diff --git a/.env.example b/.env.example
index 911f8ce96..ba602fa2a 100644
--- a/.env.example
+++ b/.env.example
@@ -55,75 +55,3 @@ LOG_TO_FILE=true
# In Docker, also bind-mount the host path into the container at the same
# location (see docker-compose.yml for the matching volume snippet).
# BAMBUDDY_EXTERNAL_ROOTS=
-
-# Local-login recovery bypass (#1589) — set to "true" / "1" / "yes" to
-# accept username + password credentials on /auth/login (and to allow the
-# /auth/forgot-password flow) even when the in-app setting "Disable local
-# login" is turned on. This is the documented "SSO is broken, let me back
-# in" path for an operator whose only normal sign-in route is via OIDC.
-# /auth/advanced-auth/status also reports local_login_enabled=true while
-# this is set, so the login page shows the credentials form to match.
-# LDAP is governed by its own ldap_enabled toggle and is not affected.
-# Leave unset for normal operation.
-# BAMBUDDY_LOCAL_LOGIN=true
-
-# --- OIDC provider from the environment (#2593) ------------------------------
-# Defines ONE OIDC provider declaratively, for deployments that are managed by
-# compose files or GitOps and never touch the settings UI. Providers created in
-# the UI are unaffected and keep working alongside this one.
-#
-# Activates only when all four required vars below are set; an empty value
-# counts as unset. The provider is written on startup and re-applied on every
-# boot, so the UI shows it as read-only and the API refuses to change it -- an
-# edit there would be reverted at the next restart anyway.
-#
-# Removing the vars DISABLES the provider rather than deleting it: accounts
-# linked to it would otherwise lose their link permanently. Re-adding the vars
-# enables it again with those links intact.
-#
-# If you lock yourself out, BAMBUDDY_LOCAL_LOGIN=true above is the way back in.
-#
-# Required:
-# BAMBUDDY_OIDC_NAME=Keycloak
-# BAMBUDDY_OIDC_ISSUER_URL=https://sso.example.com/realms/main
-# BAMBUDDY_OIDC_CLIENT_ID=bambuddy
-# BAMBUDDY_OIDC_CLIENT_SECRET=your-client-secret
-#
-# Optional, shown with their defaults:
-# BAMBUDDY_OIDC_SCOPES=openid email profile
-# BAMBUDDY_OIDC_ENABLED=true
-# BAMBUDDY_OIDC_AUTO_CREATE_USERS=false
-# BAMBUDDY_OIDC_AUTO_LINK_EXISTING=false
-# BAMBUDDY_OIDC_EMAIL_CLAIM=email
-# BAMBUDDY_OIDC_REQUIRE_EMAIL_VERIFIED=true
-# BAMBUDDY_OIDC_ICON_URL=
-# BAMBUDDY_OIDC_AUTOLOGIN=false
-# BAMBUDDY_OIDC_DEFAULT_GROUP=
-#
-# Booleans accept true/1/yes or false/0/no (case-insensitive). Blank or unset
-# uses the default; any other value is rejected and the provider is skipped.
-#
-# DEFAULT_GROUP is the group new users land in when AUTO_CREATE_USERS is on;
-# without it they get Viewers. It matches a group NAME exactly (case-sensitive)
-# -- group ids are assigned per install, so the same compose file would point at
-# a different group on every deployment. A name that matches no group is
-# refused: the provider is left as it was and the reason is logged, rather than
-# quietly creating under-privileged users the locked UI could not correct. On a
-# FIRST boot that means no provider is created at all and no SSO button appears
-# -- create the group first. Removing the variable clears the group again.
-#
-# AUTO_LINK_EXISTING binds an OIDC identity to an existing local account with
-# the same email address. With EMAIL_CLAIM=email it is refused unless
-# REQUIRE_EMAIL_VERIFIED=true, because an identity provider that does not
-# verify addresses would let anyone claim someone else's account. The whole
-# config is then skipped and logged; the app still starts.
-#
-# ISSUER_URL must be https:// and publicly reachable -- private, loopback,
-# link-local, numeric-encoded and IPv4-mapped hosts are rejected. An in-cluster
-# URL like http://keycloak:8080 is refused with a single log line and no SSO
-# button; use the externally-reachable HTTPS issuer URL instead.
-#
-# NAME is matched against the existing providers on every boot: setting it to
-# the name of one you already created in the UI ADOPTS and OVERWRITES it (its
-# issuer, client id and secret are replaced and it becomes read-only). Pick a
-# name that doesn't collide unless that takeover is intended.
diff --git a/.github/scripts/ghcr_inject.py b/.github/scripts/ghcr_inject.py
deleted file mode 100644
index e5e38431d..000000000
--- a/.github/scripts/ghcr_inject.py
+++ /dev/null
@@ -1,328 +0,0 @@
-#!/usr/bin/env python3
-"""Inject GHCR container-download stats into the jgehrcke/github-repo-stats report.
-
-GHCR exposes a container's total + 30-day daily-pull series only in the
-package page HTML. There is no REST or GraphQL API for it. This script
-scrapes that page once per workflow run, merges the rolling 30-day window
-into a sidecar CSV on gh-pages, and re-injects a Vega-Lite chart at the
-top of ``latest-report/report.html``.
-
-Why the merge: each run only sees the last 30 days, but the CSV grows
-forever — days that fall off GitHub's 30-day window stay in the CSV
-because they were captured while in-window. Overlapping dates are
-overwritten on each run, so GitHub's late-arriving revisions to recent
-days self-correct.
