Terminal:
- New /terminal page with Linux-style terminal UI (dark theme, title bar, prompt)
- OCI Config selector — isolated per user (ownership check)
- Tab autocomplete: parses oci --help dynamically, caches results, commands first
- Command history (↑/↓) persisted in DB per user
- Security: only 'oci' commands, blocks pipes/redirects/shell injection
- Built-in commands: clear, history, help
- Timeout 60s per command
i18n:
- Spanish (es.ts): 748+ keys, Latin American formal
- Language selector moved from sidebar to My Settings (🇧🇷/🇺🇸/🇪🇸)
- Auto-detect browser language (pt/es/en)
Backend:
- POST /api/terminal/execute — run OCI CLI with selected config
- GET /api/terminal/completions — dynamic autocomplete from oci --help
- GET /api/terminal/history — per-user command history
- terminal_history table in SQLite
- _resolve_embed_config: new user_id param, scopes all fallback queries to user's own configs
- _get_adb_and_genai: propagates user_id to config resolution
- _chat_start: verify ownership of genai_config_id and oci_config_id
- TF prompt generator: scope default GenAI query to user_id
- Consult embeddings: scope GenAI resolution to user_id
- _search_cis_remediation: include global ADB configs (is_global=1)
- Add is_global column to adb_vector_configs and mcp_servers (schema + migration)
- Add _verify_config_access() and _verify_report_access() helpers
- Apply ownership checks to ~70 endpoints (OCI explore, actions, GenAI, MCP, ADB, reports, embeddings, terraform)
- Reports are 100% private (even admin can't see others')
- Add user_id to embedding metadata + filter in _vector_search/_vector_search_multi
- Remove cross-user ADB fallback in _get_active_adb_configs
- Add auth (token query param) to report HTML and compliance report iframes
- Audit log: admin sees all, user/viewer sees only own
- Embedding task status mapped to user
- Frontend: GLOBAL badge on ADB/MCP configs, hide edit/delete for non-admin on global resources
- Export/import includes is_global field
- New OCI Services page with Service Status (auto-detect + overrides) and OCI Health (real-time Oracle status) tabs
- Compliance report: OCI Services section with Cloud Guard recommendations table, back page with Connect with us
- DOCX generation: professional styling with Pillow camouflage strip, green header tables, result boxes
- Separate Download DOCX button in reports page
- Timezone now per-user (not global) — each user configures their own timezone
- ADB connection pre-check before report generation (fail fast 503)
- Compliance report iframe shows friendly HTML instead of JSON 404 during generation
- OCI Health dashboard: proxies ocistatus.oraclecloud.com with search, geo filters, expandable region cards
- Title: "Oracle Cloud Infrastructure (OCI) CIS Foundations Benchmark Assessment"
- Purpose Statement removed, replaced by single Disclaimer (benchmark standard + legal protection)
- Profile Definitions section added (Level 1 and Level 2 descriptions from CIS page 13)
- Level badge on each finding (green Level 1, orange Level 2)
- Level column in benchmark summary table
- Formatting: pre-wrap + line breaks in description/rationale for long policy text
- Resource tables: up to 7 columns (was 4), shows all useful columns per finding type
- Age calculation: time_created/time_expires shown as "2025-01-16 (434d)"
- OCID display: truncated with start+end visible "ocid1...3ikc3ma"
- Column labels: user-friendly names (User, Key ID, Created (Age), etc.)
- Removed id from skip list, added user_name/fingerprint/time_created to priority
- Single ADB connection: _vector_search_multi searches all tables with 1 connection (was 11)
- Smart table skip: _relevant_tables matches query keywords to tables, skips irrelevant ones
- Follow-up enrichment: short questions (≤8 words) enriched with previous user message for RAG context
- CIS filter applied to enriched query (follow-up "qual o comando cli?" inherits "cis 1.1" from previous)
- RAG system prompt: remediation must be COMPLETE with CLI commands in code blocks, never summarized
- Table keyword mapping for all 11 tables (IAM, networking, compute, etc.)
- Applied to both Chat Agent and Consultar Embeddings
- Chunk findings CSV: includes CIS Recommendation number, Section, Status in document header
- Consult embeddings: tenancy dropdown (OCI config selector) for filtered search
- CIS number detection: regex extracts "cis X.Y" from query → TEXT LIKE filter for exact match
- Dynamic top_k: 10 per table when CIS filter active (vs 3 default), 15 global results
- Vector search text_filter: combined vector similarity + TEXT LIKE for precise results
- Purged 121174 legacy docs without tenancy metadata from all CIS tables
- Re-embedded 4364 docs across 7 tables with full CIS metadata
- GPT-5.2 for consult (was GPT-4.1), max_tokens 8000
- Auto-detect embedding model per table dimension (1536/3072) for search queries
- Embedding cache: reuse same embedding for tables with same model (avoid redundant API calls)
- Tenancy filter: strict JSON_VALUE match, no IS NULL fallback (prevents old data leaking)
- Global tables (cisrecom, engineerknowledgebase): no tenancy filter (generic knowledge)
- ADB connection timeout: 15s connect, 30s query
- RAG context: includes extract_date per document, relevance score, source table name
- Context size: 12000 chars max, distributed proportionally across top 8 docs
- ADB offline handling: LLM informed when bases are unavailable
- System prompt updated: clear hierarchy (findings > cisrecom > engineerknowledgebase)
- RAG vs MCP Tools differentiation: stored data vs real-time scan instructions
- Temporal awareness: model prioritizes recent data, supports date comparison
- Text chunking: max 8000 chars per document, large CSV rows split with context header
- Text truncation: _embed_text truncates at 8000 chars before sending to model (prevents 400 errors)
- Purge before re-embed: deletes old docs by tenancy+date before inserting new ones
- Shared embedding status: file-based status (/data/.embed_status/) instead of in-memory dict (fixes multi-worker visibility)
- Progress bar: shows green (OK) + red (failures) segments, percentage, processed/total count
- Better error logging: extracts readable error message from OCI API errors
- Auto-embed report: maps each CSV to its ADB table (summaryreportcsvvector, identityandaccess, networking, etc.)
