Repository navigation
v3.51.0: superadmin can permanently delete a task from the cockpit (dashboard 0.26.0) - #139
Merged
Merged
Conversation
…ashboard 0.26.0) The cockpit (and its iOS home-screen app) could dismiss a task but never delete it. The task drawer, desktop panel and phone bottom sheet alike, now has "Delete permanently" for a task in any status: open, done or dismissed. - POST /api/tasks/<id>/delete shells `pt rm --yes -- PT-N` (tombstoned, so sync clients drop it). The sidecar looks up the PT-N first: `pt rm` reads a uuid as an open-task title and would miss closed tasks. - Superadmin-only, like approval decisions: the tailnet also carries the fleet's agents, so it needs X-PTask-Decide-Token = PTASK_DASH_DECIDE_TOKEN (403 decide_token_required / decide_disabled otherwise). - /api/config reports superadmin, so the button only shows where the token is configured. The cockpit confirms first, asks for the token once and keeps it in localStorage. - Not on the Rust pt serve dashboard (no superadmin in its config); machine clients already have task_delete on /sync. CI unblock: deny.toml ignores RUSTSEC-2026-0367/0368/0369 (zip 7.2.0, published this month, failing cargo-deny on main too). All three are in zip's extract(); our only zip user, candle-core 0.10.2 (native-ml), reads entries by name and never extracts. The fix is zip >= 9 and candle 0.11.0 still pins zip ^8.6, so there is no upgrade path yet. Tests: 9 new sidecar tests (any status by uuid or PT-N, token gate, disabled without a strong token, bad ids never reach pt, cross-origin, pt failure, markup); 124 Python + 24 Node dashboard tests pass. End to end against real pt 3.50.6 on a scratch DB: a done task deleted by uuid, task.deleted tombstone attributed to dashboard. Phone-size UI checked in a browser. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
puretensor
force-pushed
the
feat/superadmin-delete
branch
from
October 19, 2026 11:59
48dfd75 to
c576b58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The cockpit at
ptask.tail07f9ef.ts.net, including its iOS home-screen app, could dismiss a task but never delete it. The task drawer (desktop panel and phone bottom sheet) now has Delete permanently for a task in any status: open, done or dismissed.How
POST /api/tasks/<id>/deleteshellspt rm --yes -- PT-N. It is tombstoned, so sync clients drop the task. The sidecar looks up the PT-N first, becausept rmreads a uuid as an open-task title and would miss closed tasks.X-PTask-Decide-Token=PTASK_DASH_DECIDE_TOKEN. Without it the sidecar answers 403decide_token_requiredordecide_disabled./api/configreportssuperadmin, so the button only shows where the token is configured. The cockpit asks for confirmation first, asks for the token once, and keeps it in localStorage.pt servedashboard does not get this button, because its config has nosuperadmin. Machine clients can already delete withtask_deleteon/sync.Verification
dashboard/tests/test_delete.py. All 124 Python and 24 Node dashboard tests pass.pt3.50.6 on a scratch DB: a request without the token got 403. With the token, a done task was deleted by uuid, leaving atask.deletedtombstone attributed todashboard.Deploy note
Production has no
PTASK_DASH_DECIDE_TOKENyet. It goes in~/puretensor-tasks/.dashboard.env, the PureTensor instance only, and in Vaultwarden.🤖 Generated with Claude Code