Command palette: rebuild the nav list from a role-gated table so every
navigable page (Docker, Terminal, WireGuard, Commands, Security posture,
Updates, Certificates, Uptime, Alerts, Threats) appears with a role-gated
"g <key>" chord. The help panel is derived from the resulting list, so a
gated-out page has neither an entry nor a live shortcut (no 403 dead-end).
New chords k/t/w/c/p/u/r/a resolve via nav.find; no collision with the
hardcoded CMDK_GO map (d/s/i/f/l/e/y/v).
Scrollbars: add a .no-scrollbar utility and apply it to the server-detail
tab strip and the sidebar nav, so macOS "always show scroll bars" no longer
paints a permanent track where nothing overflows.
Threats KPIs: replace the orphaned 5-box row with a 4-box even grid of the
count metrics + a full-width Top-Attacker spotlight card (an IP, not a count).
serviceAction: a start/restart can EXIT 0 (systemd accepted the request) yet
the unit dies on launch (e.g. monit crashing on a bad config) -> is-active
reports failed. Verify the real post-action state and, when the unit did not
come up, report failure WITH the reason (systemctl status tail) so the
operator sees why instead of a false "gestartet". Harden all three systemctl
calls against argument injection: unit must start alphanumeric, passed after
`--` and escapeshellarg'd (Codex-reviewed, clean).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Restructure the navigation so host-level tools are grouped separately and
the host vs per-server split is explicit.
Sidebar — three groups instead of two:
• Flotte: Dashboard, Servers, Services, Commands, Files, Audit
• Host: Docker, Terminal, WireGuard, System, Security posture, Patch,
Certificates, Uptime (things that act on the Clusev host)
• Konto: Settings, Alerts, Threats, Versions, Release, Help
Docker & Terminal are now split by target:
• Sidebar Docker = the CLUSEV HOST's containers; sidebar Terminal = the
host shell. Both admin-only (manage-fleet, route + mount guarded) — the
control-plane machine, same bar the host shell already used.
• Per-server Docker + Terminal move to the server-details page as tabs
(Übersicht | Docker | Terminal, ?tab= deep-linkable). New lean
components Servers\ServerDocker + Servers\ServerTerminal; the metrics
poll is suppressed off the overview tab. Viewing a server's containers
is open to any role; actions/logs/shell require operate.
Also: Docker\Index + Terminal\Index reduced to host-only (no target
toggle / server rail); ServerDocker checks credential()->exists() (the
withExists attribute does not survive Livewire hydration); container rows
drop the noisy port list. Docs at ~/clusev-site updated to match; a
.gitignore guard keeps the separate marketing site out of this repo.
Tests: Docker/Terminal component + RBAC gate tests reworked for the split;
new ServerDockerTest + ServerTerminalTest. 747 pass. R12-verified in a
browser (3-group sidebar, host Docker/Terminal, server tabs switch, real
per-server containers, zero console errors).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
boban