\nNOTE: enforcement requires the app DB role be non-superuser (superusers ignore RLS).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Multi-tenancy P0: RLS foundation (flag-gated, proven isolation)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:56:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "832874399a21a83f64ffeee5302a282a4fa4748d",
          "body": "strongSwan couldn't be validated end-to-end without a real IPsec (kernel-xfrm) host, so\ndrop it rather than ship untested. Removes overlay/strongswan.go + test, the registry\nentry, the enroll-dialog option + API validation for 'strongswan', and the jump-image\nstrongswan packages/IKE ports. The Overl\n[…]\n),\nso a second cert overlay can be re-added later once testable. Builds + overlay tests pass;\nWireGuard + OpenVPN paths unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS overlay: remove strongSwan/IPsec (unvalidated) — OpenVPN only",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:41:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "056e306a1c5842c73c0e1f57d5868173d95c7318",
          "body": "…ental\n\nDesign + phasing for FLEET_MULTI_TENANCY (default off). Groundwork only; no code yet.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: multi-tenancy (MSP) phased plan — row-level, flag-gated, increm…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:36:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b06402b91e35a915034c68e5131f7966da74cec3",
          "body": "- Self-contained offline RDP recording player: scripts/build-guac-player.mjs inlines\n  guacamole-common-js into public/guac-player.html (regenerated in prebuild). Loads a\n  local .guac via an object-URL StaticHTTPTunnel (the same proven playback path),\n  fully offline, with play/seek/native-fullscre\n[…]\nwnload\n  button in the RDP recordings panel.\n- Content search: highlight the searched keyword in result snippets (highlightMatch).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.34.0 — Offline .guac player + content-search keyword highlighting",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:31:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7b177d69385ef36b2b3d555c9020a63b5b1d94c5",
          "body": "- RDP replay (RdpPlayer) gains full-screen: the Guacamole canvas scales to fit the\n  viewport (both dimensions), with Esc (capture phase) + a floating exit button.\n- SSH replay: replaced the easy-to-miss top-row icon with a floating, fixed\n  'Exit full screen (Esc)' button in the viewport corner, above the overlay.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.7 — Full-screen for RDP replay + visible SSH exit button",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:20:53Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cad413fe9c1e8de9e5ef73dbf47dd5c758c07b7e",
          "body": "Esc sometimes didn't exit fullscreen because the xterm terminal (when focused) can\nstopPropagation on keydown, so the bubble-phase window listener missed it. Moved the Esc\nhandler to the capture phase. Also replaced the small corner icon with a clear labeled\n'Exit full screen (Esc)' button.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.6 — Session replay: reliable full-screen exit",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T01:06:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2d88686aa2f1bb5b33aa8002e0d94111ede947f7",
          "body": "Bypass the local model's tool choice for unambiguous questions: detect the intent, run\nthe right tool with correct args, and have the model only narrate (tools disabled so it\ncan't mis-route). Covers 'who ran/typed <command> [on <host>]' -> search_commands and\n'what/which pending updates [on <host>]\n[…]\n> host_updates. High-precision (unit-tested,\nincl. negative cases); everything else falls through to the normal model-driven loop.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.5 — Ask AI: deterministic fast-path for obvious intents",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:50:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cf09797e7c79f87edacae7d4dd58d3c1c6b50dbe",
          "body": "…ost)\n\n'What are the pending updates?' used host_detail, which returns the entire host so the\nUI rendered the full host card (OS/filesystems/interfaces) under the answer. New\nhost_updates tool returns just the pending packages (host, package, version, security)\nas a focused table — one host or all a\n[…]\n\nscoped. Update questions route here; host_detail is now for filesystem/network only.\nJSONB extraction validated against Postgres.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.4 — Ask AI: focused host_updates tool (stop dumping the whole h…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:42:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fe224723708a01822e6c3f258d4b7f42bb498041",
          "body": "…_commands\n\nHardened the system prompt + tool descriptions so 'who ran/typed/executed <command>'\nroutes firmly to search_commands (interactive terminals) and recent_commands (Fleet\nRun-Command), never fleet_insights/query_hosts; scoped fleet_insights to health/capacity\nonly. Fixes a weak-local-model mis-route (it answered 'who ran df' with fleet health).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.3 — Ask AI: route 'who ran <command>' to search_commands/recent…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:24:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f315bb5a059f602a2a3d2fdd6f1e8f48e4c19d80",
