Make main the lean product a site receives

main was 16 days and 259 commits behind the line the product is actually built
on, at contract 0.30.0 against 0.35.0, with no per-PC credential code at all. It
was neither current nor curated - just stale. This brings it forward and, at the
same time, makes it mean something: main is what a receiving site installs, and
nothing else.

WHAT IT CARRIES. Twelve plugins - backups, computers, endpoints, guides,
knowledgebase, machines, network, notifications, printers, slides, tools,
warranty - plus applications, which is manifest-less core and always ships. The
only manifest dependency inside that set is endpoints on computers, and both are
in it, so the closure is self-contained.

WHAT IT DOES NOT. employees, geenforce, measuringtools, printedparts and usb
stay on the site line. So do the Windows installer tree, the VM rehearsal
helpers, the agent tooling config, one site's data loader, the internal audit
and findings records, and the planner spreadsheet. 1,135 tracked files against
1,438.

A REMOVAL THAT BREAKS THE APP IS NOT A REMOVAL, and two nearly shipped:

deploy/site-profile-universal.json still named all seventeen plugins. It is the
file docs/DEPLOY.md tells a site to provision from, so a fresh install would
have failed at `flask plugin apply-profile` with PluginError - the first thing a
receiving site does, broken by the branch meant to serve them. It now names the
twelve that exist, and its comment says the two must agree.

agent/ was never refreshed. Whoever populated this branch copied shopdb/,
plugins/, frontend/ and tests/ from the site line and left the agent tree at its
September state: 22 C# and PowerShell sources missing, including AgentCredentials,
EnrollmentService, AgentHttpFactory and the fleet-alert client, plus one file the
site line had deleted still present. The old tree is internally consistent, so it
compiles, and nothing in CI builds it - every gate was green over a server that
speaks enrollment and per-PC credentials to a bundled agent source that cannot.
Resynced whole.

DECISIONS THIS ENCODES, rather than defers:

- The plugin-authoring lab builds printedparts, whose manifest depends on
  employees, so it could not stay. The lab remains on the site line and main
  ships no build-along tutorial. That is a real loss for an adopting developer
  and is recorded here rather than discovered later.
- Recognition, Training and Recertification notifications are no longer seeded.
  Each splits one notification into a card per employee and renders a photo,
  which needs a plugin this branch does not bundle. Seeding them would offer an
  author a type that cannot resolve anybody. A site that installs employees gets
  them from that plugin's own seed.
- Windows/IIS is documented as the legacy path throughout, and the README leads
  with Docker, because that is what a receiving site gets.

The API description is regenerated for THIS branch - 347 paths and 483
operations, down from 415 and 573 - so the published contract describes what is
here rather than what the site line serves. docs/CONFIG.md lost the two
measuring-tool label keys the code no longer declares, which two lanes had
decided opposite ways.

Suite: 3124 passed, 6 skipped. Naming and style gates pass. The docs gates run
rather than skip, and every index line count is derived from the file it names.

plugins/computers/frontend/views/ActionPicker.vue

@@ -17,9 +17,13 @@
           v-for="opt in filteredCommands"
           :key="opt.action"
           class="action-option"
+          :class="{ 'action-locked': opt.mayauthor === false }"
           @mousedown.prevent="selectCommand(opt)"
         >
           {{ opt.label || opt.action }}
+          <span v-if="opt.mayauthor === false" class="action-lock-note">
+            needs {{ opt.requiredpermission }}
+          </span>
         </div>
         <div
           class="action-option action-branch"
@@ -171,6 +175,9 @@ function enterMonitorLevel() {
 }
 
 function selectCommand(opt) {
+  // The server refuses this action anyway; declining here turns a confusing 403
+  // on save into an obvious "you cannot pick that" at the point of choosing.
+  if (opt.mayauthor === false) return
   emit('update:modelValue', opt.action)
   open.value = false
   level.value = 'command'
@@ -254,6 +261,8 @@ function cancelCreate() {
 }
 .action-option { padding: 8px 12px; cursor: pointer; color: var(--text); }
 .action-option:hover { background: var(--bg); }
+.action-locked { opacity: 0.55; cursor: not-allowed; }
+.action-lock-note { font-size: 0.75rem; color: var(--text-light); margin-left: 6px; }
 .action-branch { font-style: italic; }
 .action-create { font-weight: 600; color: var(--primary); }
 .action-divider { height: 1px; background: var(--border); margin: 2px 0; }

plugins/computers/frontend/views/ConfigurationPoliciesList.vue

@@ -42,8 +42,8 @@
                   </span>
                 </td>
                 <td class="actions">
-                  <button class="btn btn-secondary btn-sm" :disabled="p.source !== 'local'" @click="openModal(p)">Edit</button>
-                  <button class="btn btn-danger btn-sm" :disabled="p.source !== 'local'" @click="remove(p)">Delete</button>
+                  <button class="btn btn-secondary btn-sm" :disabled="!iseditable(p)" @click="openModal(p)">Edit</button>
+                  <button class="btn btn-danger btn-sm" :disabled="!iseditable(p)" @click="remove(p)">Delete</button>
                 </td>
               </tr>
               <tr v-if="policies.length === 0">
@@ -140,7 +140,7 @@ const error = ref('')
 const form = ref(emptyForm())
 
 function emptyForm() {
-  return { name: '', description: '', scopejson: { type: 'true' }, actions: [] }
+  return { name: '', description: '', scopejson: { type: 'allpcs' }, actions: [] }
 }
 
 onMounted(() => loadData())
@@ -174,7 +174,9 @@ async function loadData() {
     }
 
     if (types.status === 'fulfilled') {
-      pctypes.value = types.value.data.data || []
+      // Plain array, same as applications below. Reading .data.data threw
+      // inside this try, so apps, actions and monitors never got assigned.
+      pctypes.value = types.value || []
     } else {
       failures.push('PC types')
       console.error('Error loading PC types:', types.reason)
@@ -219,7 +221,7 @@ function openModal(item = null) {
     form.value = {
       name: item.name || '',
       description: item.description || '',
-      scopejson: item.scopejson ? JSON.parse(JSON.stringify(item.scopejson)) : { type: 'true' },
+      scopejson: item.scopejson ? JSON.parse(JSON.stringify(item.scopejson)) : { type: 'allpcs' },
       actions: (item.actions || []).map(a => ({
         action: a.action, mode: a.mode || 'gate',
         desiredstate: a.desiredstate, params: a.params, intervalminutes: a.intervalminutes
@@ -285,6 +287,18 @@ async function save() {
   }
 }
 
+// Mirrors the API guard in plugins/computers/api/policy_routes.py: local,
+// autoapp and shipped rows are all editable. A shipped row is a starting point
+// the product supplies, not a fixed opinion, and it keeps source='shipped' so
+// provenance survives the edit. Only a genuinely external managed owner is
+// read-only. Disabling on source==='local' alone stranded shipped rows behind
+// dead buttons while the API was accepting the write.
+const EDITABLE_SOURCES = ['local', 'autoapp', 'shipped']
+
+function iseditable(p) {
+  return EDITABLE_SOURCES.includes(p.source)
+}
+
 async function remove(p) {
   if (!confirm(`Delete configuration policy "${p.name}"?`)) return
   try {

plugins/computers/frontend/views/PCForm.vue

@@ -573,12 +573,14 @@ onMounted(async () => {
       operatingsystemsApi.list({ perpage: 100 }),
       computersApi.protocols.list(),
       businessunitsApi.listAll(),
-      // Handles its own failure: a site without printers still gets a form.
     ])
 
     pcTypes.value = ptRes.data.data || []
     statuses.value = statusRes.data.data || []
-    vendors.value = vendorRes.data.data || []
+    // listAll() pages past the server's 100-row cap and returns the ROWS, not
+    // an axios response, so these are read directly. Reading .data.data here
+    // throws and takes the whole form down with it.
+    vendors.value = vendorRes || []
     models.value = allModels
     locations.value = locRes || []
     operatingsystems.value = osRes.data.data || []
@@ -636,7 +638,11 @@ onMounted(async () => {
     }
   } catch (err) {
     console.error('Error loading data:', err)
-    error.value = 'Failed to load data'
+    // A client-side TypeError has no err.response, so apiError() would report
+    // only the fallback and hide which field broke. Name it either way.
+    error.value = err?.response
+      ? apiError(err, 'Failed to load data')
+      : `Failed to load data: ${err?.message || err}`
   } finally {
     loading.value = false
   }

