Conversation
API: new scan, script, and snapshot handlers with expanded host routes
UI: scanner template editor, environment host form, scan stop hook,
improved host pages, vulnerability widgets, and scan status updates
Engine: Dockerfile and startup script refinements
Infra: docker-compose dev config updates, gitignore cleanup
Cleanup: remove obsolete SDK summary and monitoring task files
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove network_mode: host and extra_hosts from sirius-engine in dev compose. The base compose already defines bridge networking with explicit port mapping (5174, 50051). Host mode on macOS Docker Desktop binds ports inside the Linux VM, making them unreachable from the Mac host. Bridge mode with port mapping allows native agents to connect to localhost:50051. ICMP probes still work via cap_add: NET_RAW. Co-authored-by: Cursor <cursoragent@cursor.com>
- Delete host-old.tsx (replaced by host/[ip].tsx) - Delete HostVulnerabilities.tsx (consolidated into HostOverview) - Delete AgentTemplatesTab.complex.tsx and .new.tsx (unused variants) - Delete scanner/general/ directory (CallbacksTab, CustomScriptsTab, EngineSettingsTab, GeneralScannerSettings, ScanTypesTab) - Delete ScannerNavigation.tsx, NmapSettingsTab.tsx, RustScanScannerSettings.tsx (superseded by v4 scanner redesign) - Delete logging_middleware.go (replaced by structured logging) Co-authored-by: Cursor <cursoragent@cursor.com>
API (sirius-api): - Expand scan handler with sub-scan support and improved orchestration - Refactor host, vulnerability, and statistics handlers - Update agent template and script handlers with structured logging - Improve RabbitMQ service integration - Update route definitions for new scan endpoints Infrastructure: - Improve engine startup script with enhanced health checks Documentation: - Add scanner architecture docs (data flow, sub-scans, host dedup) - Add logging conventions guide - Update scanner README and documentation index Co-authored-by: Cursor <cursoragent@cursor.com>
…ages Comprehensive UI modernization applying the v4 dark-first, operator-grade design language across all primary pages. Dashboard: - Redesign security score gauge, vulnerability trend chart - Add recent activity timeline and top vulnerable hosts widget - Modernize dashboard page layout with hero cards Scanner: - Rework scanner page with profile selector and scan navigator - Update nmap scripts tab, script navigator, and scanner settings - Add scan controls, scan host columns, script filters/library - Improve agent scanner settings and template management Host Detail (v4 redesign): - New host header with breadcrumbs, stat pills, and action buttons - Redesigned overview with system summary, ports, and source coverage - New tabbed interface (overview, vulns, network, software, etc.) - Add host data hook and persistence hook Vulnerabilities: - New vulnerability data table, navigator, and grouped view - Add severity chart, metrics, NVD details, and summary components - Modernize vulnerability report components Shared Infrastructure: - Update UI primitives (button, table) and global styles - Add severity theme, formatters, table filters, theme constants - Update tRPC routers (host, vulnerability, scanner, store, etc.) - Add agent scan router and shared server utilities Co-authored-by: Cursor <cursoragent@cursor.com>
- Redesign environment page with decluttered, table-first layout - Add compact horizontal Most Vulnerable Hosts widget (3-card row) - Add Environment Snapshot sidebar with OS distribution and stats - Extract useEnvironmentData hook for consolidated data fetching - Add EnvironmentSoftwareInventory component - Rework EnvironmentDataTable with v4 styling and severity dots - Add Open Ports column and host severity indicators - Implement tab persistence via localStorage Co-authored-by: Cursor <cursoragent@cursor.com>
- Update service networking configuration for v1 branch - Adjust dev compose overlay settings Note: sirius-api production Docker build requires go-api SDK release with slogger package (go.mod.prod needs version bump). This is a known dependency sync issue tracked separately. Co-authored-by: Cursor <cursoragent@cursor.com>
