v0.31.5

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.31.4"
+assert manifest["package"]["version"] == "0.31.5"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.20" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.31.4"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.31.5"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.31.4",
-    "CHANGELOG.md": "## 0.31.4",
-    "ROADMAP.md": "## 0.31.4",
-    "AGENTS.md": "Current source version: 0.31.4.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.4",
+    "README.md": "# RustProxy 0.31.5",
+    "CHANGELOG.md": "## 0.31.5",
+    "ROADMAP.md": "## 0.31.5",
+    "AGENTS.md": "Current source version: 0.31.5.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.5",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.31.4"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.31.5"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -536,7 +536,7 @@ for marker in [
     "administration_https_health_accepts_http2_authority_without_host_header",
 ]:
     assert marker in admin, marker
-assert '"/assets/streams.js"' in admin and '"metrics": stream_metrics' in admin
+assert '"/assets/streams.js"' in (root / 'src/admin/panel_assets.rs').read_text() and '"metrics": stream_metrics' in admin
 for marker in ['"/api/config/{section}"', 'async fn update_section', 'section_updates_are_revisioned_and_do_not_require_full_config_payloads', 'panel_subpage_routes_survive_browser_refresh', 'fn panel_document_path', 'panel_document_path(&path)', 'certificate_metadata', 'inspected_metadata', 'session_at_with_browser_lifetime', 'session_lifetime_seconds', 'HeaderValue::from_str(&auth::session_cookie(']:
     assert marker in admin, marker
 for route in ['/overview', '/vhosts', '/redirects', '/404-hosts', '/streams', '/acl-profiles', '/configuration', '/tls', '/cache', '/transform', '/logging', '/settings']:
@@ -1394,7 +1394,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.31.4"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.31.5"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1633,5 +1633,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.31.4 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.31.5 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/dashboard_boot_0311_ui_test.mjs

@@ -15,8 +15,8 @@ const bundle = read('tools/checks/web_assets.py');
 const version = read('Cargo.toml').match(/^version\s*=\s*"([\d.]+)"/m)?.[1];
 assert(version);
 assert.equal((html.match(/<script defer="" src="\/assets\//g) || []).length, 1, 'one atomic dashboard script');
-assert.match(html, /src="\/assets\/app\.js\?v=__RUSTPROXY_VERSION__"/);
-assert.match(html, /href="\/assets\/style\.css\?v=__RUSTPROXY_VERSION__"/);
+assert.match(html, /src="\/assets\/app___RUSTPROXY_ASSET_ID__\.js"/);
+assert.match(html, /href="\/assets\/style___RUSTPROXY_ASSET_ID__\.css"/);
 assert.match(router, /admin_vhosts_javascript\(\)/);
 assert.match(bundle, /"integrations\.js", "vhosts\.js"/);
 assert(router.indexOf('include_str!("web/integrations.js")') < router.indexOf('admin_vhosts_javascript(),'));
@@ -86,4 +86,4 @@ async function configRetry(failures) {
 }
 assert.deepEqual(await configRetry(2), { config: 3, fallback: 0, status: 1 });
 assert.deepEqual(await configRetry(3), { config: 3, fallback: 1, status: 0 });
-console.log(`PASS: ${version} one versioned JS payload, DOM/module-gated startup, retries and visible failure`);
+console.log(`PASS: ${version} one build-fingerprinted JS payload, DOM/module-gated startup, retries and visible failure`);

tools/checks/dependency_upgrade_0312.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Check the 0.31.4 dependency/source migration; optionally require a resolved lock.
+"""Check the 0.31.5 dependency/source migration; optionally require a resolved lock.
 