          "body": "New Commands tab on the Sessions page searches the commands users typed in recorded\nsessions (backed by the v0.33.0 command index): filter by host, see user/host/time/\ncommand, jump to replay. New endpoint GET /api/v1/session-commands (Session.Replay,\nhost-scoped, audited) over store.SearchSessionCommands. Route confirmed mounted+gated\n(401 unauth); store SQL previously validated; frontend builds.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.2 — Sessions: 'Commands' search view",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:13:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "aef4621d8e4fe216006e661740f89b121027b072",
          "body": "The host-detail dialog surfaces inventory.updatePackages (collected in v0.33.0): a\nscrollable list under System with each package's name + target version, security\nupdates flagged and sorted first. Frontend-only.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.33.1 — Host detail: show pending-update package list",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:08:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "740e21a40087e160afa8c3b71cc529868aa87d09",
          "body": "…ay full screen)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: v0.33.0 changelog (Ask AI command history/update details + repl…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:04:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a301e1a6fea54b0ac850890abec2398ce4b00e9a",
          "body": "The real 'who ran command X' over interactive terminal history:\n- internal/cmdindex reconstructs typed command lines from asciicast input events\n  (backspace / Ctrl-U / Ctrl-C / escape-sequence aware); best-effort, unit-tested.\n- Migration 0050: session_commands table + GIN full-text index + a per-r\n[…]\ny Session.Replay) with an explicit best-effort\n  caveat. Validated: migrations apply, FTS + substring queries return correct rows.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Ask AI: indexed search of commands typed in recorded SSH sessions",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-21T00:03:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0e7e0d385384e0157dae059d59fcb1bf0fe8f595",
          "body": "The recorded-session replay now has a full-screen button (and Esc to exit): the xterm\nplayer expands to a full-viewport overlay with a larger font, and re-fits on toggle and\non window resize so the recording is easier to view. Normal (drawer) view unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Session replay: full-screen toggle + resize",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:54:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4c54c873e1df3ccc5c91946f2c6e49da668ff379",
          "body": "The monitor now collects the actual pending-update package list (name, target version,\nsecurity flag) alongside the counts — apt/dnf/yum, capped at 500/host — stored in a new\nhost_inventory.update_packages JSONB column (migration 0049). Exposed on\nHostInventory.updatePackages, so host_detail (and the UI) can answer 'which packages\nneed updating on web-01', not just how many. host_detail tool description updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Ask AI: per-host pending-update package details",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:52:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "582d04a6156ebfc8aa272e429ea4e1a41b99947d",
          "body": "Exposes command_runs (Fleet Run-Command feature) to the assistant: exact command text,\nrequester, target, status, exit code, when — gated by Command.Run. Optional contains /\nhostname filters; renders as a result table. Tool + guidance clarify this is NOT\ninteractive-terminal keystrokes (those live only in session recordings).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Ask AI: recent_commands tool (who ran which Fleet command)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:46:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b73db4330eec3dcf6035f39d90c7dfdf15b8fcfc",
          "body": "- Frontend: 'VPN overlay' dropdown in the enroll dialog (default/wireguard/openvpn/\n  strongswan) wired to the enroll API's overlay field.\n- Jump-host test image: add strongswan + strongswan-swanctl, expose IKE 500/4500 udp.\n- docs/fips-mode-plan.md: document both cert overlays + per-host selection \n[…]\nG boot on the\nsame DB shows zero overlay-PKI activity and no host-scan errors. Full frontend build +\nbackend build/vet/test clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS overlay: enroll-dialog VPN selector + strongSwan jump image + docs",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:34:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "520ec7ba57ba887dbdeebfac32b5a3e84791aff8",
          "body": "- Migration 0050: hosts.overlay column ('' = deployment default).\n- models.Host.Overlay + store scan/setter (SetHostOverlay).\n- EnrollParams.Overlay + effectiveOverlay(param -> host -> cfg default); enrollment\n  dispatches WG vs cert-overlay on the per-host effective value and provisions via the\n  o\n[…]\noverlay CA\n  created lazily (pre-warmed on boot only when the default is a cert overlay).\n- enroll API validates + passes overlay.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS overlay: per-host overlay selection + registry wiring",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:30:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "95ca0b36ce3de4db609cfd4e9423abddf606c332",
