Plugin system, agent overhaul, remote ops, and UI refresh

.env.example

@@ -30,6 +30,13 @@ DATABASE_URL=sqlite:///serverkit.db
 # CORS Origins - your domain(s), comma-separated
 CORS_ORIGINS=http://localhost,https://your-domain.com
 
+# Public URL that agents should dial back to. Set this whenever the panel
+# sits behind a reverse proxy / tunnel / custom domain — the connection
+# string the panel issues to agents will embed this URL instead of the
+# request's Host header (which would otherwise be the internal IP/port).
+# Leave commented out for plain localhost development.
+# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
+
 # Ports (for Docker)
 PORT=80
 SSL_PORT=443

.gitattributes

@@ -0,0 +1,13 @@
+* text=auto eol=lf
+
+*.sh   text eol=lf
+*.ps1  text eol=crlf
+*.bat  text eol=crlf
+*.cmd  text eol=crlf
+
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.gif  binary
+*.ico  binary
+*.pdf  binary

.github/workflows/agent-release.yml

@@ -12,7 +12,7 @@ on:
         type: string
 
 env:
-  GO_VERSION: '1.21'
+  GO_VERSION: '1.23'
 
 jobs:
   build:
@@ -31,6 +31,9 @@ jobs:
           - goos: windows
             goarch: amd64
             suffix: '.exe'
+          - goos: windows
+            goarch: arm64
+            suffix: '.exe'
 
     steps:
       - name: Checkout code
@@ -60,7 +63,15 @@ jobs:
           CGO_ENABLED: 0
         run: |
           cd agent
-          go build -ldflags="-s -w -X main.Version=${{ steps.version.outputs.version }} -X github.com/serverkit/agent/internal/agent.Version=${{ steps.version.outputs.version }}" \
+          # Windows builds use -H windowsgui so Start-menu launches don't
+          # flash a console. attachParentConsole() in cmd/agent restores
+          # stdio when invoked from PowerShell/cmd for CLI subcommands.
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            EXTRA_LDFLAGS="-H=windowsgui"
+          else
+            EXTRA_LDFLAGS=""
+          fi
+          go build -ldflags="-s -w $EXTRA_LDFLAGS -X main.Version=${{ steps.version.outputs.version }} -X github.com/serverkit/agent/internal/agent.Version=${{ steps.version.outputs.version }}" \
             -o ../dist/serverkit-agent-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }} \
             ./cmd/agent
 
@@ -190,12 +201,20 @@ jobs:
           path: packages/*.rpm
           retention-days: 5
 
-  # Build Windows MSI
+  # Build Windows MSI installers (one per architecture)
   build-msi:
-    name: Build MSI Installer
+    name: Build MSI Installer (${{ matrix.arch }})
     runs-on: windows-latest
     needs: build
 
+    strategy:
+      matrix:
+        include:
+          - goarch: amd64
+            arch: x64
+          - goarch: arm64
+            arch: arm64
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -213,30 +232,30 @@ jobs:
 
       - name: Install WiX Toolset
         run: |
-          dotnet tool install --global wix
+          dotnet tool install --global wix --version 5.0.2
 
       - name: Download binary
         uses: actions/download-artifact@v4
         with:
-          name: serverkit-agent-windows-amd64
+          name: serverkit-agent-windows-${{ matrix.goarch }}
           path: dist/
 
       - name: Extract binary
         shell: bash
         run: |
           cd dist
-          unzip serverkit-agent-${{ steps.version.outputs.version }}-windows-amd64.zip
+          unzip serverkit-agent-${{ steps.version.outputs.version }}-windows-${{ matrix.goarch }}.zip
 
       - name: Build MSI
         shell: pwsh
         run: |
           cd agent/packaging/msi
-          .\build.ps1 -Version "${{ steps.version.outputs.version }}" -BinaryPath "..\..\..\dist\serverkit-agent-windows-amd64.exe" -OutputDir "..\..\..\packages"
+          .\build.ps1 -Version "${{ steps.version.outputs.version }}" -Arch "${{ matrix.arch }}" -BinaryPath "..\..\..\dist\serverkit-agent-windows-${{ matrix.goarch }}.exe" -OutputDir "..\..\..\packages"
 
       - name: Upload MSI
         uses: actions/upload-artifact@v4
         with:
-          name: serverkit-agent-msi
+          name: serverkit-agent-msi-${{ matrix.arch }}
           path: packages/*.msi
           retention-days: 5
 
