Developer-Dashboard
view release on metacpan or search on metacpan
- Add a regression assertion and record the reproduced outer-handoff failure
and successful Docker tmux attach.
5.86 2026-10-11
- Problem 46: make Docker workspace startup build-free by default; lowercase
`-c -d` starts a stopped workspace with `up -d workspace`.
- Add uppercase `-C` as an explicit cached-build opt-in and stream Compose
build progress directly to the terminal; never rebuild a running service.
- Keep Docker tmux attached through a real TTY and select a writable socket
directory when the container's `/tmp` bind mount is not writable.
- Add parser, help, completion, orchestration, build-output, and tmux
regressions and update the Problem 46 operator documentation.
5.85 2026-10-11
- Problem 46: make the Docker workspace handoff allocate a TTY and pass the
terminal streams through directly so tmux can attach interactively.
- Let workspace and ticket tmux commands honor TMUX_TMPDIR and select
writable /dev/shm when a container's /tmp bind mount is not writable, so
later commands reconnect to the same tmux server.
- Add container-backed regressions and document the reproduced permission
failure, root cause, terminal behavior, and verification flow.
5.84 2026-10-10
- Problem 47: fix the Docker Hub publication timeout by avoiding a second
full test-suite run under QEMU for each target architecture. Full suite and
coverage gates remain mandatory before publication; install the checked-out
tarball with cpanm --notest in the runtime image.
- Add a red-first workflow contract test for this install policy and document
the distinction between release verification and image assembly.
5.83 2026-10-10
- Problem 46 regression: reuse an already-running Docker workspace service
without rebuilding the container or risking in-container progress.
- When the service is stopped, start it with cached `up -d --build` and never
disable Docker's build cache; abort visibly if its running state is unknown.
- Add Docker regression tests for running, stopped, cache, and failed-probe
paths; document the workspace lifecycle and verification procedure.
5.82 2026-10-10
- Problem 46 regression: isolate the in-container workspace path alias in an
owner-only `/dev/shm` config overlay so bind-mounted host aliases are not
overwritten.
- Reject symlinked config overlays and test that the host path remains
unchanged while the container-side alias resolves to /workspace.
- Problem 47 Scorecard follow-up: pin the multi-platform Ubuntu base image by
digest so the Docker Hub build has immutable container inputs.
- Add a regression assertion for the base-image digest and document the
immutable image dependency contract.
5.81 2026-10-10
- Problem 47: add a GitHub Actions Docker Hub build for current master source.
- Run install.sh, build a fresh Dist::Zilla archive, and install/test that
exact archive so the image does not ship an older MetaCPAN copy.
- Publish versioned and latest tags for linux/amd64 and linux/arm64 using
pinned workflow actions and configured Docker Hub credentials.
- Document the master-source build and Apple Silicon/Linux arm64 behavior.
5.80 2026-10-10
- Reissue Problem 46 verification with final 5.79 blank-container install
and image-version evidence, and record the outstanding repository-level
Scorecard gates separately from the implementation results.
5.79 2026-10-10
- Reissue Problem 46's distribution with the completed problem report.
Runtime behavior is unchanged from 5.78; this version is required because
the 5.78 image build has already been recorded today.
- Preserve the ordered Docker workspace startup, alias registration, and
in-container workspace behavior with both help and completion forms.
5.78 2026-10-10
- Problem 46: add `d2 workspace -c <alias> --docker` and the `-d` shorthand
for running a normal tmux workspace inside a configured Compose service.
- Start the `workspace` service first, add the alias at `/workspace` in the
container, then start the inner workspace; stop with an actionable error
before subsequent commands if any earlier stage fails.
- Preserve the existing local tmux flow without Docker mode; document and
complete help and shell option completion for both Docker spellings.
5.77 2026-10-09
- Finalize Problem 45's report and package evidence after the 5.76 runtime
image and blank-container installation/integration checks passed.
- Keep the source README/POD, problem reports, changelog, and release version
aligned in the final distribution archive.
5.76 2026-10-09
- Problem 45: add Docker-style -t timestamps and -f follow mode to dashboard
logs, including combined web/collector output, all collectors, and a named
collector; keep --tail N, --tail=N, and -n N composable across the views.
