Harden the update flow

.gitattributes

@@ -0,0 +1,29 @@
+# Line endings are part of a file's bytes, and Condor digests some of those
+# bytes: `content_digest` in condor/layering.py stamps a forked agent file with
+# a hash of the stock file it came from, and the staleness check compares that
+# stamp against the stock file later. Leaving endings to each host's git config
+# makes that hash platform-dependent.
+#
+# `text=auto` normalizes to LF in the repository. The explicit `eol=lf` entries
+# are the files whose bytes are either hashed or executed, where a CRLF working
+# tree would be actively wrong rather than merely inconsistent.
+* text=auto
+
+# Agent content: hashed by content_digest, so the working tree must match what
+# was committed byte for byte on every platform.
+*.md text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+
+# Executed by a POSIX shell; a CRLF copy fails with a bad-interpreter error.
+*.sh text eol=lf
+Makefile text eol=lf
+
+# Binary, so git must not touch them.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.woff binary
+*.woff2 binary

.gitignore

@@ -226,3 +226,10 @@ frontend/.claude/
 # one's commit — which is how 1529d04 came to carry a message describing work it does not
 # contain. Kept on disk, out of the index.
 GATEWAY_ISSUES.md
+
+# The dashboard is built into dist.new and swapped into place, keeping dist.old
+# as a rollback (see build_frontend). `dist/` above does not match either name,
+# and an unignored scratch directory would make every mid-build tree dirty --
+# which is itself something repo_blocks() can refuse an update over.
+frontend/dist.new/
+frontend/dist.old/

.python-version

@@ -0,0 +1 @@
+3.12

Makefile

@@ -53,10 +53,14 @@ install: setup
 	@$(MAKE) setup-chrome
 	@-$(MAKE) doctor
 
+# Bounded, and says which way it failed. The bare `python -c` this replaces had
+# no timeout and sent stderr to /dev/null, so a stalled download sat on
+# "Setting up Chrome..." for ever with nothing to read and no way to finish the
+# install. See condor/setup_chrome.py; it always exits 0, because charts are
+# optional and an optional renderer must not fail an install.
 setup-chrome:
 	@echo "Setting up Chrome for chart rendering..."
-	@uv run python -c "import kaleido; kaleido.get_chrome_sync()" 2>/dev/null || \
-		echo "Chrome setup skipped (not required for basic usage)"
+	@uv run python -m condor.setup_chrome || true
 
 doctor:
 	@bash -c ' \
@@ -65,6 +69,13 @@ doctor:
 		uv run python -m condor.doctor \
 	'
 
+# Builds into dist.new and swaps, exactly as the in-process updater does
+# (utils/updater.build_frontend). vite's `emptyOutDir` would otherwise empty the
+# directory in place: `run` and `restart` stop Condor first, but this target is
+# public and a Condor started any other way -- `run-fg`, a supervisor, a second
+# checkout -- is left serving an empty dist for the length of the build, and a
+# build that then fails leaves it with no dashboard at all.
+#
 # Reinstall when the lockfile moved, not merely when node_modules is absent:
 # after the first boot the directory always exists, so a pull that adds a
 # dependency would otherwise build against a stale tree and fail. npm rewrites
@@ -79,7 +90,11 @@ build-frontend:
 		   [ package-lock.json -nt node_modules/.package-lock.json ]; then \
 			npm ci || exit 1; \
 		fi; \
-		npm run build \
+		rm -rf dist.new && \
+		npm run build -- --outDir dist.new --emptyOutDir && \
+		rm -rf dist.old && \
+		{ [ -d dist ] && mv dist dist.old || true; } && \
+		mv dist.new dist \
 	'
 
 # Fails early (before the frontend build) if Condor is already up

condor/doctor.py

@@ -176,6 +176,81 @@ def check_dependencies() -> list[Check]:
 _PLACEHOLDER_CREDENTIALS = {"admin", "password", "changeme", ""}
 