@@ -352,6 +371,7 @@ jobs:
             | Linux | x64 (amd64) | `serverkit-agent-${{ steps.version.outputs.version }}-linux-amd64.tar.gz` |
             | Linux | ARM64 | `serverkit-agent-${{ steps.version.outputs.version }}-linux-arm64.tar.gz` |
             | Windows | x64 (amd64) | `serverkit-agent-${{ steps.version.outputs.version }}-windows-amd64.zip` |
+            | Windows | ARM64 | `serverkit-agent-${{ steps.version.outputs.version }}-windows-arm64.zip` |
 
             #### Linux Packages
             | Format | Architecture | Download |
@@ -365,8 +385,9 @@ jobs:
             | Format | Architecture | Download |
             |--------|--------------|----------|
             | MSI | x64 | `serverkit-agent-${{ steps.version.outputs.version }}-x64.msi` |
+            | MSI | ARM64 | `serverkit-agent-${{ steps.version.outputs.version }}-arm64.msi` |
 
-            > **New:** Run `serverkit-agent tray` to launch the **System Tray Application** which provides a visual indicator that the agent is running, along with quick access to status, logs, and service controls. The MSI installer auto-starts the tray on Windows login.
+            > **New:** The Windows MSI now opens a native pairing wizard right after install — no browser, no WebView2 runtime needed. The Start-menu shortcut and login autostart both run the unified desktop app: pairing wizard if not yet configured, otherwise the system tray.
 
             #### Docker
             ```bash
@@ -458,6 +479,7 @@ jobs:
           echo "| RPM | x86_64 | ✅ Built |" >> $GITHUB_STEP_SUMMARY
           echo "| RPM | aarch64 | ✅ Built |" >> $GITHUB_STEP_SUMMARY
           echo "| MSI | x64 | ✅ Built |" >> $GITHUB_STEP_SUMMARY
+          echo "| MSI | ARM64 | ✅ Built |" >> $GITHUB_STEP_SUMMARY
           echo "| Docker | multi-arch | ✅ Built |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### Release" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -27,6 +27,7 @@
 /backend/*.pyd
 /backend/.env
 /backend/.venv
+/backend/.venv-wsl/
 /backend/pip-log.txt
 /backend/pip-delete-this-directory.txt
 /backend/dev-data/
@@ -40,6 +41,7 @@
 /agent/*.test
 /agent/*.out
 /agent/bin/
+/dist/
 
 # Environment / Secrets
 .env
@@ -53,6 +55,7 @@
 *.csr
 /backend/.env
 /frontend/.env.local
+/frontend/.env.development.local
 
 # Docker
 .docker-compose.untracked.yml
@@ -95,4 +98,19 @@ new_templates/
 nul
 SECURITY_AUDIT.md
 APP_IMPROVEMENTS.md
+UI_REPORT.md
 *.png
+
+# MSI / build artifacts that should not be committed.
+/agent/packaging/msi/output/
+/agent/packaging/msi/*.wixpdb
+
+# Brand assets that the agent embeds at build time are generated by
+# agent/packaging/icons/generate_icons.py from the SVG, but must be checked
+# in so CI builds don't have to install cairo/Pillow.
+!agent/internal/setupui/serverkit.ico
+!agent/internal/setupui/serverkit_header.png
+docs/PLAN_AGENT_FLEET.md
+/docs/plans
+/.agents
+/.extension-platform-plan/