- Keep collector record timestamps when available; timestamp web log lines at
read time because the persisted web log does not store per-line event time.
- Route `dashboard serve logs` through the shared parser and update help,
shell-completion metadata, README/POD, and integration documentation.
- Add follow, timestamp, mixed-source, and coverage-closure regressions.
5.75 2026-10-09
- Finalize Problem 45's 5.75 package and runtime image after the 5.74 image
version was consumed; keep the Docker-style log tail implementation and
its completed verification report aligned in the final artifacts.
5.74 2026-10-09
- Problem 45: add Docker-style --tail N and --tail=N limits to dashboard logs.
- Apply the line limit to combined web/collector output and scoped log views;
retain -n as a compatible alias and reject malformed or negative counts.
- Cover the public CLI, zero-line handling, invalid input, and command help
with Docker-executed regressions; document the behavior in the manual.
5.73 2026-10-08
- Problem 38: normalize captured merged Docker Compose YAML to valid UTF-8,
preserving valid UTF-8 and converting isolated Windows-1252 bytes before
the temporary file is consumed by config, up, down, build, ps, logs, or
other Compose operations.
- Add Docker regression coverage for the malformed-byte producer case and
verify the normalized merged YAML parses while preserving the pound sign.
- Make the nav I/O-failure test assert that its blocked layer contributes no
entries while allowing other active runtime layers to contribute nav.
5.56 2026-10-06
- Problem 37: use a cron collector's scheduler heartbeat for watchdog stall
detection instead of treating the quiet time between scheduled executions
as repeated collector failures.
- Add a Docker regression proving a live cron loop awaiting its 7–8am run
does not raise the watchdog's repeated-restart warning at 10pm.
- Problem 34 follow-up: route public Docker Compose operations through the
materializing runner instead of directly executing the unresolved file list.
- Keep the merged file alive until Compose exits and preserve streamed output
for build, up, down, and other operational commands.
5.54 2026-10-05
- Problem 34 follow-up: keep the invocation Compose project directory when
layered files are materialized for build, up, down, and other operations.
- Preserve an explicit user-supplied --project-directory, reject malformed
Compose arguments before execution, and cover up, build, and down in Docker.
5.53 2026-10-03
- Implement Problem 25's external skill-help passthrough and Problem 36's
layered skill-command completion, with regression coverage for both.
- Rebuild the project Docker image from a flattened local base after the
previous base image exceeded the overlay mount-option limit.
- Pass the complete D2 test suite (258 files / 22,403 tests) and the 5.53
blank-environment integration run with tests enabled.
- Keep the internal/external CLI help boundary and layered skill completion
regressions covered in the test suite.
5.52 2026-10-03
- Problem 25 follow-up: keep help handling within internal CLI dispatch and
pass native help flags through to dotted external skill commands.
- Problem 36: merge dotted skill completion names across project and home
runtime layers while de-duplicating shared commands.
- Add Docker regression coverage for external CLI help passthrough and
layered project/home skill command completion.
5.51 2026-10-03
- Problem 25 follow-up: keep help handling within internal CLI dispatch and
pass native help flags through to dotted external skill commands.
- Add a Docker regression fixture for `d2 tira.tasklist.prune --help` and
document the internal-versus-skill help ownership boundary.
5.50 2026-10-03
- Problem 35: configure Dist::Zilla's UploadToCPAN releaser so an explicit `dzil release`
has a real PAUSE upload action; keep the upload separate from `dzil build`
and document that credentials belong outside the repository.
- Add a release metadata regression test for the configured Releaser plugin.
5.49 2026-10-03
- Problem 12, 32, 33, and 34 delivery follow-up: publish the final Docker,
coverage, package-build, and blank-container integration evidence in the
numbered problem report.
- Refresh the release archive to include the completed problem status index.
5.48 2026-10-03
- Problem 12 follow-up: normalize dotted workspace refs consistently for
tmux session lookup and creation, and reuse a duplicate session only after
verifying the tagged logical workspace owner.
- Problem 32: separate path aliases from command completion and bound cdr
candidates to direct children, narrowing one directory per entered term.