-
-Hard-fails if either scrape pattern stops matching. Silent fallbacks
-would let the chart freeze at last-known-good and nobody would notice.
-"""
-
-from __future__ import annotations
-
-import argparse
-import csv
-import json
-import re
-import sys
-import urllib.request
-from datetime import datetime, timezone
-from pathlib import Path
-
-GHCR_URL = "https://github.com/{owner}/{pkg}/pkgs/container/{pkg}"
-USER_AGENT = "Mozilla/5.0 (X11; Linux x86_64) bambuddy-stats"
-
-TOTAL_RE = re.compile(
- r'Total downloads\s*
\n"
- if toc_anchor not in html:
- raise RuntimeError("report.html: TOC anchor not found; layout drift?")
- html = html.replace(toc_anchor, toc_anchor + toc_block, 1)
-
- section_anchor = "\n"
- if section_anchor not in html:
- raise RuntimeError("report.html: section anchor () not found; layout drift?")
- html = html.replace(section_anchor, section_anchor + section_block, 1)
-
- script_anchor = "\n"
- if script_anchor not in html:
- raise RuntimeError("report.html: script anchor () not found; layout drift?")
- html = html.replace(script_anchor, script_block + script_anchor, 1)
-
- report_path.write_text(html, encoding="utf-8")
-
-
-def main() -> int:
- parser = argparse.ArgumentParser()
- parser.add_argument("--report", required=True, type=Path)
- parser.add_argument("--csv", required=True, type=Path)
- parser.add_argument("--owner", required=True)
- parser.add_argument("--pkg", required=True)
- parser.add_argument(
- "--ghcr-cache",
- type=Path,
- default=None,
- help="Read GHCR HTML from a local file instead of fetching. For local dry-runs only.",
- )
- args = parser.parse_args()
-
- if not args.report.exists():
- print(f"::error::report not found: {args.report}", file=sys.stderr)
- return 1
-
- if args.ghcr_cache:
- html = args.ghcr_cache.read_text(encoding="utf-8")
- print(f"Loaded cached GHCR HTML: {args.ghcr_cache} ({len(html):,} bytes)")
- else:
- html = fetch_ghcr(args.owner, args.pkg)
- print(f"Fetched GHCR page: {len(html):,} bytes")
-
- cumulative, cumulative_display = parse_total(html)
- fresh_daily = parse_daily(html)
- print(f"Cumulative pulls: {cumulative:,} ({cumulative_display})")
- print(f"Fresh days from sparkline: {len(fresh_daily)}")
-
- merged = merge_csv(args.csv, fresh_daily)
- write_csv(args.csv, merged)
- print(f"Merged CSV rows: {len(merged)} -> {args.csv}")
-
- spec = build_vega_spec(merged)
- fetched_at = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
- patch_report(
- args.report,
- spec,
- cumulative,
- cumulative_display,
- fetched_at,
- args.owner,
- args.pkg,
- )
- print(f"Patched: {args.report}")
- return 0
-
-
-if __name__ == "__main__":
- raise SystemExit(main())
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f2b9cc8b..a474ee856 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,10 +42,7 @@ jobs:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install ruff
- # Install the exact pin from requirements-dev.txt rather than the latest
- # release, so CI and contributors run the same linter. `pip install ruff`
- # silently drifted ahead of every local venv.
- run: pip install "$(grep -E '^ruff==' requirements-dev.txt)"
+ run: pip install ruff
- name: Run ruff check
run: ruff check backend/
@@ -68,10 +65,7 @@ jobs:
- name: Install dependencies
run: |
- # Upgrade setuptools too: the runner's Python toolcache ships an old
- # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0).
- # A fix exists, so we upgrade rather than --ignore-vuln.
- python -m pip install --upgrade pip setuptools
+ python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pip-audit
@@ -201,47 +195,15 @@ jobs:
if path and not info.get('dev') and not info.get('devOptional'):
prod.add(path.split('node_modules/')[-1])
vulns = data.get('vulnerabilities', {})
- # Documented advisory exceptions: high/critical findings whose only offered
- # 'fix' is a semver-major change and which do not apply to how Bambuddy ships.
- # Keyed by GHSA id. An entry only holds while the fix stays major-only (see
- # fix_is_major below) - once upstream backports, the gate fails until we take
- # the patch. That is what retired the one entry this list used to carry:
- # GHSA-qwww-vcr4-c8h2 (React Router RSC-mode CSRF) shipped in 7.18.2, so the
- # pin moved rather than the exception staying.
- ALLOWLIST = set()
- def advisory_ids(name, seen=None):
- seen = seen if seen is not None else set()
- if name in seen:
- return set()
- seen.add(name)
- ids = set()
- for item in vulns.get(name, {}).get('via', []):
- if isinstance(item, dict):
- url = item.get('url', '')
- if '/advisories/' in url:
- ids.add(url.rsplit('/', 1)[-1])
- elif isinstance(item, str):
- ids |= advisory_ids(item, seen)
- return ids
- def fix_is_major(v):
- fa = v.get('fixAvailable')
- return isinstance(fa, dict) and fa.get('isSemVerMajor')
- def exempt(name, v):
- ids = advisory_ids(name)
- return bool(ids) and ids <= ALLOWLIST and fix_is_major(v)
fixable = {n: v for n, v in vulns.items()
- if n in prod and v.get('severity') in ('high', 'critical')
- and v.get('fixAvailable') and not exempt(n, v)}
+ if n in prod and v.get('severity') in ('high', 'critical') and v.get('fixAvailable')}
skipped = len(vulns) - len({n: v for n, v in vulns.items() if n in prod})
if fixable:
for name, v in fixable.items():
print(f'FIXABLE {v[\"severity\"].upper()}: {name}')
sys.exit(1)
total = sum(1 for n, v in vulns.items() if n in prod and v.get('severity') in ('high', 'critical'))
- exempted = sorted(n for n, v in vulns.items() if n in prod and exempt(n, v))
print(f'npm audit: {total} high/critical (0 fixable), {len(vulns)} total ({skipped} npm-internal filtered)')
- if exempted:
- print('exempted (documented, unreachable): ' + ', '.join(exempted))
"
frontend-typecheck:
diff --git a/.github/workflows/cleanup-ghcr.yml b/.github/workflows/cleanup-ghcr.yml
index 393af552e..4cc22554a 100644
--- a/.github/workflows/cleanup-ghcr.yml
+++ b/.github/workflows/cleanup-ghcr.yml
@@ -31,7 +31,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- package: [bambuddy]
+ package: [bambuddy, bambuddy-beta]
steps:
- name: Cleanup ${{ matrix.package }}
env:
diff --git a/.github/workflows/repo-stats.yml b/.github/workflows/repo-stats.yml
index 53dca9db9..f805363c5 100644
--- a/.github/workflows/repo-stats.yml
+++ b/.github/workflows/repo-stats.yml
@@ -19,48 +19,3 @@ jobs:
repository: maziggy/bambuddy
ghtoken: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
ghpagesprefix: https://maziggy.github.io/bambuddy
-
- # Inject ghcr.io container-download stats (cumulative + 30-day
- # sparkline merged into a sidecar CSV so the chart grows beyond
- # the 30-day window GHCR exposes). Runs after jgehrcke regenerates
- # report.html on gh-pages.
- - name: checkout-source
- uses: actions/checkout@v4
- with:
- path: source
-
- # jgehrcke/github-repo-stats commits to the `github-repo-stats`
- # branch by default (NOT gh-pages — Pages is configured to serve
- # from that branch). Direct git clone with the PAT surfaces real
- # git stderr if anything fails, unlike actions/checkout@v4 which
- # swallows errors as opaque "exit code 1".
- - name: checkout-data-branch
- env:
- GH_PAT: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
- run: |
- git clone --branch github-repo-stats --depth 1 \
- "https://x-access-token:${GH_PAT}@github.com/${{ github.repository }}.git" \
- data
- cd data
- git config user.name "github-actions[bot]"
- git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
- - name: inject-ghcr-pulls
- run: |
- python3 source/.github/scripts/ghcr_inject.py \
- --report data/maziggy/bambuddy/latest-report/report.html \
- --csv data/maziggy/bambuddy/ghcr-pulls.csv \
- --owner maziggy \
- --pkg bambuddy
-
- - name: commit-and-push
- working-directory: data
- run: |
- if [ -z "$(git status --porcelain)" ]; then
- echo "no changes — skipping commit"
- exit 0
- fi
- git add maziggy/bambuddy/latest-report/report.html \
- maziggy/bambuddy/ghcr-pulls.csv
- git commit -m "ghcr-pulls: refresh container downloads chart"
- git push
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 0a330a1c0..41b07f726 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -125,10 +125,7 @@ jobs:
- name: Install dependencies
run: |
- # Upgrade setuptools too: the runner's Python toolcache ships an old
- # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0).
- # A fix exists, so we upgrade rather than --ignore-vuln.
- python -m pip install --upgrade pip setuptools
+ python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pip-audit
@@ -308,46 +305,13 @@ jobs:
}
}
const vulns = results.vulnerabilities || {};
- // Documented advisory exceptions (keyed by GHSA id) - see ci.yml for the
- // full rationale and the matching hard gate. GHSA-qwww-vcr4-c8h2: React
- // Router RSC-mode CSRF, not reachable from Bambuddy's BrowserRouter SPA
- // (@react-router/server not installed); react-router/-dom pinned to 7.18.1
- // (the most-patched 7.x), no non-major fix exists. Auto-surfaces again if a
- // non-major fix ships.
- const ALLOWLIST = new Set(['GHSA-qwww-vcr4-c8h2']);
- function advisoryIds(name, seen) {
- seen = seen || new Set();
- if (seen.has(name)) return new Set();
- seen.add(name);
- const ids = new Set();
- for (const item of (vulns[name] || {}).via || []) {
- if (item && typeof item === 'object') {
- const url = item.url || '';
- if (url.includes('/advisories/')) ids.add(url.split('/').pop());
- } else if (typeof item === 'string') {
- for (const id of advisoryIds(item, seen)) ids.add(id);
- }
- }
- return ids;
- }
- function fixIsMajor(info) {
- const fa = info.fixAvailable;
- return fa && typeof fa === 'object' && fa.isSemVerMajor;
- }
- function exempt(name, info) {
- const ids = advisoryIds(name);
- return ids.size > 0 && [...ids].every(id => ALLOWLIST.has(id)) && fixIsMajor(info);
- }
const filtered = {};
- const flagged = {};
for (const [name, info] of Object.entries(vulns)) {
- if (!prodDeps.has(name)) continue;
- filtered[name] = info;
- if (!exempt(name, info)) flagged[name] = info;
+ if (prodDeps.has(name)) filtered[name] = info;
}
results.vulnerabilities = filtered;
fs.writeFileSync('npm-audit-results.json', JSON.stringify(results, null, 2));
- const count = Object.keys(flagged).length;
+ const count = Object.keys(filtered).length;
console.log(count > 0
? count + ' production vulnerabilities found'
: 'No production vulnerabilities (filtered ' + Object.keys(vulns).length + ' npm-internal entries)');
diff --git a/.github/workflows/windows-installer.yml b/.github/workflows/windows-installer.yml
deleted file mode 100644
index 682118c1e..000000000
--- a/.github/workflows/windows-installer.yml
+++ /dev/null
@@ -1,182 +0,0 @@
-name: Windows Installer
-
-# Build the Windows installer .exe.