AGENTS.md

@@ -0,0 +1,122 @@
+# AGENTS.md
+
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
+
+## Project Overview
+
+ServerKit is a server control panel for managing web applications, databases, Docker containers, and security on VPS/dedicated servers. Flask backend (Python 3.11+), React frontend (Vite + SCSS), SQLite/PostgreSQL database, real-time updates via Socket.IO.
+
+## Development Commands
+
+```bash
+# Backend (launcher default port 47927, hot-reload)
+cd backend && python -m venv venv && source venv/bin/activate  # Windows: venv\Scripts\activate
+pip install -r requirements.txt
+python run.py
+
+# Frontend (launcher default port 41921, Vite HMR)
+cd frontend && npm install && npm run dev
+
+# Both at once (Linux/WSL)
+./dev.sh
+
+# Frontend lint
+cd frontend && npm run lint
+
+# Frontend production build
+cd frontend && npm run build
+
+# Backend tests
+cd backend && pytest
+cd backend && pytest --cov=app
+
+# Docker
+docker compose -f docker-compose.dev.yml up --build
+```
+
+Default dev credentials: `admin` / `admin`
+
+## Architecture
+
+### Backend (`backend/`)
+
+Flask app factory in `app/__init__.py` using `create_app()`. Three-layer architecture:
+
+- **`app/api/`** — Flask Blueprints, one file per feature (36 files). All routes prefixed `/api/v1/`. JWT-protected via `@jwt_required()`.
+- **`app/services/`** — Business logic (48 files). Services are stateless modules called by API routes. Heavy lifting (shell commands, Docker API, file operations) happens here.
+- **`app/models/`** — SQLAlchemy ORM models (15 files). Tables auto-created on startup via `db.create_all()`.
+
+Other backend components:
+- `app/sockets.py` — Socket.IO event handlers for real-time metrics, logs, terminal
+- `app/agent_gateway.py` — Multi-server agent communication
+- `app/middleware/security.py` — Security headers middleware
+- `config.py` — Environment-based config (development/production/testing)
+- `run.py` — Entry point
+
+### Frontend (`frontend/src/`)
+
+React 18 SPA with client-side routing:
+
+- **`pages/`** — Route-level components (~29 files). Each maps to a route in `App.jsx`.
+- **`components/`** — Reusable UI components shared across pages.
+- **`contexts/`** — React Context providers: `AuthContext` (JWT auth + token refresh), `ThemeContext`, `ToastContext`, `ResourceTierContext` (feature gating).
+- **`services/api.js`** — Centralized `ApiService` class handling all HTTP requests, token management, and auto-refresh.
+- **`hooks/`** — Custom React hooks for reusable logic.
+- **`styles/`** — SCSS stylesheets with design system variables. Main entry is `main.scss`. Page-specific styles in `styles/pages/`.
+- **`layouts/`** — `DashboardLayout` wraps authenticated pages (sidebar + header).
+
+Route guards: `PrivateRoute` (auth check), `PublicRoute` (redirect if logged in), `SetupRoute` (redirect to `/setup` if not configured).
+
+### Request Flow
+
+Browser → Nginx (`:80`/`:443`) → proxy_pass to Docker containers (`:8001-8999`) for managed apps, or to Flask (`:5000`) for the panel API. The 404 handler in Flask serves `index.html` for SPA client-side routing; API routes return JSON errors.
+
+### Production Build
+
+The Dockerfile is multi-stage: Node 20 builds frontend, Python 3.11 serves everything via Gunicorn with GeventWebSocket workers. Built frontend is served from Flask's static folder.
+
+## Platform & Distro Awareness
+
+ServerKit deploys on Linux (bare metal, VPS, or Docker). Development may happen on Windows/macOS.
+
+- **Service layer is Linux-only** — nginx, systemctl, apt/dnf, PHP-FPM, etc. are inherently Linux. No need to abstract these for Windows.
+- **Platform-agnostic code** (config management, storage, API layer) should guard Unix-only calls like `os.chmod` with `if os.name != 'nt'` so the dev server can run locally on any OS.
+- **Distro differences matter** — use `backend/app/utils/system.py` helpers (`get_package_manager`, `is_package_installed`, `install_package`) instead of calling `apt`/`dpkg`/`dnf` directly. Not all targets are Debian-based.
+
+## Code Style
+
+### Python
+- PEP 8, type hints where helpful
+- Service functions are standalone (no classes unless stateful)
+- Consistent JSON error responses: `{'error': 'message'}, status_code`
+
+### React/JavaScript
+- Functional components with hooks only
+- PascalCase for components (`Sidebar.jsx`), camelCase for everything else
+- SCSS for styling — use existing design system variables (`$bg-card`, `$primary-color`, `$spacing-md`, etc.) and BEM-like naming (`.block__element--modifier`)
+- Context API for global state; props drilling is fine for 2-3 levels
+- No inline styles; no Tailwind/CSS-in-JS
+
+### Diffs & Commits
+- One logical change per commit
+- Minimal, focused diffs — don't silently refactor surrounding code
+- Branch naming: `feature/`, `fix/`, `docs/`, `refactor/` prefixes
+
+## Adding a New Feature (Full Stack)
+
+1. **Model**: Add SQLAlchemy model in `backend/app/models/`
+2. **Service**: Add business logic in `backend/app/services/`
+3. **API**: Create Blueprint in `backend/app/api/`, register it in `app/__init__.py` with `url_prefix='/api/v1/<feature>'`
+4. **Frontend API**: Add methods to `ApiService` in `frontend/src/services/api.js`
+5. **Page**: Create page component in `frontend/src/pages/`, add route in `App.jsx`
+6. **Styles**: Add SCSS file in `frontend/src/styles/pages/`, import in `main.scss`
+
+## Key Environment Variables
+
+| Variable | Purpose |
+|----------|---------|
+| `SECRET_KEY` | Flask session signing |
+| `JWT_SECRET_KEY` | JWT token signing |
+| `DATABASE_URL` | DB connection string (`sqlite:///...` or PostgreSQL) |
+| `CORS_ORIGINS` | Comma-separated allowed origins |
+| `FLASK_ENV` | `development` or `production` |

