Release 1.8.1: Redis persistence fix (#20)

in-flight OAuth logins, and any admin-created API token

redis-server ran with --save '' --appendonly no (deliberately ephemeral,
per the original "audit/metrics/session storage" framing). That stopped
being a safe assumption once API tokens (PATs) lived in this same Redis
-- a PAT is supposed to be a stable, long-lived credential, not
disposable session state, but every `docker rm -f jump-host` + rebuild
silently invalidated every one that existed.

Matches proxy's existing pattern exactly: AOF + periodic RDB persisted
to $REDIS_DATA_DIR (default /data), which the deployment mounts as a
volume (see the companion theta-env change).

Verified against a live container: minted a real PAT, force-recreated
the container (docker rm -f + rebuild), confirmed the same token still
authenticates afterward.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.8.1] - 2026-07-28
+
+### Fixed
+- **Redis had zero persistence** (`--save '' --appendonly no`, no data-dir volume) — every container rebuild/recreation silently wiped all sessions, in-flight OAuth logins, and any admin-created API token. This is why re-running `setup.sh` appeared to "break OAuth with jump": the jump-host container gets recreated, and any token or in-flight login vanished with it. Now Redis persists (AOF + periodic RDB) to `/data`, mounted as a named volume (`jump-redis-data`) in theta-env's compose file. Verified live: minted a PAT, force-recreated the container, confirmed the same PAT still authenticated afterward.
+
+## [1.8.0] - 2026-07-28
+
+### Fixed
+- **TUI-mode SSH connections (a bare `ssh user@host`, no target) could drop with "PTY allocation request failed" / "shell request failed"** — `runTuiSession` awaited two real round-trips (an audit-log write, then a directory API call) *before* attaching the session's pty/shell/exec listeners, so a client that sent those requests quickly enough got auto-rejected by ssh2 before anything was listening. `runGrammar` (the `uid_-_target` path) already had the equivalent fix; this ports it to the picker path.
+- **`formAJAX`'s loading indicator showed literal HTML**, not a spinner — same fix as sso-manager-node/proxy's companion releases.
+
+## [1.7.1] - 2026-07-28
+
+### Added
+- **Regression test**: a static check across all views/client-side scripts fails CI if any native `alert()`/`confirm()`/`prompt()` call appears — these block all further browser events on the page. This app has never had one; keeps it that way.
+
 ## [1.7.0] - 2026-07-27
 
 ### Added

docker-entrypoint.sh

@@ -12,9 +12,17 @@ if [[ -f /config/jump-secrets.js ]]; then
 	info "Loaded config from /config/jump-secrets.js"
 fi
 
-# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379).
+# Redis for audit/metrics/session AND api-token storage (app connects to
-info "Starting redis..."
+# 127.0.0.1:6379). Persisted (AOF + periodic RDB) to /data, which the
-redis-server --daemonize yes --save '' --appendonly no
+# deployment should mount as a volume -- without this, every container
+# recreation silently wiped every session, in-flight OAuth login, and any
+# admin-created API token, which is especially bad for the last one since a
+# PAT is meant to be a stable, long-lived credential, not session state.
+REDIS_DATA_DIR="${REDIS_DATA_DIR:-/data}"
+mkdir -p "$REDIS_DATA_DIR"
+info "Starting redis (AOF persisted to $REDIS_DATA_DIR)..."
+redis-server --daemonize yes --dir "$REDIS_DATA_DIR" --appendonly yes \
+	--appendfilename appendonly.aof --save 900 1 --save 300 10 --save 60 10000
 
 # Wait for redis to answer before starting the app.
 for _ in $(seq 1 20); do

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {

nodejs/public/lib/js/app-base.js

@@ -679,13 +679,10 @@ function formAJAX(btn){
 		return false;
 	}
 
-	app.messages.action(
+	// Plain text: app.messages.action HTML-escapes its message (by design,
-		`<div class="spinner-border" role="status">
+	// see @simpleworkjs/frontend), so raw markup like a spinner <div> would
-			<span class="visually-hidden">Loading...</span>
+	// render literally instead of as an element.
-		</div>`,
+	app.messages.action('Saving…', $form, 'info');
-		$form,
-		'info'
-	);
 
 	app.api[method]($form.attr('action'), formData, function(error, data){
 		app.messages.action(data.message, $form, error ? 'danger' : 'success'); //re-populate table