- Problem 33: add regression coverage confirming an unregistered leading
cdr word remains a search term and participates in completion narrowing.
- Problem 34: use invocation-directory Compose files as the base project and
restrict automatic runtime service merging to services declared there.
- Add Docker regression and complete statement, branch, condition, and
subroutine coverage verification for the affected library.
5.47 2026-10-03
- Problem 34: use invocation-directory Compose files as the local project
base and limit automatic runtime service overlays to declared local
services; keep explicit service selection and no-local-base discovery
behavior intact.
- Add Problem 33 regressions proving an unregistered first cdr argument
remains a search term for both target resolution and later TAB narrowing.
- Problem 12 follow-up: map dotted workspaces to tmux's underscore-normalized
session names, check existing session ownership, and confirm duplicate
create races before reuse.
- Problem 32: keep path aliases out of root command completion, offer them
beside tmux sessions for `workspace`, and restrict initial `cdr` TAB
candidates and subsequent narrowing to one directory level per term to
avoid recursive tree scans.
- Add regression tests for completion namespaces, direct-child cdr listing,
and concurrent workspace session creation; synchronize docs and POD.
5.46 2026-10-03
- Align the main manual with the blank-environment integration behavior:
plain cpanm runs the distribution tests, then installed d2 version and
delegated grep/Compose help are verified against the archive.
- Rebuild the final release artifact and Docker image after documenting the
selected-home marker rule and installed short-entrypoint regression gate.
5.45 2026-10-03
- Strengthen blank-environment release verification through the installed
d2 entrypoint: compare its version with the tarball, verify delegated grep
help, and preserve native Docker Compose config/help arguments.
- Record explicit Problem 31 coverage that all Docker marker creation uses
the selected home runtime while marker discovery/removal spans active
service layers.
5.44 2026-10-03
claimed in a working column that has stopped moving, and one left untouched in
the backlog.
- Coverage gate: refuses to grade a database written by a different
Devel::Cover install, and says which two disagree, instead of exiting with an
unexplained status.
4.25 2026-08-09
- CI: restored a pipeline that had certified nothing for ten days. Three
GitHub Action pins sat on the node20 line while their version comments
claimed node24, so every run died at Setup Perl and the suite, the coverage
gate and both CVE audits never executed (DD-449). The pin comments are now
resolved against the upstream tag rather than trusted (DD-449), the
environment export no longer swallows its own failure inside a command
substitution (DD-483), and two suite files no longer assume tools and
libraries CI installs elsewhere (DD-485).
- Security: helper session ids are drawn from the operating system CSPRNG
instead of a SHA over the pid, the wall-clock second and built-in rand -
the construction CVE-2026-13577 describes in Dancer2, reimplemented here in
the code guarding the web interface. Crypt::URandom is now a declared
dependency floored at 0.55, because CVE-2026-2474 affects earlier releases
(DD-452).
- Security: dispositioned CVE-2026-13577 for Dancer2, which has no fixed
release, behind a guard that fails the audit if any production code ever
activates a Dancer2 session (DD-451).
- Security: closed a Zip Slip in dashboard open-file, where a sources jar
could write attacker-controlled paths anywhere the user can write (DD-498).
- Security: corrected the CVE gate's subject so it judges the product's
declared chain rather than the host interpreter (DD-499).
- Fix: a collector's loop state is written before its pidfile, so a
concurrent running_loops can no longer delete the pidfile of a healthy loop
and leave it unstoppable by name while the supervisor forks a duplicate
(DD-488).
- Fix: Housekeeper's temp-file cleanup lists its directory instead of
globbing a pattern built from the path, so a directory whose path contains
a space stops hiding every real temp file and unlinking unrelated ones
(DD-502).
- Test reliability: the coverage gate, the empty-environ probe and several
collector lifecycle fixtures no longer fail purely because the host is
CPU-starved, which is the shape of every CI runner (DD-482, DD-486,
DD-489). Every timeout changed here is backed by a measurement rather than
by the fact that a larger number passes.
4.24 2026-08-08
- Security: closed the open-redirect class in the login redirect sanitizer
and on both HTTPS-enforcement Host-header redirect paths (DD-415, DD-419),
rather than only the single reported byte.