plugins/computers/frontend/views/PCTypeMappingSettings.vue

@@ -7,16 +7,14 @@
     <div class="section-card">
       <div class="setting-group">
         <p class="setting-description">
-          This page has been retired. Imaging pc-type handling now lives in
-          GE-Enforce, where each imaging PC type is a manifest scope with its own
-          Computer Type. Manage it from the GE-Enforce section instead.
+          This page has been retired. An imaging PC type is now decided by
+          whatever provisions the machine, not configured here.
         </p>
         <p class="setting-description">
           The collector still applies the built-in pc-type to Computer Type
           defaults, so existing enrollment keeps working; there is nothing to
           configure here anymore.
         </p>
-        <RouterLink class="btn" to="/geenforce/manifests">Open GE-Enforce</RouterLink>
       </div>
     </div>
   </div>
@@ -24,7 +22,7 @@
 
 <script setup>
 // Deprecated page. Kept only so the /settings/pctypemapping route and old
-// bookmarks still resolve; GE-Enforce (scope computertypeid) supersedes the old
-// collector pc-type mapping UI. See ADR-012.
-import { RouterLink } from 'vue-router'
+// bookmarks still resolve. The "open the tool that replaced this" link went
+// with the plugin that served it, and a button to a route this build has no
+// page for is worse than no button.
 </script>

plugins/computers/frontend/views/PCTypesList.vue

@@ -107,8 +107,9 @@ onMounted(() => loadData())
 async function loadData() {
   loading.value = true
   try {
-    const response = await computersApi.types.listAll({ active: false })
-    pcTypes.value = response.data.data || []
+    // listAll() pages past the server's 100-row cap and returns the ROWS, not
+    // an axios response - there is no .data to unwrap.
+    pcTypes.value = await computersApi.types.listAll({ active: false })
   } catch (err) {
     console.error('Error loading PC types:', err)
   } finally {

plugins/computers/frontend/views/PCsList.vue

@@ -33,6 +33,7 @@
             <thead>
               <tr>
                 <th>Asset Tag</th>
+                <th>Alias</th>
                 <th>Hostname</th>
                 <th>Serial Number</th>
                 <th>PC Type</th>
@@ -45,6 +46,7 @@
             <tbody>
               <tr v-for="item in computers" :key="item.assetid" class="clickable-row" @click="$router.push(`/pcs/${item.computer?.computerid || item.assetid}`)">
                 <td>{{ item.assetnumber }}</td>
+                <td>{{ item.name || '-' }}</td>
                 <td>{{ item.computer?.hostname || '-' }}</td>
                 <td class="mono">{{ item.serialnumber || '-' }}</td>
                 <td>{{ item.computer?.computertypename || '-' }}</td>

plugins/computers/frontend/views/ScopeNodeEditor.vue

@@ -2,7 +2,8 @@
   <div class="scope-node">
     <div class="scope-node-row">
       <select v-model="node.type" class="form-control scope-type" @change="onTypeChange">
-        <option value="true">Matches everything</option>
+        <option value="allpcs">All PCs (excludes servers)</option>
+        <option v-if="node.type === 'true'" value="true">Matches everything (incl. servers)</option>
         <option value="pctype">PC type is</option>
         <option value="app">App is installed</option>
         <option value="and">ALL of (AND)</option>
@@ -71,20 +72,20 @@ function onTypeChange() {
   delete node.nodes
   delete node.node
   if (node.type === 'and' || node.type === 'or') {
-    node.nodes = [{ type: 'true' }]
+    node.nodes = [{ type: 'allpcs' }]
   } else if (node.type === 'not') {
-    node.node = { type: 'true' }
+    node.node = { type: 'allpcs' }
   }
 }
 
 function addChild() {
-  props.node.nodes.push({ type: 'true' })
+  props.node.nodes.push({ type: 'allpcs' })
 }
 
 function removeChild(index) {
   props.node.nodes.splice(index, 1)
   if (props.node.nodes.length === 0) {
-    props.node.nodes.push({ type: 'true' })
+    props.node.nodes.push({ type: 'allpcs' })
   }
 }
 </script>