 This is not a substitute for rustc, cargo metadata or runtime tests.
 """
@@ -14,7 +14,7 @@ parser = argparse.ArgumentParser()
 parser.add_argument('--require-lock', action='store_true', help='Require the post-upgrade Cargo.lock produced by cargo update')
 args = parser.parse_args()
 manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
-assert manifest['package']['version'] == '0.31.4'
+assert manifest['package']['version'] == '0.31.5'
 assert manifest['package']['rust-version'] == '1.99'
 deps = manifest['dependencies']
 expected_requirements = {
@@ -78,4 +78,4 @@ if missing:
     print(f'PENDING: lockfile still requires cargo update ({details})')
 else:
     print('PASS: pinned key packages found in post-upgrade lock; cargo --locked verification is still required')
-print('PASS: 0.31.4 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')
+print('PASS: 0.31.5 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.31.4 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.31.5 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -29,7 +29,7 @@ required = [
     DOCS / "V0.25.2_AUDIT.md",
     DOCS / "V0.25.1_AUDIT.md",
     DOCS / "V0.25.0_AUDIT.md",
-    DOCS / "IMPLEMENTATION_0.31.4.md",
+    DOCS / "IMPLEMENTATION_0.31.5.md",
     DOCS / "IMPLEMENTATION_0.31.3.md",
     DOCS / "IMPLEMENTATION_0.31.1.md",
     DOCS / "TEST_REPORT.md",
@@ -67,7 +67,7 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.31.4")
+assert readme.startswith("# RustProxy 0.31.5")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme

tools/checks/file_logs_tabs_0315_ui_test.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+const read = path => fs.readFileSync(new URL(`../../${path}`, import.meta.url), 'utf8');
+const html = read('src/admin/web/index.html');
+const js = read('src/admin/web/file-logs.js');
+const css = read('src/admin/web/style.css');
+const en = JSON.parse(read('langs/en_US.json')).translations;
+const pl = JSON.parse(read('langs/pl_pl.json')).translations;
+const header = html.indexOf('class="file-logs-heading-actions"');
+const filter = html.indexOf('id="file-logs-filter"');
+const toggle = html.indexOf('id="file-log-consolidate-vhosts"');
+assert.ok(header >= 0 && header < toggle && toggle < filter, 'compact consolidation switch belongs in header');
+assert.equal((html.match(/id="file-log-consolidate-vhosts"/g) || []).length, 1);
+for (const view of ['entries','counts']) {
+    assert.match(html, new RegExp(`id="file-log-tab-${view}"[^>]+role="tab"`));
+    assert.match(html, new RegExp(`id="file-log-view-${view}"[^>]+role="tabpanel"`));
+}
+assert.match(html, /id="file-log-view-counts"[^>]+hidden/);
+assert.ok(html.indexOf('id="file-log-aggregate-form"') > html.indexOf('id="file-log-view-counts"'));
+assert.ok(html.indexOf('id="file-log-aggregate-form"') < html.indexOf('id="file-log-view-entries"'));
+assert.match(js, /function setView\(view\)/);
+assert.match(js, /aria-selected/);
+assert.match(js, /\$\("file-log-view-" \+ name\)\.hidden = !selected/);
+assert.match(js, /activeView === "counts" && aggregateField/);
+assert.match(js, /localStorage\.setItem\(CONSOLIDATION_STORAGE_KEY/);
+assert.match(css, /#file-log-view-counts\[hidden\], #file-log-view-entries\[hidden\]/);
+for (const strings of [en, pl]) for (const key of ['fileLogsConsolidateShort', 'fileLogsEntriesTab','fileLogsCountsTab']) assert.ok(strings[key], key);
+console.log('PASS: Stored Logs separate tabs, shared filter, compact persisted consolidation toggle, localized UI.');

tools/checks/panel_cache_http_0310_ui_test.mjs

@@ -24,7 +24,8 @@ for (const codec of ['zstd', 'br', 'gzip']) {
   assert(assets.includes('"/assets/app.js"'));
 }
 for (const path of ['app.js','management.js','vhosts.js','settings.js','cache-panel.js','traffic-panel.js','style.css','langs.json']) {
-  assert(router.includes(`"/assets/${path}", get(panel_assets::serve)`), path);
+  if (path === "langs.json") assert(router.includes(`"/assets/${path}", get(panel_assets::serve)`), path);
+  else assert(router.includes('"/assets/{fingerprinted}"'), path);
   assert(assets.includes(`"/assets/${path}"`), path);
 }
 assert(compression.includes('preferred_encoding(headers, &settings)'));

