Circuit Breaker v0.4.6

A security fix for session tokens, and a topology map patch: panels and menus that would not close, a map that re-rendered continuously, and zoom that could not show a large map whole. Also a themed approval dialog for new agents, styling that had silently stopped applying across the app, clearer errors when adding a Proxmox cluster, and a readable cb resources.

Fixed

• The map no longer re-renders continuously. Since 0.2.x it re-rendered around a thousand times a second from page load, on every map, which cost CPU and made the panels below unreliable.
• The node details panel closes on the first click of its close button. It could take several clicks: the panel re-selected the node it had just closed, and a slight pointer movement during the click jumped the panel away from the button.
• The right-click menu on a node is laid out as a menu again. Its styles stopped being generated when the map moved in 0.4.2, so it stretched across the screen or did not appear at all. It, and the boundary and line menus, now close on a left click anywhere outside them, including on the canvas and on other nodes.
• The hover telemetry card opens beside the pointer rather than a few hundred pixels below it, and stays closed after its close button instead of reopening for whichever node was underneath.
• A large or wide map can be fitted into view whole. Automatic fits were held at 40% zoom and the canvas was bounded, so big maps could not be shown or panned in full. The saved zoom and position are now kept per map instead of one shared across every map.
• Adding a Proxmox cluster with the name, URL or API token left empty now says which field is missing. The Save button used to be disabled with no explanation, and the name’s placeholder looked like a value already entered.
• The create-node dialog opens centred above the page. It fell into the lower half of the screen and needed a scroll, sat under the top bar and dock, and had bevelled buttons and inputs.
• Hover, focus and disabled states, translucent theme colours and borders apply again across the app. 35 style classes in 11 files, most of them in the map’s menus and dialogs, were written in a form that produced no CSS at all, and bordered elements drew no border or the browser’s bevel instead of the theme.
• The upgrade instructions for native and Proxmox LXC installs give the command that works, install.sh --upgrade. Several pages said cb update, which only updates the single-container image and refuses on a native install.

Changed

• Approving a new agent happens in a themed dialog, from both the Add agent flow and Review on a pending row. It shows the agent’s identity with a copyable fingerprint, flags a duplicate machine ID, and offers the hardware link and capability choices; it can also reject the agent. The approve step in Add agent used to approve with default capabilities only, and both screens rendered with unstyled browser controls.
• cb resources is readable. Output is grouped into usage, components, shared limits, attention, notices and what was not measured; CPU and memory show a capacity bar; each component’s own RAM and CPU caps sit in its row instead of a separate list, and CPU sets or unlimited ceilings that constrain nothing are left out; totals missing some components say so once; low-level stalls below 1% no longer raise attention; and services use one short name throughout. In a terminal it uses the web app’s colours; piped output, NO_COLOR and --json are unchanged.

Security

• Updated PyJWT to 2.15.1 for CVE-2026-101918. PyJWT signs and verifies the session tokens every sign-in issues, so this is the reason to upgrade.
• Updated undici (7.30.0) and brace-expansion (1.1.21, 5.0.12), both frontend development dependencies, for published denial-of-service and TLS-validation advisories. Neither ships in the application bundle.

Documentation

• The README is rewritten around the current product, with new screenshots, the one-line install first, and the upgrade and cb command references corrected.
• ADR 0006 puts an npm installer CLI, @blkleg/circuitbreaker, on the road to 1.0, superseding ADR 0004. Nothing is published to npm yet.

What’s Changed

• ci: tell the site when a release or mirrored content changes by @BlkLeg in #207
• Merge dev into main: v0.4.6 (PyJWT security fix, map fixes, agent approval dialog) by @BlkLeg in #210

Full Changelog: v0.4.5…v0.4.6