更新说明

Features

• Add a public product marketing site under `site/` (home, product, get-started, changelog), built by `make site` / `scripts/build_site.py` from `Cargo.toml` + `CHANGELOG.md`, separate from the embedded console in `web/`. Deploy to Cloudflare Workers (`bot-vm-ops-site`) at `ops.droplink.cloud` via `make site-deploy` / `.github/workflows/cloudflare-site.yml`.
• Expand the product-site get-started flow: For Agent (default) vs For Human paths, Cloudflare Tunnel domain-access guidance for reaching the local panel, and follow-on docs for Web, Skills, CLI, and MCP.
• Put a one-click copyable setup Prompt at the top of the For Agent get-started path so users can paste it into an Agent chat.

Security

• Protect the service's own credentials and runtime files from every authorized root. The startup `--file-root` and all `roots.json` roots now share one deny list covering the token, history database, data/log/config directories and the installation directory, so a second root can no longer read `data/token`, `data/tunnel-token` or `run.sh`. Roots equal to or inside those runtime paths are ignored on startup and hot reload.
• Force `sandbox allow-scripts` and `Cross-Origin-Opener-Policy: same-origin` on HTML runtime previews, and keep SVG previews inert, so opening a preview URL directly no longer runs it with the panel's origin.
• Record every browser login attempt (success, invalid token, and rate-limited) in the operation audit with the client address, and lock a client for 15 minutes after 5 failures within 15 minutes (`429` + `Retry-After`). The limiter trusts a single `CF-Connecting-IP`, falls back to a shared `local` bucket, and is bounded to 4096 clients.

Features

• Play audio and video in the local Review Pack Style 3 viewer with Media Chrome 4.2.1. The official esbuild IIFE is inlined into the viewer page, which upgrades `<audio>` and `<video>` with a Media Chrome control bar (play, time, progress, volume, and fullscreen on video). Native `controls` stay off, so the browser bar is not shown beside it. Pack file responses remain `script-src 'none'`; the library is not placed in pack HTML. Download, Markdown preview, and the double-click guard stay in place. Arrow keys still move between files.
• Add a local Review Packs page. Packs are directories on the machine running bot-vm-ops, registered in `review.sqlite`, and served by this process at `/review/packs/{id}/{token}/`. The public viewer matches Style 3 (no top title bar; desktop left rail and preview; mobile file list collapsed behind a hamburger icon; previous/next, path crumbs, and image/audio/video/markdown/html/pdf/text players). The viewer page allows inline script and style; pack file responses stay on `script-src 'none'`. A URL without the trailing slash redirects to the slash form so relative file paths stay under the token. The console can register a directory, mint or extend a preview URL, open it, and revoke it. Visit counts increase when the viewer is opened. Files are not uploaded to R2. Set `BOT_REVIEW_ROOT` and/or an authorized file root, and `BOT_REVIEW_PUBLIC_BASE` (default `https://vmops.droplink.cloud`). `review.droplink.cloud` stays a separate transitional tool and is not used here.

Fixes

• Serve hardlinked regular files from local Review Packs, and raise the single-file preview limit from 64 MiB to 512 MiB. A file over that limit returns HTTP 413 with the Chinese reason in the page; other file-open `Invalid` errors return HTTP 400 with their message. Both used to be the generic “链接无效或已失效” 404. Symlinks, directories, and path checks are unchanged. File-manager upload and download stay at 64 MiB.
• Render Markdown in the local Review Pack Style 3 viewer. `.md` and `.markdown` files are parsed in the viewer page with marked 18.1.1 and sanitized with DOMPurify 3.4.17 before insertion, so headings, lists, links, and code show as HTML. Unsafe tags, inline handlers, and non-pack URLs are removed. If rendering fails, the viewer shows the escaped source. Pack files stay `text/plain` with `script-src 'none'`. PDF preview is unchanged.
• Stop the local Review Pack Style 3 viewer from enlarging on double-click or double-tap. Image preview no longer toggles a zoomed layout on click: the first click of a double-click expanded the image, and the reflow could move it out from under the pointer so the second click never toggled it back. The page now uses `touch-action: manipulation` and cancels double-click default actions outside video, audio, and form controls. Pinch-zoom and browser or OS zoom stay available; the rail, drawer toggle, and mobile navigation are unchanged.
• Fix SIGHUP roots reload dropping the `--file-root` startup root from `/api/roots` and opening newly added roots without the protected list; the startup root now stays visible and locked across reloads.

Fixes

• Fix Grok per-agent discovery dropping every `DISPLAY` matcher: the real `~/.sand-window-assignments.json` stores each window as a bare integer (`{"<uuid>": 3}`) while the parser only accepted the object form, so every discovered grok-agent Bot reported `no_supported_match_condition` with no process, RSS or CPU data. Bare integers are now accepted alongside the object forms.
• Fix `roots add` path validation silently accepting non-canonical paths on Linux: `Path` equality is semantic and `join("./x")` drops the dot, so `/a/./b` passed the canonical comparison (macOS only rejected it because `/tmp` is a symlink). The validator now compares the exact input string against the canonical form and rejects symlink final components via `symlink_metadata`. This was the Linux verify-app failure that blocked the v0.3.5 and first v0.3.6 release runs.

Features

• Add CLI-managed folder authorization: authorized roots persist in `roots.json` (atomic, 0600) and can only be changed via the local `bot-vm-ops roots add|remove|list` CLI; the HTTP API exposes read-only `GET /api/roots` and the Web file manager gains an authorized-roots tab that generates copyable request prompts instead of mutating grants.
• Reload authorized roots on SIGHUP without restarting `serve`; per-root read-only mode is enforced and Grok-discovery-only roots are never browsable through file APIs.
• Add a built-in locked read-only Grok agent discovery grant on `grok-bot-vm-*` hosts, disabled with `--no-grok-discovery`.

Features

• Add opt-in Grok per-agent discovery using `DISPLAY`-matched process sets, with bounded `/proc` environment collection and per-agent CPU/RSS accounting.

Features

• Add Bot JSON CLI queries for the registry, resource history, and bounded log reads.
• Add a Web Bot overview page showing registered Bots with bounded status and resource summaries.
• Add a Web Bot detail page with bounded resource history, log, and diagnosis evidence.
• Add a local MCP stdio entry: `bot-vm-ops mcp` speaks line-delimited JSON-RPC over stdio, reuses CLI credential resolution, and enforces bounded frames, in-flight requests, and timeouts against a running local `serve`.

Fixes

• Fix the Web update check querying the never-published bare package name `bot-vm-ops`; it now queries the scoped `@chufa/bot-vm-ops`.
• Redact audit paths in Web views with a fixed-length summary instead of exposing full paths.
• Preserve Bot RSS accounting and source sampling time in resource history.

Changes

• Tighten lint enforcement: frontend ESLint runs with `--max-warnings 0` aligned with Rust `-D warnings`; lint/typecheck/test failures no longer mask independent Rust check evidence in verification reports.
• Move release blockers earlier: the release workflow extends npm registry visibility polling to 6 minutes, CI adds a fast Linux musl `cargo check` job on every push, and a `make pre-release VERSION=X.Y.Z` gate verifies version/lockfile consistency, a clean tree, upstream sync, and `make verify-app` before tagging.
• Add `make clean` to remove local build outputs, caches, and verification evidence while preserving archived CI evidence.
• Record the 2026-10-18 module/security/clean-code review and queue follow-up tasks CR01-CR07.