-#
-# Triggers:
-# - Tag push matching v* (release builds, uploaded as a release asset)
-# - Manual dispatch (for testing the build pipeline)
-#
-# Release tags are Authenticode-signed through the SignPath Foundation OSS
-# program. Daily prereleases are deliberately left unsigned so they don't burn
-# the OSS signing quota; use the `sign` dispatch input to exercise the signing
-# path by hand.
-
-on:
- push:
- tags:
- - 'v*'
- workflow_dispatch:
- inputs:
- sign:
- description: 'Submit the installer to SignPath for signing'
- type: boolean
- default: false
-
-# Least-privilege per CodeQL actions/missing-workflow-permissions.
-# contents: write is required by softprops/action-gh-release to attach
-# the .exe to a tag release; the manual-dispatch path doesn't trigger
-# that step and could run with read-only, but a single workflow-level
-# block keeps the surface auditable in one place.
-# actions: read lets the SignPath connector download the uploaded artifact
-# through the API. Declaring a permissions block at all drops every scope we
-# don't name to `none`, so the signing step fails to fetch the artifact
-# without it.
-permissions:
- contents: write
- actions: read
-
-jobs:
- build:
- runs-on: windows-latest
- timeout-minutes: 30
-
- env:
- # Sign real release tags but not `-daily.` prereleases, and let a manual
- # run opt in. GitHub's `||` returns the *last* operand when everything is
- # falsy (an empty string here, not `false`), so every use site compares
- # against the string 'true' rather than treating this as a boolean.
- SIGN: ${{ (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-daily.')) || inputs.sign }}
-
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Setup Python
- uses: actions/setup-python@v5
- with:
- python-version: '3.13'
-
- - name: Setup Node.js
- uses: actions/setup-node@v4
- with:
- node-version: '22'
-
- # Inno Setup 6.x is pre-installed on windows-latest runners (under
- # C:\Program Files (x86)\Inno Setup 6\). No install step needed.
-
- - name: Stage installer artifacts
- working-directory: installers/windows
- run: python build.py
- shell: pwsh
-
- - name: Compile installer (ISCC)
- working-directory: installers/windows
- run: |
- & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" bambuddy.iss
- shell: pwsh
-
- # SignPath signs a *GitHub artifact*, not a workspace path: the connector
- # pulls the artifact back out through the API, which is why this upload
- # has to happen before signing and why upload-artifact must be v4 or newer
- # (older versions expose no `artifact-id` output). Kept as a separate,
- # clearly-named artifact so an unsigned build is never mistaken for a
- # signed one when downloading from the run page.
- - name: Upload unsigned installer
- id: upload_unsigned
- uses: actions/upload-artifact@v7
- with:
- name: bambuddy-windows-installer-unsigned
- path: installers/windows/build/output/*.exe
- if-no-files-found: error
-
- # The artifact arrives at SignPath as a .zip (that is simply what
- # upload-artifact produces), so the artifact configuration on the SignPath
- # side describes a wrapping the . With skip-decompress
- # left at its default the signed archive is extracted again here, so
- # `signed/` ends up holding the bare .exe.
- - name: Sign installer (SignPath)
- if: env.SIGN == 'true'
- uses: signpath/github-action-submit-signing-request@v2
- with:
- api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
- # Not a credential -- the organization ID appears in ordinary SignPath
- # URLs and is useless without the API token above.
- organization-id: '4d7e5b59-d0fb-4a6b-b385-b861e18c6386'
- project-slug: 'bambuddy'
- signing-policy-slug: 'test-signing'
- github-artifact-id: ${{ steps.upload_unsigned.outputs.artifact-id }}
- wait-for-completion: true
- output-artifact-directory: installers/windows/build/signed
-
- # Replace the unsigned binary in-place so every downstream step (alias,
- # artifact upload, release attachment) keeps working off one directory and
- # cannot accidentally publish the unsigned copy.
- - name: Promote signed installer
- if: env.SIGN == 'true'
- shell: pwsh
- working-directory: installers/windows/build
- run: |
- $signed = @(Get-ChildItem -Path signed -Filter *.exe)
- if ($signed.Count -ne 1) {
- throw "expected exactly one signed .exe, found $($signed.Count)"
- }
- Move-Item -Force $signed[0].FullName (Join-Path output $signed[0].Name)
- Write-Host "promoted signed installer: $($signed[0].Name)"
-
- # Fail loudly rather than shipping an unsigned .exe under a signed
- # release. The test certificate is self-signed, so Windows reports the
- # signature as untrusted (`UnknownError`) -- that is expected and is not
- # what this checks. Only the absence of a signature is treated as a
- # failure; swap in a stricter assertion once the production certificate
- # is imported.
- - name: Verify signature
- if: env.SIGN == 'true'
- shell: pwsh
- working-directory: installers/windows/build/output
- run: |
- Get-ChildItem -Filter *.exe | ForEach-Object {
- $sig = Get-AuthenticodeSignature $_.FullName
- if ($sig.Status -eq 'NotSigned') {
- throw "$($_.Name) carries no Authenticode signature"
- }
- Write-Host "$($_.Name): $($sig.Status) / $($sig.SignerCertificate.Subject)"
- }
-
- # Stable + beta tag releases (e.g. v0.2.5b1, v0.3.0) get an unversioned
- # copy alongside the versioned filename so external surfaces (website,
- # wiki, newsletters) can link to a stable URL that survives version
- # bumps:
- #
- # https://github.com/maziggy/bambuddy/releases/latest/download/bambuddy-windows-x64-setup.exe
- #
- # GitHub's `latest` redirect excludes prereleases, so this URL always
- # points at whatever was released as a full release. Daily prereleases
- # are excluded from the alias because (a) the unversioned name would be
- # semantically confusing next to the date-stamped versioned name on a
- # daily prerelease page, and (b) there's no stable "latest daily" URL
- # anyway (`latest` skips prereleases), so the alias adds no value there.
- #
- # Runs after signing so the alias is a copy of the *signed* binary.
- - name: Create unversioned alias (non-daily tags only)
- if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-daily.')
- shell: pwsh
- working-directory: installers/windows/build/output
- run: |
- $versioned = Get-ChildItem -Filter "bambuddy-*-windows-x64-setup.exe" | Select-Object -First 1
- if (-not $versioned) { throw "no versioned installer .exe found" }
- Copy-Item $versioned.FullName "bambuddy-windows-x64-setup.exe"
- Write-Host "alias: bambuddy-windows-x64-setup.exe -> $($versioned.Name)"
-
- - name: Upload installer artifact
- uses: actions/upload-artifact@v7
- with:
- name: bambuddy-windows-installer
- path: installers/windows/build/output/*.exe
- if-no-files-found: error
-
- - name: Attach installer to release
- if: startsWith(github.ref, 'refs/tags/v')
- uses: softprops/action-gh-release@v2
- with:
- files: installers/windows/build/output/*.exe
- fail_on_unmatched_files: true
diff --git a/.gitignore b/.gitignore
index 72b114b1f..a33d1b645 100644
--- a/.gitignore
+++ b/.gitignore
@@ -90,8 +90,3 @@ advertisements/
gitleaks-report.json
scripts/pip-audit.sh
-
-security/
-
-test_pipeline_archive_source.3mf
-test_pipeline_run_1.3mf
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9bd706032..2bd17ff7b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -30,9 +30,7 @@ repos:
exclude: ^(static/|frontend/tsconfig\.)
- id: check-added-large-files
args: ['--maxkb=1000']
- # CHANGELOG.md is intentionally large (detailed per-release entries over
- # many versions); exempt it while keeping the 1 MB guard for everything else.
- exclude: ^(static/assets/|CHANGELOG\.md$)
+ exclude: ^static/assets/
- id: check-merge-conflict
- id: debug-statements
- id: detect-private-key
diff --git a/BACKERS.md b/BACKERS.md
index bfba0e1a6..efd4ed06f 100644
--- a/BACKERS.md
+++ b/BACKERS.md
@@ -13,7 +13,7 @@ If you sponsor and your name isn't here within 48h, please write an email to mar
## Corporate Sponsors ($300/mo+)
-- [@northpole3dprinting](https://github.com/northpole3dprinting)
+*None yet — be the first. Your logo on the bambuddy.cool homepage and press.html, plus co-marketing.*
## Sustaining Sponsors ($150/mo+)
@@ -24,20 +24,15 @@ If you sponsor and your name isn't here within 48h, please write an email to mar
- [@VREmma](https://github.com/VREmma)
- [@pwostran](https://github.com/pwostran)
- [@Praxeis](https://github.com/Praxeis)
-- [@jmclaren7](https://github.com/jmclaren7)
-- [@RoBoT24-web](https://github.com/RoBoT24-web)
-- [@Rayvenhaus](https://github.com/Rayvenhaus)
-- [@TheUltimateC0der](https://github.com/TheUltimateC0der)
-- [@rstocks](https://github.com/rstocks)
## Supporters ($15/mo+)
- [@rewart01](https://github.com/rewart01)
+- [@rstocks](https://github.com/rstocks)
- [@sixfootseven](https://github.com/sixfootseven)
- [@MethodicalMartian](https://github.com/MethodicalMartian)
+- [@jmclaren7](https://github.com/jmclaren7)
- [@brianharwell](https://github.com/brianharwell)
-- [@shosier01](https://github.com/shosier01)
-- [@freifunk-bamberg](https://github.com/freifunk-bamberg)
## Backers ($5/mo+)
@@ -54,24 +49,6 @@ If you sponsor and your name isn't here within 48h, please write an email to mar
- [@Geoff-S](https://github.com/Geoff-S)
- [@andyspinball](https://github.com/andyspinball
- [@avandeputte](https://github.com/avandeputte)
-- [@joeferrante](https://github.com/joeferrante)
-- [@GPop61](https://github.com)
-- [@CooleyMcCoolson](https://github.com/CooleyMcCoolson)
-- [@mikeloveridge](https://github.com/mikeloveridge)
-- [@boernie](https://github.com/boernie)
-- [@qoatzelcoat](https://github.com/qoatzelcoat)
-- [@Sanaki](https://github.com/Sanaki)
-- [@jlofshult](https://github.com/jlofshult)
-- [@TriadX1](https://github.com/TriadX1)
-- [@hazzardr](https://github.com/hazzardr)
-- [@Shihchiun](https://github.com/Shihchiun)
-- [@kycrna](https://github.com/kycrna)
-- [@iljur](https://github.com/iljur)
-- [@bhamiltoncx](https://github.com/bhamiltoncx)
-- [@g7ufo](https://github.com/g7ufo)
-- [@Heidelberger2000](https://github.com/Heidelberger2000)
-- [@MorganMLGman](https://github.com/MorganMLGman)
-
---
## One-time and historical supporters
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9453c0be..987fc386b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,434 +2,6 @@
All notable changes to Bambuddy will be documented in this file.