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.31.4 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.31.5 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.31.4 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.31.5 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.31.4"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.31.5"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.31.4"
+    assert manifest["to_version"] == "0.31.5"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -617,7 +617,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.4"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.5"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -971,8 +971,8 @@ def source_contract_smoke() -> None:
     assert proxy.index("RustProxy: denied by access policy") < proxy.index("if let Some(spec) = &route.response") < proxy.index("let (backend, backend_lease, affinity_cookie)")
     assert "pub client_ip: Option<String>" in logging and "client_ip" in logging
     admin_assets = (ROOT / "src/admin/panel_assets.rs").read_text(encoding="utf-8")
-    assert '"metrics": stream_metrics' in admin and '"/assets/streams.js"' in admin and 'include_str!("web/streams.js")' in admin_assets
-    assert '.route("/404-hosts", get(public::index))' in admin and '"/assets/host404.js"' in admin and 'include_str!("web/host404.js")' in admin_assets and '"not_found_hosts"' in admin
+    assert '"metrics": stream_metrics' in admin and '"/assets/streams.js"' in admin_assets and 'include_str!("web/streams.js")' in admin_assets
+    assert '.route("/404-hosts", get(public::index))' in admin and '"/assets/host404.js"' in admin_assets and 'include_str!("web/host404.js")' in admin_assets and '"not_found_hosts"' in admin
     assert "session_at_with_browser_lifetime" in admin and "session_lifetime_seconds" in admin
     assert '/api/preferences' in admin and 'live_log_columns' in admin
     assert 'default_admin_theme' in admin and '"dark" | "light"' in admin
@@ -989,7 +989,7 @@ def source_contract_smoke() -> None:
     tls_source = rust_source(ROOT, "src/tls.rs")
     for marker in ["CertificateMetadata", "not_before_unix", "not_after_unix", "days_remaining", "expiry_status"]:
         assert marker in tls_source, marker
-    assert '"/assets/redirects.js"' in admin and 'include_str!("web/redirects.js")' in admin_assets and '.route("/redirects", get(public::index))' in admin
+    assert '"/assets/redirects.js"' in admin_assets and 'include_str!("web/redirects.js")' in admin_assets and '.route("/redirects", get(public::index))' in admin
     assert '/Ubuntu%2014.04%20LTS/' in acl and 'repeated_slashes_are_normalized_for_routing' in acl and 'percent_encoded_spaces_are_valid_request_paths' in policies and 'repeated_slashes_route_normally_but_reach_upstream_unchanged' in policies and 'local_location_response_uses_response_rules_without_opening_backend' in policies and 'local_location_response_still_respects_route_acl' in policies
     db_source = rust_source(ROOT, "src/db.rs")
     acme_source = rust_source(ROOT, "src/acme.rs")
@@ -1108,7 +1108,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.31.4"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.31.5"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1313,7 +1313,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.31.4 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.31.5 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/security_logs_0315_ui_test.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+
+const read = path => fs.readFileSync(new URL(`../../${path}`, import.meta.url), 'utf8');