CLAUDE.md

@@ -4,17 +4,17 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-ServerKit is a server control panel for managing web applications, databases, Docker containers, and security on VPS/dedicated servers. Flask backend (Python 3.11+), React frontend (Vite + LESS), SQLite/PostgreSQL database, real-time updates via Socket.IO.
+ServerKit is a server control panel for managing web applications, databases, Docker containers, and security on VPS/dedicated servers. Flask backend (Python 3.11+), React frontend (Vite + SCSS), SQLite/PostgreSQL database, real-time updates via Socket.IO.
 
 ## Development Commands
 
 ```bash
-# Backend (port 5000, hot-reload)
+# Backend (launcher default port 47927, hot-reload)
 cd backend && python -m venv venv && source venv/bin/activate  # Windows: venv\Scripts\activate
 pip install -r requirements.txt
 python run.py
 
-# Frontend (port 5173, Vite HMR)
+# Frontend (launcher default port 41921, Vite HMR)
 cd frontend && npm install && npm run dev
 
 # Both at once (Linux/WSL)
@@ -62,7 +62,7 @@ React 18 SPA with client-side routing:
 - **`contexts/`** — React Context providers: `AuthContext` (JWT auth + token refresh), `ThemeContext`, `ToastContext`, `ResourceTierContext` (feature gating).
 - **`services/api.js`** — Centralized `ApiService` class handling all HTTP requests, token management, and auto-refresh.
 - **`hooks/`** — Custom React hooks for reusable logic.
-- **`styles/`** — LESS stylesheets with design system variables. Main entry is `main.less`. Page-specific styles in `styles/pages/`.
+- **`styles/`** — SCSS stylesheets with design system variables. Main entry is `main.scss`. Page-specific styles in `styles/pages/`.
 - **`layouts/`** — `DashboardLayout` wraps authenticated pages (sidebar + header).
 
 Route guards: `PrivateRoute` (auth check), `PublicRoute` (redirect if logged in), `SetupRoute` (redirect to `/setup` if not configured).
@@ -93,7 +93,7 @@ ServerKit deploys on Linux (bare metal, VPS, or Docker). Development may happen
 ### React/JavaScript
 - Functional components with hooks only
 - PascalCase for components (`Sidebar.jsx`), camelCase for everything else
-- LESS for styling — use existing design system variables (`@card-bg`, `@primary-color`, `@spacing-md`, etc.) and BEM-like naming (`.block__element--modifier`)
+- SCSS for styling — use existing design system variables (`$bg-card`, `$primary-color`, `$spacing-md`, etc.) and BEM-like naming (`.block__element--modifier`)
 - Context API for global state; props drilling is fine for 2-3 levels
 - No inline styles; no Tailwind/CSS-in-JS
 
@@ -109,7 +109,7 @@ ServerKit deploys on Linux (bare metal, VPS, or Docker). Development may happen
 3. **API**: Create Blueprint in `backend/app/api/`, register it in `app/__init__.py` with `url_prefix='/api/v1/<feature>'`
 4. **Frontend API**: Add methods to `ApiService` in `frontend/src/services/api.js`
 5. **Page**: Create page component in `frontend/src/pages/`, add route in `App.jsx`
-6. **Styles**: Add LESS file in `frontend/src/styles/pages/`, import in `main.less`
+6. **Styles**: Add SCSS file in `frontend/src/styles/pages/`, import in `main.scss`
 
 ## Key Environment Variables