plugins/computers/frontend/views/configurationPolicyEditable.spec.js

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'fs'
+import { fileURLToPath } from 'url'
+import { dirname, join } from 'path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const view = readFileSync(join(here, 'ConfigurationPoliciesList.vue'), 'utf8')
+
+// The API decides what may be edited; the buttons only reflect that decision.
+// These drifted once: policy_routes.py was widened to accept shipped rows while
+// the buttons still disabled on source !== 'local', so every shipped policy sat
+// behind a dead Edit button and the change looked like it had never rolled.
+// If the API guard changes, EDITABLE_SOURCES here changes with it.
+describe('the configuration policy buttons follow the API guard', () => {
+  it('treats shipped as editable, not read-only', () => {
+    expect(view).toContain("EDITABLE_SOURCES = ['local', 'autoapp', 'shipped']")
+  })
+
+  it('does not gate the buttons on local alone', () => {
+    expect(view).not.toContain(":disabled=\"p.source !== 'local'\"")
+  })
+
+  it('gates edit and delete on the same rule', () => {
+    const disabled = view.match(/:disabled="!iseditable\(p\)"/g) || []
+    expect(disabled).toHaveLength(2)
+  })
+})

plugins/computers/frontend/views/pcDetailCredential.spec.js

@@ -0,0 +1,58 @@
+/**
+ * Per-PC credential controls on PC Details.
+ *
+ * Revoke and allow-reenroll are admin-role routes on the server. The page reads
+ * the credential from the same endpoint state call the liveness chip uses, and
+ * offers the two actions to admins only; every other reader gets the state in
+ * the Endpoint status card, where the server has already redacted the details.
+ *
+ * Asserted against the file text, matching pcDetailRunScripts.spec.js.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const source = readFileSync(join(here, 'PCDetail.vue'), 'utf8')
+// Relative to the staged copy under src/.plugins-staged/, which is what runs.
+const api = readFileSync(join(here, '..', '..', '..', 'api', 'index.js'), 'utf8')
+
+describe('PCDetail credential controls', () => {
+  it('gates the controls on the admin role', () => {
+    expect(source).toMatch(/const canManageCredential = computed\(\(\) => authStore\.isAdmin\)/)
+    expect(source).toMatch(/v-if="canManageCredential && credential"/)
+  })
+
+  it('reads the credential from the endpoint state response', () => {
+    const loader = source.slice(source.indexOf('async function loadLiveness'))
+    const body = loader.slice(0, loader.indexOf('\n}\n'))
+    expect(body).toMatch(/credential\.value = state\.credential \|\| null/)
+  })
+
+  it('offers revoke only for an enrolled PC and allow only for a blocked one', () => {
+    expect(source).toMatch(/v-if="credential\.state === 'enrolled'"[\s\S]{0,120}credential-revoke/)
+    expect(source).toMatch(/v-if="credential\.reenrollblocked"[\s\S]{0,120}credential-allow/)
+  })
+
+  it('offers the keep-from-enrolling option and sends it with the reason', () => {
+    expect(source).toMatch(/v-model="revokeblockreenroll"/)
+    expect(source).toMatch(/Keep this PC from enrolling again/)
+    const handler = source.slice(source.indexOf('async function submitRevokeCredential'))
+    const body = handler.slice(0, handler.indexOf('\n}\n'))
+    expect(body).toMatch(/blockreenroll: revokeblockreenroll\.value/)
+    expect(body).toMatch(/reason: revokereason\.value\.trim\(\)/)
+  })
+
+  it('calls the existing enrollment routes', () => {
+    expect(api).toMatch(/`\/endpoints\/enrollment\/assets\/\$\{assetId\}\/revoke`/)
+    expect(api).toMatch(/`\/endpoints\/enrollment\/assets\/\$\{assetId\}\/allow-reenroll`/)
+    expect(api).toMatch(/if \(opts\.blockreenroll\) \{\s*body\.blockreenroll = true/)
+  })
+
+  it('confirms before allowing re-enrollment', () => {
+    const handler = source.slice(source.indexOf('async function confirmAllowReenroll'))
+    const body = handler.slice(0, handler.indexOf('\n}\n'))
+    expect(body).toMatch(/if \(!confirm\(/)
+  })
+})