 
+def _check_admin_can_administer(data: dict | None) -> list[Check]:
+    """Whether ``ADMIN_USER_ID`` is an id ``config.yml`` treats as an admin.
+
+    Two files have to agree about one number and nothing checked that they
+    did. ``.env`` decides who the dashboard *is* -- local mode logs in as
+    ``ADMIN_USER_ID`` with no password -- while ``config.yml`` decides what
+    that id may *do*. Disagree and every admin route answers 403: the Updates
+    tab is not rendered, the "Updates available" notification links to a tab
+    that is not there, and clicking it lands on Servers with nothing said.
+
+    Nothing was wrong enough to notice. The old check asked only whether the
+    variable was set, so an install in exactly this state reported
+    ``ADMIN_USER_ID`` green on the very value that had no rights.
+
+    A duplicated key is worth naming on its own: ``.env`` is read by three
+    parsers and the last assignment wins in all of them, so a second line is
+    silently authoritative and the first is the one people read.
+    """
+    from utils.config import ADMIN_USER_ID, LOCAL_MODE
+
+    admin_id = str(ADMIN_USER_ID or "").strip()
+    if not admin_id or not isinstance(data, dict):
+        return []
+
+    duplicates: list[Check] = []
+    if ENV_PATH.exists():
+        try:
+            assignments = [
+                line
+                for line in ENV_PATH.read_text(encoding="utf-8").splitlines()
+                if re.match(r"^\s*(export\s+)?ADMIN_USER_ID\s*=", line)
+            ]
+        except OSError:
+            assignments = []
+        if len(assignments) > 1:
+            duplicates.append(
+                Check(
+                    "ADMIN_USER_ID (duplicate)",
+                    FAIL,
+                    f"{len(assignments)} assignments in .env — the last one wins "
+                    f"({admin_id}), the others are dead. Delete all but one.",
+                )
+            )
+
+    users = data.get("users") or {}
+    role = ""
+    for key, record in users.items():
+        if str(key) == admin_id and isinstance(record, dict):
+            role = str(record.get("role") or "")
+            break
+
+    if role.lower() == "admin":
+        return duplicates
+
+    if not role:
+        detail = (
+            f"config.yml has no user {admin_id}, so the dashboard logs in as an "
+            "id with no role at all and every admin route answers 403."
+        )
+    else:
+        detail = (
+            f"config.yml gives user {admin_id} the role '{role}', not 'admin', "
+            "so every admin route answers 403 — no Updates tab, and the "
+            "'Updates available' notice links to a tab that is not rendered."
+        )
+    where = "the dashboard signs in as this id" if LOCAL_MODE else "this id"
+    return duplicates + [
+        Check(
+            "Admin access",
+            FAIL,
+            f"{detail} Set `users.{admin_id}.role: admin` in config.yml " f"({where}).",
+        )
+    ]
+
+
 def _check_placeholder_credentials(data: object) -> list[Check]:
     if not isinstance(data, dict):
         return []
@@ -262,6 +337,7 @@ def check_config() -> list[Check]:
 
             data = yaml.safe_load(config_yml.read_text(encoding="utf-8"))
             checks.append(Check("config.yml", OK, "present and parses"))
+            checks.extend(_check_admin_can_administer(data))
             checks.extend(_check_placeholder_credentials(data))
         except Exception as e:
             checks.append(Check("config.yml", FAIL, f"failed to parse: {e}"))
@@ -317,8 +393,17 @@ def _listening_binds(port: int) -> list[str]:
             binds = []
             for line in proc.stdout.splitlines()[1:]:  # skip header row
                 cols = line.split()
+                # ``-sTCP:LISTEN`` makes lsof print the state as its own
+                # trailing token, so NAME is ``TCP 127.0.0.1:8088 (LISTEN)``
+                # and the last column is ``(LISTEN)`` -- not an address at all.
+                # Taking it and splitting on "(" yielded the empty string,
+                # which ``_is_public_bind`` used to read as a wildcard: every
+                # loopback listener on a host without ``ss`` reported as bound
+                # to all interfaces.
+                if cols and cols[-1].startswith("("):
+                    cols = cols[:-1]
                 if cols:
-                    binds.append(cols[-1].split("(")[0])
+                    binds.append(cols[-1])
             return binds
         except Exception:
             pass
@@ -357,8 +442,15 @@ def _bind_host(addr: str) -> str:
 
 
 def _is_public_bind(addr: str) -> bool:
+    """Whether ``addr`` is a wildcard bind — reachable from off this machine.
+
+    The empty string is deliberately *not* a wildcard. It is what a bind this
+    code failed to parse looks like, and answering True for it turns a parsing
+    bug into a security warning about a port that may well be on loopback.
+    Unknown is not public; a bind nobody could read is reported by nothing.
+    """
     host = _bind_host(addr)
-    return host in ("0.0.0.0", "*", "::", "[::]", "")
+    return host in ("0.0.0.0", "*", "::", "[::]")
 
 
 def check_dashboard_port() -> list[Check]: