- Journal pane now distinguishes 'no entries' from 'no journal access':
journalctl exits 0 with empty output when the agent's user simply can't
see the target's entries (demo mode / user-run agents), explaining
itself only on stderr. The agent forwards that hint as an additive
JournalResponse.notice and the client renders it with practical advice.
Verified E2E via a stub journalctl emulating the unprivileged case.
- Version 1.60.0 across all crates (1.51 would read fine, but the repo's
scheme is 1.40/1.50/…, and a literal 1.6.0 would sort BELOW 1.50.0 in
semver). All user-facing version strings already come from
CARGO_PKG_VERSION — a stale binary was the only way to see an old one.
- scripts/install.sh: build-from-source install/upgrade for the test
fleet (Linux + macOS). Detects in-repo checkouts, installs rustup when
missing, replaces a systemd socktop-agent service binary in place and
restarts it, requires system protoc on riscv64.
- build.rs (agent + connector): fall back to $PROTOC / PATH when
protoc-bin-vendored has no binary for the host (riscv64) — native SBC
builds previously panicked in the build script.
- CHANGELOG.md covering v1.50.0 -> 1.60.0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- socktop, socktop_agent, socktop_connector -> 1.51.0.
- socktop_wasm_test and zellij_socktop_plugin consume the in-repo
connector via path deps so wasm-feature API drift is caught at PR time
instead of after publish. Immediately proved out: the wasm requests
module needed the new sampled_at_ms field, invisible to native builds.
- zellij plugin gains the standalone [workspace] marker (it could not be
cargo-checked in-tree at all before). NOTE: its lib.rs has pre-existing
compile errors unrelated to the connector (static mut STATE conflicts
with register_plugin!, missing BTreeMap import) — needs its own rework,
out of scope here.
- README: sampled_at_ms in the example payload.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Security: with --verify-hostname off (the default), the old NoVerify
verifier accepted ANY server certificate — the CA loaded from --tls-ca
was never consulted, so the documented pinning was a no-op and the
connection was trivially MITM-able. Replace it with PinnedCertVerifier:
the presented end-entity cert must be byte-identical to a cert in the
--tls-ca file (any cert in a multi-cert PEM matches, supporting
rotation). Signature validation now uses the ring provider's full
algorithm set instead of a hardcoded 3-scheme list. Empty PEM files
fail fast instead of failing closed per-handshake.
The --verify-hostname path is unchanged (WebPki root-store validation).
Also: the third argument of connect_async_tls_with_config is
tungstenite's disable_nagle flag, not a verification toggle — we were
passing verify_hostname there, leaving Nagle ON for default users. Pass
true unconditionally, and disable Nagle on the plain ws:// path too;
socktop exchanges small request/response frames where Nagle only adds
latency.
Client now consumes the connector via a dual path+version dep so these
fixes are in local builds and CI before the crates.io publish (cargo
strips the path on publish). Connector version -> 1.51.0.
Verified E2E: agent A's cert connects to agent A; agent B's cert
against agent A fails the handshake (the rpi-worker-1 wrong-PEM
scenario); --verify-hostname against a 127.0.0.1 SAN still connects.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Delete socktop_connector/src/connector.rs: orphaned since 08f248c removed
'pub mod connector;' during the modularization refactor. Never compiled
(verified under default, wasm, and workspace feature combos) but shipped
in the crates.io tarball and contained an outdated copy of the TLS
verifier — a trap for anyone patching the pinning bug in the dead copy.
- Delete empty socktop/src/ws.rs, tracked editor backup ui/.modal.rs.backup,
and stray test_thiserror.rs at the repo root.
- Delete the two LEGACY #[allow(dead_code)] process input handlers; the
header-click render test now exercises the live _with_selection handler
instead (better coverage of the real path).
- Drop unused sysinfo dependency from the socktop client.
- Replace stale 'temporarily increased for testing' comment on
COMPRESSION_THRESHOLD (it already held the production value).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three panes painted two independent pieces of text onto one row with nothing
reserving space between them, so below roughly 105 columns the right-hand piece
was simply drawn over the tail of the left one:
socktop — host: cachyos-gaming | 🔒✗ TLS | (a: about⏱ 500ms metrics | 2000ms
The width arithmetic used str::len(), a byte count, so the emoji in these strings
overstated their width and left orphaned glyphs at the right edge as well. The
process table had the same problem in a different form: it handed the layout
solver a fixed, over-constrained column set, so a narrow pane crushed the
percentage-sized Name column to nothing while fixed-width PID and Mem % kept
their full width — losing the one field that identifies a process.
Add ui::fit (measure in terminal columns, truncate on character boundaries, pick
the richest wording that fits) and give each pane a priority ladder:
- Header: drop the key hints, then the TLS/token badges, then the
"socktop — host:" prefix, then the metrics/procs words, and only then shorten
the hostname. Hostname and intervals are what survive longest.
- CPU pane: drop the "CPU Temp:" label, then the now:/avg: labels, then the
average, then the temperature's decimal, and the temperature itself last — a
thermal warning outranks a second decimal place.
- Process table: Name is unconditional; CPU %, then Mem, then PID, then Mem %
are added as the pane widens, so Mem % is the first to go and Name the last.
Also fixes sort-header clicks, which resolved against a Layout that omitted the
column spacing the Table renders with, so a click landed off by up to four
columns. Covered by a test that clicks each label where it is actually drawn.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Resolves all five open Dependabot alerts (GHSA-9f94-5g5w-gf6r,
GHSA-394x-vwmw-crm3, GHSA-hfpc-8r3f-gw53, GHSA-65p9-r9h6-22vj,
GHSA-vw5v-4f2q-w9xf) by moving aws-lc-sys from 0.33.0 to 0.42.0.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* chore: update ratatui from 0.28 to 0.30
* style: cargo fmt
* fix: replace manual zero-guarded divisions with checked_div
* fix: collapse nested if into match guard
* style: cargo fmt
* bump crossterm and optimize various types, remove stale code.
* fix windows build
* only show parent level processes on main tui
This check in offers alpha support for per process metrics, you can view threads, process CPU usage over time, IO, memory, CPU time, parent process, command, uptime and journal entries. This is unfinished but all major functionality is available and I wanted to make it available to feedback and testing.
non functional update:
- refactor stream of consciousness into separate files.
- combine equivelent functions used in networking and wasm features.
- cleanups and version bumps.
Related to: Usage as a lib #8
1. feature gating of TLS and other features not supported with WASM.
2. updated documentation.
3. creation of AI slop WASM example for verification.
- socktop connector allows you to communicate with socktop agent directly from you code without needing to implement the agent API directly.
- will also be used for non tui implementation of "socktop collector" in the future.
- moved to rust 2024 to take advantage of some new features that helped with refactor.
- fixed everything that exploded with update.
- added rust docs for lib.
jasonwitty
jason