…althchecks - Update go.mod.prod to reference go-api v0.0.14 (includes slogger package) - Regenerate go.sum.prod with correct v0.0.14 checksums - Fix hardcoded localhost:9001 in AgentTemplatesTab.tsx to use env pattern - Add healthcheck to sirius-valkey (valkey-cli ping) - Add sirius-valkey to sirius-api depends_on - Add sirius-postgres and sirius-valkey to sirius-engine depends_on Co-authored-by: Cursor <cursoragent@cursor.com>
…es + code cleanup - Settings: sticky header with inline pill tabs, shadcn Input/Label/Button/Switch components, V4 card styling, notification toggles with Switch + "Soon" badge - System Monitor: manual tab state replacing shadcn Tabs, V4 sticky header with icon container + inline tabs + refresh button, plain divs replacing Card components - Environment: condensed snapshot panel (3/4 + 1/4 grid), removed Quick Actions sidebar buttons, tightened text sizes, fixed invalid loader label prop - Go handlers: gofmt alignment of map literals, removed trailing blank lines - Docs: markdown table formatting in logging conventions Co-authored-by: Cursor <cursoragent@cursor.com>
…eanup - Fix Button component architecture: variant styles now take precedence over className overrides via tailwind-merge ordering, preventing solid bg-violet-600 buttons from bypassing the glass theme - Remove all inline bg-violet-600 overrides across ~35 components, buttons now inherit from the variant system consistently - Update sidebar nav: add matchPaths for sub-page highlighting (e.g. /host/* highlights Environment), solid white base with structural active indicators instead of colored glow - Bump page header right-padding (pr-12 → pr-14) to match repositioned avatar in ConsoleHeader, HostHeader, VulnerabilityNavigator - Move "Need the Sirius Agent?" banner into Scan Profile column to save vertical space on scanner page - Remove non-functional Settings tab from ProfileManager and TemplatesScannerSettings Co-authored-by: Cursor <cursoragent@cursor.com>
Remove legacy test/example routes and pages that should not ship in v1, and update the documentation index entries required by repo hooks. Co-authored-by: Cursor <cursoragent@cursor.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| {/* Header */} | ||
| <div className="border-b border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800"> | ||
| <h2 className="text-lg font-semibold text-gray-900 dark:text-gray-100"> | ||
| <div className="border-b border-gray-700 bg-gray-800 bg-gray-800"> |
There was a problem hiding this comment.
Missing padding class in terminal sidebar header
Low Severity
When the dark: class variants were removed from the sidebar header div, the base p-4 padding class was also accidentally dropped. The old class string was "border-b border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800", and the replacement is "border-b border-gray-700 bg-gray-800 bg-gray-800" — missing p-4 and duplicating bg-gray-800. The "Agent Control" heading would render with no padding.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a6cb12c073
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -13,6 +12,8 @@ import { agentTemplatesRouter } from "~/server/api/routers/agent-templates"; | |||
| import { repositoriesRouter } from "~/server/api/routers/repositories"; | |||
| import { statisticsRouter } from "~/server/api/routers/statistics"; | |||
| import { eventsRouter } from "~/server/api/routers/events"; | |||
| import { agentScanRouter } from "~/server/api/routers/agentScan"; | |||
| import { apikeysRouter } from "~/server/api/routers/apikeys"; | |||
There was a problem hiding this comment.
Importing apikeysRouter here breaks the UI server build because this commit does not add sirius-ui/src/server/api/routers/apikeys.ts (the routers directory only contains existing routers plus agentScan.ts). TypeScript/Next will fail with a module-resolution error before runtime, so none of the API router wiring can start.
Useful? React with 👍 / 👎.
| ): Promise<{ success: boolean; error?: string }> { | ||
| try { | ||
| // Build the command string based on mode | ||
| let command = "internal:template-scan --all"; |
There was a problem hiding this comment.
The dispatch path accepts mode values (comprehensive, templates-only, scripts-only) but always sends internal:template-scan --all, so requests for non-template modes are silently ignored. In practice, scripts-only scans will never run as requested and mode-specific behavior in scan profiles is functionally broken.
Useful? React with 👍 / 👎.