-## [1.2.5.2] - 2026-08-02
-
-### Added
-- **The print queue now shows when each job would finish (#2736, contributor @mpl1337)** — A queue row carried a job's print duration but not the clock time that maps to, so "if I start this one now, when is it done?" meant doing the arithmetic yourself, once per row — while the card for the running print has shown an ETA all along. Pending and staged rows now show one too, beside the duration, in your configured 12/24-hour format and styled to match the live one. It is deliberately a per-job answer and not a forecast of the whole queue: "start this now and it finishes at 14:30", not a projection of everything ahead of it. That only means anything for a job that could actually start now, so the ETA appears on exactly those. A job sits behind whatever is printing on its printer, and behind anything the scheduler would dispatch ahead of it — resolved in the same order the scheduler itself uses, including **Shortest Job First** when that is on — and stays quiet until it is genuinely next up, so three jobs stacked on one printer no longer quote the same finishing time three times over. Staged jobs are the exception in both directions: the scheduler skips them without claiming the printer, so they neither hold up the job behind them nor wait for it, and they show an ETA whenever their printer is free — which is the honest answer to "what happens if I press Start". Jobs scheduled for later, jobs blocked with a stated reason, jobs conditional on an earlier print succeeding, and jobs with no duration in their metadata show nothing at all. The time also keeps up with the clock instead of freezing at the moment the page was opened, and every row on screen is measured from the same instant, so two rows are always comparable. Frontend-only. Translated in all locales; wiki updated. Covered by frontend tests.
-- **Keep the AMS slots the slicer picked (#2700, contributor @Striker72rus)** — Bambu Studio and OrcaSlicer resolve which physical AMS tray feeds each filament themselves, right before sending. Bambuddy threw that away: a queue-mode virtual printer worked the mapping out again at dispatch time, from the filament type and colour baked into the 3MF. That is usually the better answer — it is computed against the printer's live trays and it respects **Prefer lowest filament** and the AMS-backup gate that goes with it — but it has nothing to go on when the match isn't unique. Two spools of the same red PLA, and the slot you deliberately chose in the slicer is a coin toss. A new per-virtual-printer **Save AMS mapping** toggle keeps the slicer's pick instead: the print dispatches to exactly those trays, and the mapping is stored on the archive so a reprint can reuse the same physical spools — a **Mapping** button in the print modal selects every slot from it in one click, and the archive card and queue row say so. Because a tray number only means something on the AMS it was resolved against, the mapping records its printer and is only ever offered on that same printer; a model-based ("Any [model]") virtual printer has no fixed printer and is unaffected. Off by default, so nothing changes for existing virtual printers until you turn it on, and **Force color match** still wins for the print being dispatched when both are on. Translated in all locales; wiki updated. Covered by backend and frontend tests.
-- **P2S/X2D accessory fans: left auxiliary cooling and chamber exhaust (#2691, contributor @gzimbric, requested in #2660)** — The P2S and X2D have two fans Bambuddy could not show or drive. The **left auxiliary part cooling fan** had no tile and no control at all, because the printer only reports it inside its air-duct data and never in the ordinary fan fields Bambuddy was reading. The **chamber exhaust fan** had the opposite problem: its tile appeared on every P2S whether or not the fan was fitted, so owners of a base machine had a control that did nothing. Both are add-on kits on the P2S and fitted at the factory on the X2D. Both tiles now appear only when the printer itself reports the hardware, so a base P2S looks exactly as it does today and a kitted one gains the fans it actually has. The left auxiliary fan is set from the same speed popover as the others, and the enclosure fan is labelled **Exhaust** on the P2S and X2D — matching the printer's own screen and Bambu Studio — while every other enclosed model keeps **Chamber Fan**. The confirmation message after changing a speed uses the same name as the tile that was clicked. The four tiles are ordered part cooling, left auxiliary, auxiliary, exhaust, so they read left to right in the same order as the physical fans. Both fields are also published through the status endpoint, the WebSocket feed and the MQTT relay, so external automations can read them. Translated in all locales; wiki updated. Covered by backend and frontend tests, including the case where the printer sends a partial fan report — a tile must not disappear mid-print just because one update didn't mention it.
-- **Live print progress in the browser tab (#2693, contributor @Chachigo, requested in #1041)** — Watching a print meant keeping the Bambuddy tab in view, or switching back to it every few minutes. Enable **Print progress in tab** under Settings → Appearance and the tab title becomes `42% · Bambuddy` while the favicon turns into a progress ring in your theme accent colour, both updating live over the WebSocket the rest of the UI already uses. With several printers running, the tab follows the one finishing soonest, tie-broken by highest progress; title and favicon return to their defaults as soon as nothing is printing or the toggle goes off. Off by default, and stored per browser (like the light/dark toggle) so a wall-mounted dashboard and a laptop can each have their own setting. Translated in all locales; wiki updated. Covered by frontend tests.