- Security: closed three path-traversal classes - saved-page writes outside
the dashboards root (DD-395), parent-directory traversal in every
skill-namespaced web route with static-file containment asserted (DD-416),
and skill installs whose repo name escapes the skills root (DD-426).
- Security: every page-derived value the web layer places inside an HTML
attribute is now escaped for attribute context (DD-421), and saved
bookmark link segments are percent-encoded for URL context (DD-423).
- Security: state-changing requests are rejected when Origin or Referer is
foreign, on every web tier (DD-422).
- Security: the transient-token denial now depends on the token alone, so a
file value riding along can no longer bypass the 403 (DD-425).
- Security: release tarballs no longer carry dogfood QA evidence, ticket
worktrees (DD-414), or the Hermes runtime state root and its credentials
(DD-432).
- Feature: first-class self-upgrade - dashboard upgrade and d2 upgrade run
the canonical platform installer (DD-386).
- Feature: a real /favicon.ico is served instead of a 404 on every page
load (DD-407).
- Collectors: a timed-out command's full process subtree is terminated
(DD-388); blocked Windows command collectors are interrupted at their
timeout (DD-389); the atomic writer uses a per-process pending name so
concurrent workers stop clobbering each other (DD-418); log append and
rotation share a per-log lock (DD-399) and rotation cuts on entry
boundaries so a combined lines+days rule cannot orphan an entry body
(DD-427); collectors keep running when the updates directory is absent
(DD-398).
- Runtime: saved-Ajax disconnect cleanup terminates descendant processes
(DD-396) and gives them a real elapsed SIGTERM grace window (DD-428);
runtime state readers survive a transient empty state file (DD-411) and
the web lifecycle no longer acts on incomplete runtime state (DD-412).
- Windows: the SSL certificate home resolves through PathRegistry so the
HTTPS server starts (DD-417); every passwd lookup is guarded so
non-interactive sessions resolve a user and a home (DD-413); PERL5LIB
generation is cross-platform (DD-397); PowerShell startup caches are
anchored to the home layer and no longer clobber live PATH state
(DD-390).
- Web UI: every generated HTML document carries a lang attribute (DD-405);
logout and an authorized /login route by trust tier (DD-408); page-editor
textareas carry programmatic accessible names (DD-409); rendered page
chrome no longer overflows 320px phone viewports (DD-410).
- Performance: PathRegistry working-directory lookups no longer fork
/bin/pwd repeatedly (DD-393).
- Gates: the POD syntax gate reads the source tree instead of a stale copy
and the three reds it was hiding are fixed (DD-429); the coverage gate
grades lib/ instead of the stale build tree (DD-431) and a failed exec in
the harness process can no longer blind it (DD-428); the Windows
collector-timeout E2E is proven on a real QEMU Windows guest and made
repeatable (DD-404).
- Metadata: MakeMaker license metadata aligned with MIT (DD-400).
4.23 2026-07-29
- Coverage: every module under lib/ now reaches 100.0 on all four
Devel::Cover metrics - statement, subroutine, branch, AND condition -
driven by the new per-module hermetic coverage suites (t/59 through
t/106) with genuinely-unreachable outcomes annotated inline and dead
guard operands removed where redundancy caused unreachable branches.
- CI: all three workflows (test, release-github, release-cpan) enforce the
all-metric standard through script/check-all-metric-coverage, which
fails closed on any metric below 100.0 or any malformed report
(t/107-all-metric-coverage-gate.t).
- Security: helper host-trust no longer accepts arbitrary Host headers
that merely resolve to loopback, closing a DNS-rebinding vector; exact
loopback literals and configured alias hosts remain trusted.
- Test isolation: the fresh-runtime API assertions in
t/15-cli-module-coverage.t now chdir into their isolated HOME so a
dev-runtime layer in the working checkout cannot capture their writes.
- Installability: the dependency hardening initially raised the Perl floor
to 5.44, which cpanm rejects on every mainstream perl (perl:latest is
5.42); the floor is restored to 5.38 (the code's real requirement) while
CI continues to run on Perl 5.44 and the dependency version pins keep
the security gate.
( run in 0.795 second using v1.01-cache-2.11-cpan-3f962061493 )