plugins/computers/frontend/views/pcDetailRunScripts.spec.js

@@ -0,0 +1,95 @@
+/**
+ * Run Scripts tab on PC Details.
+ *
+ * The thing worth pinning here is the SEPARATION. run_script and
+ * scheduledtask_run map to different grants in plugins/endpoints/commands.py
+ * (endpoints.runscript and endpoints.corptools), split out of a single
+ * endpoints.deploy bundle precisely so that being able to trigger a corporate
+ * tool does not also mean being able to run arbitrary PowerShell as SYSTEM.
+ *
+ * That split lives in the backend. The UI can quietly undo it by hanging the
+ * script picker off the Corporate Tools tab, whose only gate is
+ * endpoints.corptools - and the failure would be invisible in review, because
+ * the page would look correct and the server would simply 403 the push. These
+ * tests fail if someone merges the two.
+ *
+ * Asserted against the file text, matching systemScriptsSettings.spec.js.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const source = readFileSync(join(here, 'PCDetail.vue'), 'utf8')
+
+describe('PCDetail Run Scripts tab', () => {
+  it('gates the tab on endpoints.runscript, not the Corporate Tools grant', () => {
+    expect(source).toMatch(
+      /const canRunScript = computed\(\(\) => authStore\.hasPermission\('endpoints\.runscript'\)\)/)
+  })
+
+  it('pushes run_script from its own tab, not from the Corporate Tools block', () => {
+    // The corptools block must not gain a run_script call: that would put the
+    // action behind endpoints.corptools in the UI while the server still
+    // demands endpoints.runscript.
+    const corptools = source.slice(
+      source.indexOf("activegroup === 'corptools'"),
+      source.indexOf("activegroup === 'runscripts'"))
+    expect(corptools).not.toMatch(/run_script/)
+    expect(source).toMatch(/activegroup === 'runscripts'/)
+  })
+
+  it('enqueues run_script with a script-id target', () => {
+    expect(source).toMatch(/'run_script', `script:\$\{script\.scriptid\}`/)
+  })
+
+  it('requires a typed confirmation before running', () => {
+    // Every script on this tab is arbitrary code, so unlike Corporate Tools
+    // there is no safe branch that gets a plain OK button.
+    const handler = source.slice(source.indexOf('async function confirmRunScript'))
+    const body = handler.slice(0, handler.indexOf('\n}\n'))
+    expect(body).toMatch(/Type RUN to confirm/)
+    expect(body).toMatch(/typed !== 'RUN'/)
+  })
+
+  it('warns that a script runs as SYSTEM before it is sent', () => {
+    const tab = source.slice(source.indexOf("activegroup === 'runscripts'"))
+    expect(tab.slice(0, 2000)).toMatch(/runs as SYSTEM/)
+  })
+
+  it('shows the run context and working directory read-only', () => {
+    // Both are authoring decisions made in the library. Offering an override
+    // here would mean the script that ran is not the script that was reviewed,
+    // so they must be rendered as facts and never bound with v-model.
+    const tab = source.slice(source.indexOf("activegroup === 'runscripts'"))
+    const block = tab.slice(0, tab.indexOf('runscripts-actions'))
+    expect(block).toMatch(/selectedscript\.workingdirectory/)
+    expect(block).toMatch(/selectedscript\.runcontext/)
+    expect(block).not.toMatch(/v-model="[^"]*workingdirectory/)
+    expect(block).not.toMatch(/v-model="[^"]*runcontext/)
+  })
+
+  it('offers only scripts that have a body', () => {
+    // A bodyless script is rejected at enqueue by _resolve_run_script, so
+    // listing it would offer a button whose only outcome is an error.
+    expect(source).toMatch(/filter\(\(script\) => script\.hasbody\)/)
+  })
+
+  it('reports the push as queued rather than as finished', () => {
+    // The agent collects the command on its next check-in; claiming it ran
+    // would assert an outcome nothing has observed.
+    const handler = source.slice(source.indexOf('async function confirmRunScript'))
+    expect(handler.slice(0, handler.indexOf('\n}\n'))).toMatch(/queued for/)
+  })
+
+  it('styles the Run Scripts tab from defined theme tokens only', () => {
+    // --text-primary/--text-secondary/--bg-secondary are not defined by this
+    // app's theme. var() then falls through to the fallback, or to inherit,
+    // which reads fine in light mode and misrenders for dark-mode users - the
+    // failure only shows up on the theme most of the shop floor runs.
+    const runscripts = source.slice(source.indexOf('.corptools-intro'))
+    expect(runscripts).not.toMatch(/--text-primary|--text-secondary|--bg-secondary|--surface/)
+    expect(runscripts).not.toMatch(/var\(--[a-z-]+,\s*#/)
+  })
+})