Add the missing production compose override, make the UI Docker build config patch portable, and bump production go-api dependency to v0.0.15 for API key symbols. Co-authored-by: Cursor <cursoragent@cursor.com>
Use safe production placeholders in docker-compose.prod.yaml so compose config validation can run without repository-level secrets. Co-authored-by: Cursor <cursoragent@cursor.com>
Commit the pending Sirius API/UI security hardening changes (API key middleware/routes, tRPC proxy updates, compose wiring, and security test scaffolding) so CI evaluates the same state that passes local builds. Co-authored-by: Cursor <cursoragent@cursor.com>
Inject a CI API key placeholder for compose validation/integration paths and bump sirius-api go.mod to go-api v0.0.15 so validation steps compile with new API key store symbols. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace arithmetic increment expressions that can trip `set -e` on some bash versions, ensuring lint-docs-quick runs reliably in GitHub Actions. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace arithmetic post-increment operations that can fail under `set -e` in GitHub Actions bash, preventing false negatives in lint-index. Co-authored-by: Cursor <cursoragent@cursor.com>
Stabilize engine image builds by pinning known-compatible app-scanner and app-agent commits, keeping go-api at v0.0.14 for engine build compatibility, and applying scanner source compatibility patches in-container. Co-authored-by: Cursor <cursoragent@cursor.com>
Use stable default build args in ci.yml so pull-request image builds no longer override the engine Dockerfile pins with 'main', which caused scanner build path mismatches. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace GITHUB_TOKEN-based registry auth with GHCR push credentials so PR image publishing is authorized for organization package writes. Co-authored-by: Cursor <cursoragent@cursor.com>
Run single-architecture image builds for pull_request workflows to keep validation fast and avoid long-running multi-arch bottlenecks, while preserving amd64+arm64 builds for main branch publishing. Co-authored-by: Cursor <cursoragent@cursor.com>
Add missing SIRIUS_API_KEY env vars to ci.yml integration compose services so API/engine startup checks pass, and disable gha cache export in ci-modernized image builds to avoid intermittent 502 Unicorn failures. Co-authored-by: Cursor <cursoragent@cursor.com>
| condition: service_healthy | ||
| healthcheck: | ||
| test: ["CMD", "curl", "-f", "http://localhost:5174/health"] | ||
| test: ["CMD", "bash", "-lc", "echo > /dev/tcp/127.0.0.1/50051"] |
There was a problem hiding this comment.
Engine healthcheck checks wrong port vs CI
Medium Severity
The sirius-engine healthcheck was changed from curl -f http://localhost:5174/health (HTTP health endpoint on main port) to a TCP check on port 50051 (echo > /dev/tcp/127.0.0.1/50051). This is a weaker check that only verifies the gRPC port is accepting connections, not that the engine's HTTP service is healthy. It also diverges from CI, which still checks http://localhost:5174/health, meaning production and CI have different definitions of engine health.
Correct integration-test readiness checks to require healthy postgres/rabbitmq/valkey before app startup and only wait on app services that are actually started for the run. Co-authored-by: Cursor <cursoragent@cursor.com>
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-ui:${{ steps.meta.outputs.image_tag }} | ||
| ${{ steps.meta.outputs.also_tag_beta == 'true' && format('{0}/{1}/sirius-ui:beta', env.REGISTRY, env.IMAGE_NAMESPACE) || '' }} | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max |
There was a problem hiding this comment.
Docker build cache never written in modernized CI
Medium Severity
The cache-to: type=gha,mode=max directive was removed from all three docker/build-push-action steps (sirius-ui, sirius-api, sirius-engine) in ci-modernized.yml, while the equivalent ci.yml workflow retains it. With only cache-from: type=gha remaining, builds read from cache but never write back, so the cache will go stale and every build becomes a full uncached Docker build.
Additional Locations (2)
Switch CI RabbitMQ test image to rabbitmq:3-management and disable buildx cache export in ci.yml to avoid intermittent gha cache 502 failures during image publishing. Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent false-positive readiness checks by matching (healthy) instead of healthy, so integration tests do not advance when containers are still unhealthy. Co-authored-by: Cursor <cursoragent@cursor.com>
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-ui:${{ steps.meta.outputs.image_tag }} | ||
| ${{ steps.meta.outputs.also_tag_beta == 'true' && format('{0}/{1}/sirius-ui:beta', env.REGISTRY, env.IMAGE_NAMESPACE) || '' }} | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max |
There was a problem hiding this comment.