nodejs/services/ssh_server.js

@@ -180,6 +180,23 @@ async function runGrammar(session, client, state) {
 }
 
 async function runTuiSession(session, client, state) {
+	// Register session listeners IMMEDIATELY, before any await — same fix,
+	// same reason, as runGrammar above. The client sends pty-req and shell
+	// requests right after opening the session; awaiting audit.create() and
+	// accessibleHosts() first (both real round-trips: Redis, then the
+	// directory API) left a window where those requests could arrive before
+	// runTui had attached any listener for them, and ssh2 auto-rejects an
+	// unlistened channel request with CHANNEL_FAILURE — surfacing to the
+	// client as "PTY allocation request failed" / "shell request failed",
+	// with the connection then just sitting there (nothing left to drive it).
+	let resolveHosts, rejectHosts;
+	const hostsPromise = new Promise((res, rej) => { resolveHosts = res; rejectHosts = rej; });
+	// A silent catch so a rejection isn't "unhandled" if the client never
+	// sends a shell request at all (exec-only) — runTui's own .catch() below
+	// still runs independently when it does.
+	hostsPromise.catch(() => {});
+	const tuiPromise = runTui(session, state.uid, hostsPromise);
+
 	const record = await audit.create({ uid: state.uid, authMethod: state.authMethod, clientIp: state.clientIp, mode: 'tui' });
 
 	const finishFail = async (reason) => {
@@ -189,10 +206,15 @@ async function runTuiSession(session, client, state) {
 	};
 
 	let hosts;
-	try { hosts = await accessibleHosts(state.user); }
+	try {
-	catch (_) { return finishFail('directory-unreachable'); }
+		hosts = await accessibleHosts(state.user);
+		resolveHosts(hosts);
+	} catch (_) {
+		rejectHosts(new Error('directory-unreachable'));
+		return finishFail('directory-unreachable');
+	}
 
-	const tui = await runTui(session, state.uid, hosts);
+	const tui = await tuiPromise;
 	if (!tui.host) return finishFail('cancelled');
 	state.target = tui.host.slug;
 
@@ -253,7 +275,10 @@ function reasonMessage(reason) {
 
 // Run the TUI picker over a shell channel; returns { host, channel, ptyInfo }.
 // host is null if the user quit. exec/subsystem in picker mode are rejected.
-function runTui(session, uid, hosts) {
+// Takes a Promise for the accessible-hosts list (not the resolved list)
+// so the caller can register these listeners before that lookup completes
+// — see the comment in runTuiSession for why that ordering matters.
+function runTui(session, uid, hostsPromise) {
 	return new Promise((resolve) => {
 		let ptyInfo = null;
 		let settled = false;
@@ -262,9 +287,14 @@ function runTui(session, uid, hosts) {
 		session.on('pty', (accept, _reject, info) => { ptyInfo = info; accept && accept(); });
 		session.on('shell', (accept) => {
 			const channel = accept();
-			pickHost(channel, uid, hosts).then((host) => {
+			hostsPromise.then((hosts) => {
-				if (!host) { try { channel.write('\r\n  Bye.\r\n'); channel.close(); } catch (_) {} }
+				pickHost(channel, uid, hosts).then((host) => {
-				finish({ host, channel, ptyInfo });
+					if (!host) { try { channel.write('\r\n  Bye.\r\n'); channel.close(); } catch (_) {} }
+					finish({ host, channel, ptyInfo });
+				});
+			}).catch(() => {
+				try { channel.write('\r\n  Could not reach the directory.\r\n'); channel.close(); } catch (_) {}
+				finish({ host: null });
 			});
 		});
 		session.on('exec', (accept) => {

nodejs/test/unit/no_native_dialogs.test.js

@@ -0,0 +1,43 @@
+'use strict';
+
+// Regression guard: native alert()/confirm()/prompt() calls block all further
+// browser events on the page (found live, mid browser-automation testing, on
+// sso-manager-node's equivalent secret-rotate flow) and are visually
+// inconsistent with the rest of the UI. This app has no such call sites;
+// keep it that way.
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const ROOTS = ['views', 'public/js', 'public/lib/js'].map((d) => path.join(__dirname, '..', '..', d));
+
+const NATIVE_DIALOG_RE = /(^|[^.\w$])(alert|confirm|prompt)\s*\(/g;
+
+function walk(dir) {
+	let files = [];
+	if (!fs.existsSync(dir)) return files;
+	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) files = files.concat(walk(full));
+		else if (/\.(ejs|js)$/.test(entry.name)) files.push(full);
+	}
+	return files;
+}
+
+test('no view or client-side script calls native alert()/confirm()/prompt()', () => {
+	const offenders = [];
+	for (const root of ROOTS) {
+		for (const file of walk(root)) {
+			const src = fs.readFileSync(file, 'utf8');
+			let m;
+			NATIVE_DIALOG_RE.lastIndex = 0;
+			while ((m = NATIVE_DIALOG_RE.exec(src))) {
+				const line = src.slice(0, m.index).split('\n').length;
+				offenders.push(`${path.relative(path.join(__dirname, '..', '..'), file)}:${line} — ${m[2]}(`);
+			}
+		}
+	}
+	assert.deepStrictEqual(offenders, []);
+});