-- **Telegram notifications can target a forum topic (#1518, reporter @vmhomelab)** — Telegram groups with Topics enabled always received Bambuddy's notifications in the **General** topic, because only Bot Token and Chat ID were configurable. Getting a per-printer split therefore meant creating a separate chat per printer. The Telegram provider now takes an optional **Forum Topic ID** — the last number in a topic's link (`t.me/c/1234567890/25`) — and routes its messages into that topic, so a single group can carry one topic per printer. Left empty, the behaviour is unchanged. The ID is sent on both the plain-text and the thumbnail code paths, and is validated as a number in the form and again server-side, so a typo is reported instead of silently breaking only text notifications. Translated in all locales; wiki updated. Covered by backend and frontend tests.
-- **Support bundles now record Bambuddy's own memory, threads and child processes (#2734)** — A bundle described everything except the thing it runs in. That made reports of memory climbing over days impossible to act on: the numbers that identify what is actually growing only exist while it is happening, and by the time anyone asked, the container had been restarted. Bundles now carry resident and virtual memory, thread count, child processes by name, open files and sockets, process uptime, and a census of live objects by type. Those figures separate causes that look identical from outside — a large virtual size against a modest resident one is address space rather than data, a rising thread count points somewhere quite different from a rising child-process count, and the object census names what a growing heap is filling up with. The object census is skipped on processes already above 2 GB, because walking the heap costs most on exactly the process that can least afford it; everything else is still collected. Child processes are recorded by executable name only — an ffmpeg command line carries the camera URL and its password. Collection happens off the main loop and every metric is best-effort, so a hardened kernel or restricted container that refuses one of them still produces a complete bundle.
-- **Folder rows in the File Manager now show when anything inside them last changed (#2680 follow-up, reporter @cadtoolbox)** — The calendar toggle only put dates on the file pane, so the folder tree had no way to show the timestamp it was already sorting on. Folders now render that value under their name whenever the toggle is on, nested folders included. It is labelled **last activity** rather than "last modified" deliberately: the value is the newest timestamp among the folder, its files and everything below it, so a folder can legitimately read as newer than its own directory mtime — calling that "modified" would look like a fresh instance of the `ls -lt` mismatch the issue was originally about. Folders with no activity render nothing rather than an `Invalid Date` placeholder. Frontend-only — the field was already on the wire from the sort fix. Covered by frontend tests.
-
-### Changed
-- **Debug logs now record what the printer reports between the last layer and the end of a print (#2547, reporter @anthonyma94)** — The finish photo wants a moment that Bambu firmware does not obviously announce: printing done, toolhead parked, filament unload not yet started. Bambuddy has been driving that capture from `stg_cur=22` ("Filament unloading"), which turns out to fire on no model at all — across 247 support bundles there is not a single stage-22 capture, including the window in which it was the only trigger in the code, where all 104 captures on A1, A1 Mini, H2C, H2D, P1S, P2S, X1C and X2D fell through to the after-the-fact fallback. Choosing a replacement was not possible from the bundles we had, because outside `stg_cur` and `mc_print_sub_stage` every stage and action field the printers send is dropped unread, and the most promising candidates (`print_real_action`, `mc_action`, `mc_stage`) are absent from A1, A1 Mini and P1S payloads entirely. With debug logging enabled, Bambuddy now dumps those raw fields for the window between the last object layer and the end of the print — opening on the first end-of-print signal (last layer reached, progress at 99+, or no remaining time), logging only what changed frame to frame, and closing on the state transition — so a single debug bundle per model can show whether any firmware marks that moment. Diagnostics only: nothing reads these values, they are printer telemetry with nothing identifying in them, and at normal log levels the probe does no work at all. Covered by tests for the window boundaries, the frame budget and the guarantee that the probe cannot break status ingest.
-
-### Fixed
-- **Bambu Cloud sign-in with a TOTP (authenticator app) account always failed with "Invalid code" (#2696, reporter @cmerkle)** — Every TOTP verification was rejected regardless of the code. Bambu Lab added double-submit CSRF protection to the `bambulab.com` web origin, which is where — and only where — Bambuddy posts the two-factor code; the endpoint refused the request with `403 CSRF error: missing_cookie` **before evaluating the code at all**, and Bambuddy surfaced that as "Invalid code". Reproduced against the live endpoint with a deliberately invalid key: a bare POST returns `missing_cookie`, `GET /api/csrf` mints a `bbl_csrf_token` cookie, a POST carrying only that cookie returns `missing_header`, and a POST carrying the cookie plus an `x-bbl-csrf-token` header reaches application logic. Bambuddy now performs that handshake before submitting the code. Note that landing on the sign-in page first — the intuitive fix — does **not** work: that page sets only Cloudflare's `__cf_bm`. **Also fixed:** a CSRF refusal no longer masquerades as a wrong code; it now says the code was never checked, so nobody else loses an evening to clock drift and leading-zero theories. Only TOTP sign-ins were affected — every other cloud call, including the email-code two-factor path, goes to `api.bambulab.com`, which is not gated, and existing stored tokens kept working throughout. Covered by tests that pin the exact header name and the origin used per region.