CI build cache will never be populated
Medium Severity
cache-to: type=gha,mode=max was removed from all Docker build-and-push steps across both CI workflow files, but cache-from: type=gha was retained. Without cache-to, the GitHub Actions cache is never written to, so cache-from will progressively find nothing to load. This effectively disables Docker layer caching for all CI builds, leading to significantly slower build times.
Additional Locations (2)
Use retrying endpoint checks for API, engine, and UI startup readiness so integration tests no longer fail when Docker health labels lag or remain unhealthy despite service availability. Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid duplicate PR integration gating from the modernized workflow and keep PR validation on the stable integration job in ci.yml while preserving post-merge integration coverage on push. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| - VALKEY_PORT=6379 | ||
| - RABBITMQ_URL=amqp://guest:guest@sirius-rabbitmq:5672/ | ||
| - LOG_LEVEL=info | ||
| - SIRIUS_API_KEY=ci-placeholder-api-key |
There was a problem hiding this comment.
PR CI integration uses missing image tags
High Severity
build-and-push now runs only on push, but integration-test still runs on PRs and references needs.build-and-push.outputs.image_tag for the images. On pull_request events, build-and-push is skipped, so the integration compose uses an empty/undefined tag and likely pulls non-existent images, making PR integration testing unreliable.
| "message": "Host updated successfully", | ||
| "host_ip": hostIP, | ||
| }) | ||
| } |
There was a problem hiding this comment.
Host update endpoint inserts instead of updates
High Severity
UpdateHost calls host.AddHostWithSource with a partial sirius.Host built from the request. If AddHostWithSource performs an upsert/create-or-merge operation, this can overwrite fields unexpectedly, create duplicate/incorrect scan attribution, or reset omitted fields, instead of performing a true partial update semantics for PUT /host/:id.
| } | ||
|
|
||
| return c.JSON(response) | ||
| } |
There was a problem hiding this comment.
Scan status handlers assume base64 and host strings
Medium Severity
CancelScan/GetScanStatus/ForceStopScan always base64-decode currentScan and parse hosts as []string. If currentScan is stored as raw JSON (or hosts is an array of objects like HostEntry), these endpoints will 500 or return incorrect Hosts/TotalHosts values, breaking scan control/status in some deployments.
Additional Locations (1)
1 participant
Summary
mainfor the v1.0.0 releasequeue-test,vulnerabilities-old, and example tRPC router)Test plan
Made with Cursor
Note
High Risk
Introduces mandatory API-key enforcement and bootstrap logic in
sirius-api, which can break existing clients/deployments if headers or env vars aren’t set correctly. Also adds new control endpoints that modify live scan state in Valkey and affect operational behavior.Overview
This PR tightens service-to-service authentication by requiring
SIRIUS_API_KEYacross Docker/CI and enforcingX-API-Keyonsirius-api(health remains public), including startup bootstrap/reconciliation of the root key in Valkey and new/api/v1/keysmanagement endpoints.It adds new scan control endpoints (
/api/v1/scans/{status,cancel,force-stop,reset}), a new host update route (PUT /host/:id), and introduces script CRUD endpoints backed by Valkey, while also migrating API logging tolog/slogwith level-aware request logging.CI/CD and container workflows are updated to use dedicated GHCR push credentials, avoid multi-arch builds on PRs, only push images on
pushevents, and improve integration-test reliability (explicit service readiness checks, updated RabbitMQ image, placeholder API key injection). Docker compose is expanded with a production override file, stricter env requirements, healthchecks/resource tweaks, and dev performance/networking improvements; documentation and docs lint scripts are updated accordingly (plus removal ofSDK-RELEASE-IMPLEMENTATION-SUMMARY.md).Written by Cursor Bugbot for commit 03f6319. This will update automatically on new commits. Configure here.