+const json = path => JSON.parse(read(path));
+
+const manifest = read('Cargo.toml');
+const lib = read('src/lib.rs');
+const model = read('src/config/model.rs');
+const vhost = read('src/vhost/model.rs');
+const forward = read('src/proxy/forward_entry.rs');
+const loggingApi = read('src/admin/logging_api.rs');
+const ua = read('src/user_agent.rs');
+const stored = read('src/admin/file_logs.rs') + read('src/admin/file_logs_query.rs') + read('src/admin/file_log_search.rs');
+const html = read('src/admin/web/index.html');
+const core = read('src/admin/web/app/core.js');
+const editor = read('src/admin/web/vhosts/editor.js');
+const traffic = read('src/admin/web/traffic-panel.js');
+const fileLogs = read('src/admin/web/file-logs.js');
+const openapi = json('src/admin/openapi.json');
+const en = json('langs/en_US.json').translations;
+const pl = json('langs/pl_pl.json').translations;
+
+assert.match(manifest, /version = "0\.31\.5"/);
+assert.match(lib, /pub mod user_agent;/);
+assert.match(model, /user_agent_blocking: crate::user_agent::Policy/);
+assert.match(vhost, /user_agent_blocking: crate::user_agent::Policy/);
+assert.match(loggingApi, /"user-agent-blocking"/);
+assert.match(ua, /MAX_PATTERNS: usize = 128/);
+assert.match(ua, /candidate\.contains\(pattern\)/);
+assert.match(ua, /pattern\.contains\('\*'\)/);
+const denyPos = forward.indexOf('denied by User-Agent policy');
+const redirectPos = forward.indexOf('let redirect = snapshot.redirect_on');
+assert.ok(denyPos > 0 && redirectPos > denyPos, 'UA policy must run before redirect/origin processing');
+
+assert.match(html, /id="global-ua-block-form"/);
+assert.match(core, /saveSection\("user-agent-blocking"/);
+assert.match(editor, /"ua-block-patterns"/);
+assert.match(traffic, /traffic-copy-value/);
+assert.match(traffic, /navigator\.clipboard\?\.writeText/);
+
+assert.match(html, /id="file-log-consolidate-vhosts"/);
+assert.match(html, /id="file-log-aggregate-form"/);
+assert.match(stored, /group_id/);
+assert.match(stored, /consolidate_vhosts/);
+assert.match(stored, /aggregate_field/);
+assert.match(stored, /FILE_LOG_MAX_AGGREGATE_VALUES: usize = 4096/);
+assert.match(fileLogs, /member_count/);
+assert.match(fileLogs, /rp-file-logs-consolidate-vhosts/);
+assert.match(fileLogs, /localStorage\.getItem\(CONSOLIDATION_STORAGE_KEY\)/);
+assert.match(fileLogs, /localStorage\.setItem\(CONSOLIDATION_STORAGE_KEY/);
+assert.match(fileLogs, /aggregate_min_count/);
+assert.match(fileLogs, /file-log-aggregate-copy/);
+
+assert.equal(openapi.info.version, '0.31.5');
+assert.ok(openapi.components.schemas.Config.properties.user_agent_blocking);
+assert.ok(openapi.components.schemas.Vhost.properties.user_agent_blocking);
+assert.ok(openapi.components.schemas.FileLogSource.properties.group_id);
+const params = openapi.paths['/api/file-logs/query'].get.parameters.map(item => item.name);
+for (const name of ['consolidate_vhosts', 'aggregate_field', 'aggregate_min_count', 'aggregate_limit']) assert.ok(params.includes(name), name);
+const sections = openapi.paths['/api/config/{section}'].put.parameters.find(item => item.name === 'section').schema.enum;
+assert.ok(sections.includes('user-agent-blocking'));
+
+for (const pack of [en, pl]) {
+  for (const key of ['globalUaBlockingTitle', 'vhUaBlockEnabled', 'fileLogsConsolidateVhosts', 'fileLogsAdvancedParser', 'copied', 'copyValue']) {
+    assert.equal(typeof pack[key], 'string', key);
+    assert.ok(pack[key].length > 0, key);
+  }
+}
+
+console.log('PASS: 0.31.5 UA blocking, copy controls, repeated-value parser, vhost log consolidation, OpenAPI and locales.');

