SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The terminal Alpine component + xterm/xterm-addon-fit only ever existed in an
out-of-band build; committed source never had them, so clean CI rebuilds shipped
a bundle WITHOUT the terminal (blank panel). Add resources/js/hosting-terminal.js
(window.hostingInteractiveTerminal, recovered from the last working build), import
it from app.js, and add xterm deps to package.json/lock. Verified: a clean
'npm ci && vite build' now includes the component + xterm.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createSession only waited 2.5s for the worker to flip starting->running, but
the worker cold-boots the framework (php artisan) + opens the shell, which under
load exceeds that. On timeout it also overwrote the (healthy) worker's metadata
to status=failed, so customers saw 'Terminal worker failed to start' even though
the shell was live. Wait up to 8s and return early once status is known; never
fabricate a failure — the worker records real boot errors itself.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Push the customer's connected domain to the central connected-domains registry
so it appears under My Domains (with Transfer in if not registered with Ladill).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ladill Accounting is now live at accounting.ladill.com; add its row + icon to
the shared app launcher (byte-identical across all Ladill apps).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
InjectBootSplash middleware shows a self-branded loading splash once per session
while the app boots, then fades out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Stop emailing users when their servers hit usage limits; keep database notifications for the in-app bell.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wallet balance peek rendered as a menu row directly under Billing, backed by
a /wallet/balance endpoint (BillingClient) and guarded by Route::has. Also
opens Afia via a direct window event for reliability.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
crm.ladill.com is now live in the suite; add its launcher row + icon
(byte-identical shared launcher config).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Include the purchase modal in user-layout and stack it above the order dialog so Get a new domain opens correctly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rely on the shared modal component's close control instead of rendering a second one in the embed header.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fetch owned domains from both domains.ladill.com and the platform registry so legacy customer domains populate the Ladill picker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the Domains API for owned domains across panel, account, and order forms, with an embedded iframe purchase modal instead of redirecting to domains.ladill.com.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire UserProfileMenu and shared Blade partial into topbar, mobile nav, and layouts so menu items match the account portal (Ladill Mail excluded).
Co-authored-by: Cursor <cursoragent@cursor.com>
Wallet, Billing, Team, Developers, and Support live on account.ladill.com.
Siloed sidebars keep product nav and app Settings only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the Wallet/Billing/Team links from the hosting sidebar (managed centrally
at account.ladill.com); keep Support (deep-links to hub) and Settings. Redirect
the now-orphaned account.wallet/account.billing routes to the central hub so
bookmarks still work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Completes the strip: drop the local account.team* and account.developers* route
definitions (the DeveloperController + views were removed in the previous
commit) and point the sidebar Team link to the central account hub. account.switch
retained. (Previous commit landed only the deletions; this makes routes consistent.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Team and developer-token management now live on account.ladill.com. Remove the
local account.team* and account.developers* routes, the DeveloperController, and
the (empty) hosting Team/Developers pages; repoint the sidebar Team link to
ladill_account_url('/account/team'). The acting-account switcher (account.switch)
stays — it is load-bearing for multi-account access. Hosting developer-access
authz is already centralized via the identity API (shadow-verified + flipped).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consolidate the inline HostingAccountMember lookups (Overview/Search/Hosting
Product/Afia controllers) into HostingAccessResolver, which can source hosting
developer-access from the monolith's central /identity/hosting/developer-access
(correlating cPanel usernames to local account ids). Shadow mode by default
(HOSTING_CENTRAL_DEV_ACCESS=false): local hosting_account_members stays
authoritative and divergence from central is logged; flip the flag to cut over.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add home.ladill.com helper, repair click-outside handling on topbar menus, and expand profile links on desktop and mobile.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use HostingTeamMember instead of the missing QrTeamMember class so the first login callback completes without error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Correct a JavaScript syntax error that prevented the file manager Alpine component from loading, and include the confirm modal in the hosting panel layout so delete prompts render.
Co-authored-by: Cursor <cursoragent@cursor.com>
Guests without a local session try prompt=none SSO first; marketing pages
are only for visitors with no platform session (localhost fix retained).
Co-authored-by: Cursor <cursoragent@cursor.com>
Correct localhost marketing_url default and stop redirecting guests through
/sso/connect on visit; SSO starts only via explicit sign-in.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove interactive OAuth fallback on silent SSO failure and add ladill.marketing_url config so app subdomains open the dashboard when signed in locally.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replies came back with **bold** markup that displayed literally to users.
Render the bubble as HTML (escaped first for safety) and convert **text** to
<strong>; newlines already handled by whitespace-pre-line.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Local-only sign-out: end this app's session but leave the auth.ladill.com
session intact, so the signed-out page's Sign in again re-auths silently via
prompt=none. Full sign-out of all Ladill apps remains on account.ladill.com.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sync ladill_launcher.php and give.svg across all extracted apps so Give appears in every product switcher.
Co-authored-by: Cursor <cursoragent@cursor.com>
Include transfer.svg and the SSO launcher row so Transfer appears in the
topbar grid across all Ladill apps.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move Settings out of the Account and Advanced sections into a pinned footer on both the app and control panel sidebars.
Co-authored-by: Cursor <cursoragent@cursor.com>
isaaccladandClaude Opus 4.8