          "body": "- overlay.Overlay interface (Name/EnsureServer/ProvisionHost) + RunFunc; OpenVPN\n  implements it (wraps existing methods, lazy EnsureCA).\n- overlay.StrongSwan: IKEv2/IPsec via strongSwan+swanctl, FIPS proposals\n  (aes256-sha256-ecp256 IKE, aes256gcm16-ecp256 ESP), per-host virtual IP pinned\n  server\n[…]\nclient cert CN (spoof-proof single-address pool), jump responder\n  + host initiator provisioning scripts. Config-shape tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS overlay: Overlay interface + strongSwan/IPsec provisioner",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:24:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0127d205253019987b1c6a70a105545797634323",
          "body": "…d end-to-end validation\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS docs: mark P3 (migration toolset) + P4 (docs/UI) complete; recor…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T23:00:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ad3d15574ed6bab9b1761ec88b2e324f45844cb9",
          "body": "Adds GET /api/v1/system/fips (admin-gated) mirroring `fleetctl fips check`, and a\nFIPS 140-3 Readiness card on the System Health page: module status, overlay, CA key\ntype, password-hash algorithms, MFA counts, and an overall ready/not-ready verdict\nwith green OK / amber NOT-FIPS chips. The card hides itself if the endpoint 404s.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS P4: FIPS readiness dashboard in System Health",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T22:57:39Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bd85ef9f454a2f85b4a202a286ea69c2386e1042",
          "body": "…isory\n\n- Login now transparently re-hashes an argon2id password to PBKDF2 on successful\n  verify under FIPS (best-effort; never blocks a valid login).\n- fleetctl fips flag-stale-passwords forces must_change_pw on local accounts still on\n  a non-FIPS hash (sweeps up accounts that never log in).\n- fleetctl fips check now reports TOTP/WebAuthn factor counts + advises re-registering\n  pre-FIPS EdDSA passkeys.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS M5: verify-then-upgrade-on-login + stale-password flag + MFA adv…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T22:54:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4b90f22fe0343826c9851662001b9ed2cc4a774a",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: reseal primitives (v2->v3 upgrade, idempotency, string round-trip)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T22:52:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f6631746e6c4c860ca440ebf6f9f15a28b00cf1d",
          "body": "The grype sidecar capped each scan at 5m (GRYPE_SCAN_TIMEOUT default) while the\nbackend waited 20m (FLEET_VULN_SCAN_TIMEOUT), and compose never overrode the scanner\ncap — so a host with a big package DB (e.g. an ML/CUDA box) always 504'd. Align the\nscanner default to 20m and expose GRYPE_SCAN_TIMEOUT in compose + .env.example.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.32.3 — Fix vuln-scan 504 timeout on large hosts",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T22:50:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "362adb9625ec57e0b147a9be86376bb868e0b2b1",
          "body": "…PBKDF2\n\nAdds ResealBytes/ResealString primitives (verify-before-overwrite) and per-subsystem\nResealSecrets: CA key, overlay CA key, notify (SMTP/PagerDuty/Opsgenie), LDAP/OIDC,\nand vault entries (in-place version update). fleetctl fips reseal-secrets orchestrates\nand reports counts; targets v3 unconditionally (run before flipping FLEET_FIPS_MODE).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS P3: fleetctl fips reseal-secrets — sweep all at-rest secrets to …",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T22:47:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6016dc0df93ed4c895455cc5bf881292b23625a0",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: untrack stray built fleetctl binary + gitignore cmd binaries",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:29:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bdf5fffbf4edc70525fc85bbe54f2415952de3c3",
          "body": "…P4 remaining\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS P4 docs: mark P2 overlay done; add OpenVPN operator config + P3/…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:28:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bd7a52e3bf53c5298862304c66e9551bd9ac1cb6",
          "body": "ca.go boot re-seal now triggers on secretbox.NeedsReseal (KDF-profile mismatch)\nrather than only IsLegacy, so a FIPS deployment with FLEET_REENCRYPT_SECRETS=true\nupgrades an argon2id CA-key envelope to PBKDF2. Still gated + verify-before-overwrite.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS M3: CA key auto-upgrades v2->v3 (PBKDF2) on boot under FIPS",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:26:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6bc014f014c52ec35db3d2f86dc7ec8812e2c866",
          "body": "…nsecure\n\n- notify/senders.go (SMTP implicit TLS) and auth/ldap.go (LDAP StartTLS): pin\n  MinVersion TLS 1.2 (FIPS floor; sensible default regardless).\n- fleet-enroll-agent: refuse -insecure when FLEET_FIPS_MODE is set (fail closed;\n  FIPS requires peer-cert verification), and pin MinVersion on the \n[…]\necret at-rest reseal primitive already present (secretbox v3/PBKDF2 envelope\n  + NeedsReseal); consumed by the P3 migration sweep.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS P1: pin outbound TLS MinVersion + fail closed on enroll-agent -i…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:24:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b112074e8cd0f59adee45b698b99b88e111bdc21",
          "body": "- server.go: construct overlay PKI + OpenVPN provisioner when FLEET_OVERLAY=openvpn;\n  EnsureCA on boot; pass overlay to enrollment.New (nil under WireGuard).\n- enrollment: enrollOpenVPN() provisions the tunnel (jump server + per-host X.509\n  client cert + ccd static IP + host install) in place of W\n[…]\nt port.\n- testfabric jumphost image: add openvpn + expose 1194/udp.\n\nBuilds + vets clean on go1.24; overlay/overlaypki tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS overlay: wire OpenVPN into server boot + enrollment path",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:19:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b21bd8d36cd8a3419e59f86e27f934d7ad38a504",
          "body": "- DR page crashed to blank on a single-instance primary: replicas was null and\n  the render did .length/.map on it. Frontend normalizes to []; backend\n  DBReplication returns []DRReplica{} instead of nil (no JSON null).\n- OIDC/LDAP/SAML settings cards hung on \"Loading...\" if their config fetch faile\n[…]\n  they now render an error + Retry (+ hard-refresh hint) instead of an infinite\n  spinner. Backend endpoints were already correct.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.32.2 — Fix blank DR page + stuck OIDC/LDAP/SAML settings",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:08:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9ebed9f36da9f24d9259ff90954f63ab43e7ec58",
          "body": "…cker)\n\nfeature/fips-mode P2 progress: overlaypki X.509 CA (ECDSA P-256), overlay\npackage (server/client/ccd config + jump/host provisioning scripts), migration\n0049. Full OpenVPN tunnel validated end-to-end in containers (mutual ECDSA cert\nauth, TLS1.3/AES-256-GCM/ECDHE-P256, ccd static per-host IP). Enrollment wiring\n+ boot wiring still pending.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "WIP: OpenVPN overlay (PKI + config/script generation, validated in Do…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T21:02:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2e38720ad3cc00c2cb4ede17d85a31f0c5030581",
          "body": "…er proxies)\n\nAdd an internet-exposure section covering NPM's Custom SSL certificate flow\n(PEM full-chain + unencrypted key, SAN must match FLEET_PUBLIC_URL, internal-CA\ntrust, manual renewal) plus the general reverse-proxy requirements (Caddy/nginx/\nTraefik/ingress: WebSockets, X-Forwarded-*, FLEET_TRUSTED_PROXIES, FLEET_PUBLIC_URL).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: how to use your own HTTPS certificate (custom cert in NPM + oth…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T12:42:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "32bef3d89e9afd5bf5d1c08a61916eea50c4f484",
          "body": "A scheduled scan-all-hosts failed hosts with \"scanner unreachable ... context\ndeadline exceeded (Client.Timeout exceeded while awaiting headers)\". Root cause:\nthe scheduler fans out up to 16 scans at once, but the grype-scanner ran a blocking\ngrype subprocess inside an async handler on a single uvic\n[…]\npose: expose GRYPE_SCAN_CONCURRENCY on the grype-scanner service\n\nDeploy: make redeploy-single (rebuilds grype-scanner + backend).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.32.1 — Fix: fleet-wide vulnerability scans timing out at the scanner",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T12:15:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f5f952f1b2b837711f177d4b3da2e99e41100fe8",
          "body": "Opt-in FIPS mode via FLEET_FIPS_MODE (default off; non-FIPS unchanged). Routes\nevery in-process crypto choice through a FIPS-approved profile inside Go 1.24's\nnative validated module.\n\n- Go 1.24 toolchain; module compiled in, runtime toggle (GODEBUG=fips140=on set by\n  the entrypoint in FIPS mode); \n[…]\n module\noff); FIPS-without-module refuses to start.\n\nDeferred: P2 OpenVPN overlay (infra) + P3 existing-install migration toolset.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "FIPS 140-3 crypto profile (opt-in, P0+P1) — feature/fips-mode",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T04:07:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "762aaf2cf8ce5e182d7672b85e2127c1ebe040f5",
          "body": "Lets a standby Fleet actually run against a read-only replica. On startup Fleet\nchecks pg_is_in_recovery(); if its DB is a replica it boots in standby mode —\nskips migrations, starts no background writers, and serves only a break-glass DR\nconsole. Promotion (token-gated) runs pg_promote() and the in\n[…]\nvalidated end-to-end against a real base-backup streaming replica\n- docs: updated Two-site warm standby unplanned-failover section\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.32.0 — Read-only DR standby mode (usable warm standby)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T02:22:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bb8245c75ed79c6464001b207d7ddd928e17ed8e",
          "body": "Admin-triggered failover/failback UI for running Fleet as two independent\ninstances (active primary + warm standby at a second site). Fleet reflects\nreplication/recovery state and triggers orchestration; it does not replicate the\nDB or move DNS itself (scope boundary documented).\n\n- migration 0048: \n[…]\nwarm standby\" runbook to docs/disaster-recovery.md\n  (replication, secret-parity checklist, host-reachability options, procedures)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.31.0 — Disaster Recovery console (two-site warm standby)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T01:55:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c4541e38a63b9f3bc6d8b33edb54b499ceac4272",
          "body": "Run a one-off shell command on one or many Linux hosts without authoring a\nplaybook, from a new Ad-hoc Command tab on Automation. Governed by the command\n-control policy (block/approval/flag evaluated per host before running) so it\ncan't bypass the interactive-session rules.\n\n- migration 0047: comma\n[…]\nontend: AdhocCommandPage (command box, host/group target, live output poll,\n  run history) as a third Automation tab (Command.Run)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.30.0 — Ad-hoc command runner (Linux)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T01:16:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d1ae547fd6e5abeefbe40bee54039555fd76d2ed",
          "body": "Rules match commands typed in interactive terminal sessions and flag / block /\napproval-gate them, scoped global or per host-group. Enforced at the relay,\nfully audited. Deterrent + audit trail, not a cryptographic guarantee (documented).\n\n- migration 0046: command_policies + command_approvals + Com\n[…]\n10-min waiver)\n- frontend: Command Control page (rules table, rule dialog, pending approvals) +\n  nav/route (CommandPolicy.Manage)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.29.0 — Command control (privileged-command policy)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:52:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e3a7a4c663155fa123313bbea151b1b70c4703cb",
          "body": "Search recorded terminal sessions for a string (\"who ran X, where, when\") from a\nnew Content search tab on Session Replay. Returns matching sessions with context\nsnippets that link to replay.\n\n- store.RecordingsForSearch: bounded recent recordings + session metadata\n- sessionsapi: GET /sessions/sear\n[…]\nith its own replay Drawer\n- unit tests for stripANSI + matchSnippets; snippet slicing hardened against\n  ToLower byte-offset drift\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.28.0 — Fleet-wide session content search",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:36:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3f00670117fb6a29df3eb5462affc09815229b8f",
          "body": "Edit remote text files in the Files browser: an Edit action opens the file in a\nmonospace editor and Save writes it back over the audited jump-host/SFTP path,\ntaking an automatic on-host backup (<name>.fleetbak-<ts>) and preserving mode.\n\n- sftp: GET /hosts/{id}/sftp/read + POST /hosts/{id}/sftp/wri\n[…]\nility class — SFTP already overwrites files; this is a nicer,\n  audited UX over it (distinct from the deferred raw command runner)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.27.0 — In-browser config-file editor",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:27:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3235e4a1358b9e3634a3c90b03e984d462f568ca",
          "body": "New read-only lifecycle view: API tokens expired/expiring/unused, vault\ncredentials overdue for rotation, aging user passwords, and aging CA keys —\nmetadata only, no secret material.\n\n- store.LifecycleReport aggregates 4 sources with explainable day thresholds\n- internal/lifecycle: GET /lifecycle/ex\n[…]\nion page + nav entry, status summary chips, ranked table\n- SQL validated against the migrated schema (EXPLAIN on all four queries)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.26.0 — Expiry & Rotation dashboard",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:21:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0ec20f47fb0e52d492effe041cabc2837c4513b7",
          "body": "Act on many selected hosts at once from the Hosts grid toolbar: run a vuln scan,\nrefresh facts, set/clear a maintenance window, or add/remove tags. Each reuses the\nexisting per-host operation + permission, and the server filters the selection to\nhosts the caller can access.\n\n- store: AddHostTag / Re\n[…]\nr\n- raw ad-hoc command runner deferred to the privileged-command-policy work so it\n  ships with enforcement rather than ungoverned\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.25.0 — Bulk host actions",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:12:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e42aba8e2d1021d35cff31fe6df5b75b6b5403b",
          "body": "The Create button required a target even for the fleet-wide vulndb kind (which\nhas no host/group), so it stayed disabled. Gate the target requirement on\nneedsTarget so vulndb schedules can be saved. Backend already handled it.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.24.5 — Fix: Vulnerability DB update schedule couldn't be created",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-20T00:03:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cbf3fc78baf5b26659e5e787da8f445e3978a585",
          "body": "Gate sign-in on client IP and cap concurrent sessions per user, enforced at\nsession creation across every login path (local, LDAP, OIDC, SAML) — a single\nchoke point so no IdP can bypass it. Idle/absolute timeouts already existed.\n\n- migration 0045 adds user_session_policies (per-user override table\n[…]\n(maintenance windows) in docs/CHANGELOG.md, which was\n  missed because the in-app bundle is generated from docs/ (git-ignored .ts)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.24.4 — Conditional access: IP allowlist + concurrent-session limits",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T23:56:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "388c8d026abfc0373c81d42be37548da37b1ee5a",
          "body": "Mark a host \"in maintenance\" so its offline / updates-pending / scan-failure\nsignals stop firing while it's being patched, rebooted, or otherwise taken down\non purpose. Suppresses monitor offline/recovered alerts and dashboard insights\nfor the host; health-checking, fact collection, and metrics keep\n[…]\n alerts\" (1/4/8/24h) + \"End maintenance\" in host details;\n  In-maintenance chip in the header and a \"maint\" chip on the Hosts grid\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.24.3 — Maintenance windows: silence a host's alerts while patching",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T23:37:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e5cbb74c118f3cc5f5a796913efe64279089ea63",
          "body": "… host\n\nRoot cause of \"hosts offline for minutes after make up-single\" on a single\ninstance: up -d --build recreates the jumphost container, tearing down the\nWireGuard overlay so every managed host must re-handshake before the monitor can\nreach it (leader election was already instant — proven by log\n[…]\ne code\ndeploys don't disrupt host connectivity. up-single (full stack incl. jumphost)\nnow warns about the overlay re-establishing.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add make redeploy-single: update app code without recreating the jump…",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T23:19:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e0c8bcc40228872dd77fb310d546fd06b0c49cc0",
          "body": "While not leader, the monitor reset its timer to the full interval each tick, so\nafter acquiring leadership (e.g. post-restart) the first sweep could be up to a\nwhole interval away — hosts stayed offline long after leadership settled. Poll\nevery 5s until leader, then sweep and reset to the interval, so the first sweep\nlands within ~5s of takeover. Complements v0.23.3's stranded-lock reclaim.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Monitor: poll for leadership every 5s, sweep promptly on taking over",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T22:33:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8932dd9758e9100ae067e79a6329900325092fd3",
          "body": "Two new schedule kinds:\n\n- vulnscan: recurring vuln scan on a host/group. The engine already handled it\n  (fireVulnScan → vuln.Run, which branches Linux/grype vs Windows/MSRC+third-party);\n  the handler just rejected the kind. Allow it + a Schedules UI option.\n- vulndb: fleet-wide CVE database refre\n[…]\nSchedules editor adds both kinds; the target picker is hidden for the\nnon-host-targeted vulndb; ScheduleInput kind union extended.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Scheduled vulnerability scans + CVE database updates",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T22:24:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f0395e5baf8afe8073dc1791fb43b1c59b9866af",
          "body": "A restart left hosts offline until Postgres reaped the old instance's dropped\nconnection (which held the leader advisory lock); the monitor only sweeps as\nleader. The v0.20.3 graceful release handled clean shutdowns, but SIGKILL/crash/\npre-fix outgoing versions still stranded the lock — the single-i\n[…]\nto the lease (~30s) vs minutes. Also stop_grace_period: 30s on the backend so the\nclean, instant handoff completes before SIGKILL.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Reclaim a stranded leader lock on startup (fast takeover after restart)",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T22:16:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1e4909d669d06717153e9f9b3e4ea6d0254ac5c4",
          "body": "…next sweep\n\nPending-updates counts and the Windows software inventory refresh hourly, so the\ndashboard can lag after patching a host. Add store.MarkHostFactsStale (NULLs\nupdates_checked_at), POST /hosts/{id}/refresh (Host.View + access), and a \"Refresh\nfacts\" button in host details. The monitor re-collects that host on its next sweep\n(within ~a minute) instead of waiting the hour.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Host details: \"Refresh facts\" to re-collect updates/inventory on the …",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T20:25:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3b10b11e7c2ec673619f6b5612bcbf1b527a891b",
          "body": "Extend Windows vuln scans past the Microsoft/MSRC surface to third-party apps.\n\n- internal/cpe: curated, precision-first DisplayName→CPE dictionary (~20 common\n  apps) + version normalization + CPE builder. Unit-tested. Unmapped apps are not\n  guessed (avoids misleading findings).\n- vulnscan/sbom.go\n[…]\n DB (online update + offline import) — no new CVE source.\n\nIncrement 2 of the third-party Windows CVE plan; completes the feature.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Windows third-party app CVE coverage: CPE mapping + grype SBOM",
          "author_name": "Keith L. Forbus",
          "author_login": "kforbus3",
          "committed_at": "2026-07-19T20:22:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 7,
      "commits_last_year": 348,
      "latest_release_at": "2026-07-23T23:58:59Z",