tools/checks/source_module_contracts.py

@@ -55,7 +55,7 @@ if node:
     from web_assets import read_app_js, read_vhosts_js
     browser_markup = (ROOT / "src/admin/web/index.html").read_text(encoding="utf-8")
     assert browser_markup.count('<script defer="" src="/assets/') == 1, "one private JS bundle prevents module race"
-    assert '/assets/app.js?v=__RUSTPROXY_VERSION__' in browser_markup
+    assert '/assets/app___RUSTPROXY_ASSET_ID__.js' in browser_markup
     with tempfile.TemporaryDirectory(prefix="rustproxy-js-contract-") as directory:
         temporary = Path(directory)
         for name, content in (("app.js", read_app_js(ROOT)), ("vhosts.js", read_vhosts_js(ROOT))):

tools/checks/system_info_0301_ui_test.mjs

@@ -43,7 +43,7 @@ const code = js.slice(js.indexOf('    const runtime = latestStatus?.runtime || {
 const elements = new Map();
 const dollar = id => { if (!elements.has(id)) elements.set(id, { textContent: '' }); return elements.get(id); };
 const status = {
-  version: '0.31.4', uptime_seconds: 4201,
+  version: '0.31.5', uptime_seconds: 4201,
   runtime: {
     platform: 'Linux', operating_system: 'Debian GNU/Linux 13', kernel_version: '6.12.0', architecture: 'x86_64',
     statistics_source: 'systemstat+sysinfo', data_directory: '/var/lib/rustproxy', database_path: '/var/lib/rustproxy/config.sqlite3',
@@ -63,7 +63,7 @@ const context = {
 vm.runInNewContext(code, context);
 assert.equal(dollar('runtime-operating-system').textContent, 'Debian GNU/Linux 13');
 assert.equal(dollar('runtime-kernel-version').textContent, '6.12.0');
-assert.equal(dollar('runtime-version').textContent, '0.31.4');
+assert.equal(dollar('runtime-version').textContent, '0.31.5');
 assert.equal(dollar('runtime-logical-cpus').textContent, '8');
 assert.equal(dollar('runtime-cpu-usage').textContent, '17.2%');
 assert.equal(dollar('runtime-python').textContent, 'Available · 3.13.5');
@@ -124,4 +124,4 @@ for (const key of ['python_version','pip_version','certbot_version']) {
   assert.ok(runtimeSchema.properties.certificate_runtime.properties[key]);
   assert.equal(runtimeSchema.properties.certificate_runtime.properties[key].nullable, true);
 }
-console.log('PASS: 0.31.4 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');
+console.log('PASS: 0.31.5 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');

tools/checks/version_contracts.py

@@ -11,12 +11,12 @@ for name in ('src/main/bootstrap.rs','src/main/tasks.rs','src/web_server/fastcgi
     assert f'RustProxy {version}' not in text and f'RustProxy/{version}' not in text, f'hardcoded runtime version: {name}'
 assert 'env!("CARGO_PKG_VERSION")' in (root/'src/web_server/fastcgi/protocol.rs').read_text()
 assert 'env!("CARGO_PKG_VERSION")' in (root/'src/web_server/response/file.rs').read_text()
-assert '__RUSTPROXY_VERSION__' in (root/'src/admin/web/index.html').read_text()
+assert '__RUSTPROXY_ASSET_ID__' in (root/'src/admin/web/index.html').read_text()
 assert 'OnceLock<PanelContent>' in (root/'src/admin/public.rs').read_text()
 assert 'PanelContent::new' in (root/'src/admin/public.rs').read_text()
 assert 'preferred_encoding' in (root/'src/admin/panel_content.rs').read_text()
 assert 'include_str!("web/index.html")' in (root/'src/admin/public.rs').read_text()
-assert 'env!("CARGO_PKG_VERSION")' in (root/'src/admin/public.rs').read_text()
+assert 'super::asset_build_id()' in (root/'src/admin/public.rs').read_text()
 assert 'admin_index.html' not in (root/'build.rs').read_text()
 assert 'project_version' in (root/'make_zip.py').read_text()
 print(f'PASS: executable version comes from Cargo.toml ({version})')

tools/checks/web_server_contracts.py

@@ -139,7 +139,8 @@ web_source = rust_source(ROOT, "src/proxy/forward/web_source.rs")
 assert web_source.index("apply_response_rules(") > web_source.index("let origin_headers =")
 assert web_source.index("crate::transform::apply(") > web_source.index("apply_response_rules(")
 need(acl, "ambiguous encoded path character", '"/%2e%2e/secret"', '"/a%2fb"', '"/a%5cb"', '"/bad%"')
-need(admin, '"/web-server"', '"/assets/web-server.js"', '"web-services"', '"vhost_metrics"')
+need(admin, '"/web-server"', '"web-services"', '"vhost_metrics"')
+need((ROOT / "src/admin/panel_assets.rs").read_text(), '"/assets/web-server.js"')
 need(html, 'data-panel="web-server"', 'id="panel-web-server"', 'id="web-service-dialog"',
      'id="web-service-tabs"', 'data-web-service-page="general"', 'data-web-service-page="routing"',
      'data-web-service-page="mime"', 'data-web-service-page="cache"', 'data-web-service-page="delivery"',

tools/dev/memory_load.py

@@ -54,7 +54,7 @@ def run_load(
     port = parsed.port or (443 if parsed.scheme == "https" else 80)
     tls = ssl._create_unverified_context() if insecure else ssl.create_default_context()
     connection_type = http.client.HTTPSConnection if parsed.scheme == "https" else http.client.HTTPConnection
-    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.4", "accept": "*/*"}
+    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.5", "accept": "*/*"}
     if host_header:
         headers["host"] = host_header