-- **A2L AMS filament showed as "?" in Bambu Studio through the Virtual Printer, and manual filament picks reverted (#2697, reporter @qoatzelcoat)** — Every slot of the A2L's AMS Lite rendered as an empty question mark in the slicer's Device tab while Bambuddy's own AMS card showed type, colour and spool correctly; setting a filament by hand in Studio held for a second and then snapped back to "?". **Root cause.** The A2L reports its AMS Lite as physical unit id 16, but packs the slots' presence bits at bit base 24 — so Bambuddy normalises the id to 6 at the MQTT ingest boundary and every internal reader gets the right bits. The Virtual Printer's bridge, however, parses the printer's raw payload itself (by design — the slicer-facing cache has to keep the physical ids, since Bambu Studio addresses the Lite as 16) and so still held id 16 when it ran the shared empty-slot cleanup. That cleanup read bits 64-67, where nothing is ever set, concluded all four slots were empty and wiped `tray_type`, `tray_color`, `tray_info_idx` and the RFID fields from the copy sent to the slicer — once per second, which is also why a manual pick could not survive. **Fix.** The presence-bit helper now folds the physical id 16 onto the same bit base as the normalised 6, so it computes bits 24-27 whichever id reaches it; the cached ids the slicer sees are left untouched. Only the A2L was affected — every other AMS type already reached the helper with an id whose bit base was correct, and Bambuddy's own printer card was correct throughout. Confirmed against the reporter's debug log, which shows the cleanup clearing slots at bits 64-67. Covered by tests pinning the bit base for both ids and a bridge-level regression test built from the reporter's capture.
-- **The Settings page no longer reverts settings changed from anywhere else (#2716, reporter @jmoore-skild)** — While the Settings page was open it held its own copy of every setting and only ever took one from the server, on first load. A background effect then compared that copy against the server's and saved the whole thing back on any difference — with no way to tell "the user edited this field" from "this field changed on the server". So anything written while the page sat open was silently undone: a change made in a second tab, another user's change on a shared install, a restore from a backup. It needed no click to trigger. The page's data goes stale after a minute and refreshes when the window regains focus, and around thirty other places in the app read the same settings, so a refresh from any of them was enough — after which the page wrote its page-load copy back over all 77 settings it manages, and showed **Settings saved** while doing it. The page now keeps track of the last server state it reconciled with. A field still matching that state has not been touched, so a newer value from the server is adopted and displayed; a field the user has edited keeps their value and is saved over the top, so the newer of the two writes wins either way. Typing into a text field while a refresh lands is still safe, which is what the old behaviour was protecting. Covered by frontend tests.
-- **A rejected K-profile write is now reported as rejected (#2718, reporter @jmoore-skild)** — Saving a K-profile was fire-and-forget: Bambuddy published the command and reported success the moment the bytes left the process. The printer does answer, and the answer was received, matched, and thrown away at debug level — so a write the printer refused for a real reason still told you it was saved. The complication was that the answer itself was wrong: on single-nozzle printers it came back `result: "fail", reason: "invalid tray_id"` on writes that demonstrably applied, which made gating on it look impossible. Measuring against an X1C and an H2D found the cause — the `tray_id: -1` Bambuddy itself put in the payload. The X1C's firmware validates that field and rejects the value while applying the write anyway; the H2D ignores it. Sending `0`, as BambuStudio does, makes the acknowledgement honest, and the printer echoes back the sequence number we sent, so it can be matched to the write that caused it. Saving or deleting a profile now waits for that answer and surfaces a genuine rejection as an error instead of a success toast. A printer that stays silent is still treated as success — no answer is not evidence of refusal. The acknowledgement is also logged at INFO now, so it appears in a support bundle. Covered by backend tests.
-- **The K-profile flow type is a real choice again** — On most printers the calibration table comes back with no nozzle identity at all, and Bambuddy had started showing "Not reported by printer" in the Flow Type field as a result. That is not a value you can save, and it isn't what the slicer does: BambuStudio treats a missing nozzle identity as **Standard** and leaves the choice editable. Bambuddy now does the same. The field is hidden only on models sold with a single nozzle variant — the A1, A1 Mini and A2L — using the same rule the slicer applies. This is not the single-versus-dual-nozzle split: the P1P, P1S, P2S, X1, X1 Carbon, X1E and H2S are all single-nozzle and all offer both flows. Editing a profile also no longer strips the nozzle identity from what it writes back.
-- **Dialogs no longer act after they have closed** — The AMS slot configuration and K-Profile dialogs hold their success state briefly and then close themselves, between 1.5 and 4 seconds after the command is sent so the printer has time to process it. That timer ran whether or not the dialog was still open, so dismissing it — or the printer card refreshing underneath it — within that window left a pending close that fired later, dismissing whatever dialog happened to be open by then. The deferred close is now cancelled when the dialog goes away. Covered by frontend tests.
-- **A printer with no K-profiles can now be given its first one (#2719, reporter @jmoore-skild)** — **Add K-Profile** built its Filament dropdown out of the profiles already on the printer, so on a printer with none the field was empty, required, and impossible to satisfy — the modal even said so, telling you to go and create the profile in Bambu Studio instead. The filament picker is now populated the way every other one in Bambuddy is, in the same order: **Imported** presets first, then **Orca Cloud**, then **Bambu Cloud**, then Bambuddy's built-in Bambu filament table. That last tier is compiled in, so the list is never empty — a brand-new printer with no cloud account and nothing imported still gets you a profile. The per-printer-model copies a cloud account carries ("Bambu PLA Basic" once for the X1C, once for the P1S, once for the A1) are collapsed into a single row, and the built-in table — a static copy of the same Bambu catalogue — no longer echoes back filaments the groups above already list. Your imported and Orca Cloud libraries are both shown in full even where they overlap by name, because they are usually the same profiles reached two ways and each group is worth seeing under its own heading. The picker is a searchable list with the source heading shown as a real, legible group header — a native dropdown can't do that, since browsers render the group label of a `