      "latest_release_tag": "v0.58.3",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 0.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 71,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/kforbus3/Fleet-Terminal",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/kforbus3/Fleet-Terminal",
          "is_deprecated": false,
          "latest_version": "v0.58.3",
          "repository_url": "https://github.com/kforbus3/Fleet-Terminal",
          "versions_count": 140,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-23T23:58:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "frontend/tsconfig.json"
      ],
      "toolchain_manifests": [
        "backend/go.mod",
        "sdk/go.mod",
        "terraform-provider-fleet/go.mod"
      ],
      "largest_source_bytes": 242617,
      "source_files_sampled": 460,
      "oversized_source_files": 4,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "backend/go.mod",
        "frontend/package.json",
        "sdk/go.mod",
        "terraform-provider-fleet/go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/coreos/go-oidc/v3",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.11.0"
        },
        {
          "name": "github.com/go-chi/chi/v5",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.1.0"
        },
        {
          "name": "github.com/go-chi/cors",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.1"
        },
        {
          "name": "github.com/go-ldap/ldap/v3",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.8"
        },
        {
          "name": "github.com/go-pdf/fpdf",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.0"
        },
        {
          "name": "github.com/go-sql-driver/mysql",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/go-webauthn/webauthn",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.11.2"
        },
        {
          "name": "github.com/golang-jwt/jwt/v5",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.3.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gorilla/websocket",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.3"
        },
        {
          "name": "github.com/hashicorp/yamux",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.2"
        },
        {
          "name": "github.com/jackc/pgx/v5",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.7.1"
        },
        {
          "name": "github.com/masterzen/winrm",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260407182533-5570be7f80cf"
        },
        {
          "name": "github.com/microsoft/go-mssqldb",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.2"
        },
        {
          "name": "github.com/pkg/sftp",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.13.10"
        },
        {
          "name": "github.com/pquerna/otp",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.5"
        },
        {
          "name": "github.com/russellhaering/gosaml2",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.10.0"
        },
        {
          "name": "github.com/russellhaering/goxmldsig",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/wwt/guac",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.2"
        },
        {
          "name": "go.mongodb.org/mongo-driver",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.17.1"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.54.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.29.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.29.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.29.0"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.41.0"
        },
        {
          "name": "golang.org/x/oauth2",
          "manifest": "backend/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.23.0"
        },
        {
          "name": "@codemirror/lang-yaml",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.1.3"
        },
        {
          "name": "@emotion/react",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^11.13.3"
        },
        {
          "name": "@emotion/styled",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^11.13.0"
        },
        {
          "name": "@fontsource/roboto",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.1.0"
        },
        {
          "name": "@mui/icons-material",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.1.6"
        },
        {
          "name": "@mui/material",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.1.6"
        },
        {
          "name": "@mui/x-data-grid",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^7.22.2"
        },
        {
          "name": "@tanstack/react-query",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.59.16"
        },
        {
          "name": "@types/guacamole-common-js",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.5.5"
        },
        {
          "name": "@uiw/react-codemirror",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.25.10"
        },
        {
          "name": "@xterm/addon-fit",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.10.0"
        },
        {
          "name": "@xterm/addon-search",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.15.0"
        },
        {
          "name": "@xterm/addon-web-links",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.11.0"
        },
        {
          "name": "@xterm/xterm",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.5.0"
        },
        {
          "name": "axios",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.7"
        },
        {
          "name": "guacamole-common-js",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.5.0"
        },
        {
          "name": "qrcode.react",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.2.0"
        },
        {
          "name": "react",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^18.3.1"
        },
        {
          "name": "react-dom",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^18.3.1"
        },
        {
          "name": "react-markdown",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^9.1.0"
        },
        {
          "name": "react-router-dom",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.27.0"
        },
        {
          "name": "remark-gfm",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.0.1"
        },
        {
          "name": "zustand",
          "manifest": "frontend/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.0.1"
        },
        {
          "name": "github.com/hashicorp/terraform-plugin-framework",
          "manifest": "terraform-provider-fleet/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.13.0"
        },
        {
          "name": "github.com/kforbus3/Fleet-Terminal/sdk",
          "manifest": "terraform-provider-fleet/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "kforbus3",
          "commits": 348,
          "avatar_url": "https://avatars.githubusercontent.com/u/123222302?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 4,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "71 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "81adcd56a5bf1be62eb3123316191d60fbf49ccb",
        "ran_at": "2026-07-25T02:09:05Z",
        "aggregate_score": 2.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T23:59:57Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/kforbus3/Fleet-Terminal",
    "host": "github.com",
    "name": "Fleet-Terminal",
    "owner": "kforbus3"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 48,
      "inputs": {
        "security": 27,
        "vitality": 75,
        "community": 33,
        "governance": 30,
        "engineering": 70
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 58,
            "inputs": {
              "commits_last_year": 348,
              "human_commit_share": 1,
              "days_since_last_push": 1,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "348 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 348
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 7,
              "latest_release_tag": "v0.58.3",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 0.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "7 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 30,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "critical",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 28,
            "inputs": {
              "followers": 0,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "kforbus3",
              "public_repos": 5,
              "account_age_days": 1280
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of kforbus3",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "kforbus3"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "5 public repos, account ~3 yr old",
                "points": 12.7,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 5
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/kforbus3/Fleet-Terminal"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "140 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 140
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 70,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "topics": [
                "devops",
                "golang",
                "pam",
                "privileged-access-management",
                "react",
                "security",
                "ssh"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "7 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 27,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 27,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 14,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 4,
              "scorecard_aggregate": 2.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "71 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 61,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 71,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "frontend/tsconfig.json"
              ],
              "agent_commit_share": 1,
              "toolchain_manifests": [
                "backend/go.mod",
                "sdk/go.mod",
                "terraform-provider-fleet/go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "frontend/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "frontend/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "100 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 242617,
              "source_files_sampled": 460,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/460 source files over 60KB",
                "points": 54.5,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 460,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Could not fetch go package 'github.com/fleet-terminal/backend' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T02:09:14.960164Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kforbus3/Fleet-Terminal.svg",
  "full_name": "kforbus3/Fleet-Terminal",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}