- Section embed: new endpoint POST /api/embeddings/report/{rid}/section with per-section button in UI
- Table validation: checks registered ADB tables before embedding, reports missing tables
- Auto-detect embedding dimension: reads table dim and selects correct model (3072→large, 1536→small)
- ADB RAW(16) ID fix: all vector inserts use HEXTORAW() for UUID (fixes ORA-01465)
- Float32 vectors: all inserts use array.array('f') for FLOAT32 compatibility
- Embedding status: real-time progress polling (Embedding X/Y — table: Z)
- Loading per section: spinner only on the section being embedded, not all
- Removed individual file embed buttons (only section + full report)
- Summary CSV chunking: groups by CIS section with tenancy + extract_date metadata
- Findings CSV chunking: each row becomes a document with structured content
- README: documented all 11 required ADB vector tables with descriptions
- Oracle PDF style: decorative left strip, ORACLE brand header, red section titles, green table headers
- Cover page: removed rectangle, clean layout matching Oracle reference PDF
- Print: @page margin:0 + thead/tfoot table trick for per-page header/footer spacing without browser URL/date
- RAG remediation: fixed fallback dumping entire CIS chunk instead of just remediation section
- Findings: removed break-inside:avoid that caused empty pages, emoji replaced with [CSV] text
- Tables: break-inside:avoid on rows, section headers break-after:avoid, thead repeats on page break
- Compliance polling: useEffect-based with cleanup, auto-expand on ready, re-check on section toggle
- Explorer: silent polling during start/stop (no flickering)
- HTML report starts minimized, auto-expands on fresh generation
- Include dist/ in git for deployment
- Professional Oracle-format compliance report with RAG remediation from ADB vector store
- React 19 SPA at /app/ (16 pages, TypeScript, Vite, Zustand, i18n pt/en 625 keys)
- Report delete endpoint, embed individual report files into vector store
- Terraform ZIP download (client-side, pure JS)
- Explorer silent polling during start/stop (no flickering)
- HTML report and compliance report sections start minimized
- Token auth fix for compliance report CSV download links
- Explorer: KPI stats bar with cached counts (SQLite), background refresh,
enhanced views for VCNs/Subnets/LBs/Buckets, start/stop for DB Systems,
MySQL, Container Instances, dead state filtering across all 36 endpoints
- Prompt Generator: same knowledge pipeline as Terraform Agent — resource
type detection + official docs from GitHub + compact resource reference
- Fix: NetworkFirewallPolicySummaryCollection not iterable (.items accessor)
- Skip ADB vector search for Terraform Agent (uses local SQLite resource reference instead)
- Show error message in terminal when plan fails validation (no more stuck "Aguardando execução")
- Write region validation error to plan_output field for terminal display
- Fix Plan/Re-plan button visibility for all workspace states (including stuck planning/applying)
- Block terraform plan if model omits variable "region" (prevents wrong-region provisioning)
- Rollback button on apply failure with ROLLBACK confirmation modal
- SSH public key field in OCI configs, auto-injected into terraform.tfvars
- Split-panel layout: terminal right (40%), files/plan/resources below chat (60%)
- reasoning_effort uppercase fix for OCI SDK
- Plan button persists after destroy status
- Add CONSULT_SYSTEM_PROMPT (concise data viewer, not compliance assistant)
- Add _enrich_doc_content to extract text from metadata.text when TEXT column is short
- Enriches context with recommendation number, chapter, tenancy, section
- Improves RAG context quality for all vector search flows
- Build GenAI config from OCI credentials when no genai_configs exist
- Uses GPT-4.1 as default model with RAG system prompt
- Fixes _call_genai signature (system_prompt via gc dict, not kwarg)
- Detect VECTOR_DIMENSION_COUNT per table before querying
- Map dimensions to correct embedding model (1536→small, 3072→large)
- Cache query embeddings by dimension to avoid redundant API calls
- All tables now searchable regardless of which model generated them
- Official resource docs injection from registry.terraform.io (on-demand fetch + SQLite cache)
- Smart tfvars auto-generation from declared variables (tenancy_ocid, user_ocid, etc.)
- Multi-region provider: use var.region instead of hardcoded OCI config region
- RPC anti-cycle rule in system prompt
- System prompt auto-sync to DB on restart
- Fix UI flickering: animations scoped to tab switch only (tab-enter class)
- Terraform polling timeout increased to 60 min
- Terminal output updates without full page re-render
- Fix ${IC.bot} literal rendering in chat empty state
- Chat empty state icon scaled to 48px
- README updated to v2.2 with all changes
- Add export/import endpoints for full config backup (OCI, GenAI, MCP, prompts, settings, ADB)
- Export includes private keys (base64) for complete environment migration
- Import merges by ID (skips existing, no duplicates)
- Fix Resource Plan parser to recognize free-form format (model skips ```plan blocks)
- Fix replan not clearing previous apply/destroy outputs
- Fix duplicate CIS Compliance Scanner MCP server on multi-worker startup
- Add Terraform prompt editor with auto-save in menu
- Add Update Network Access endpoint and UI for ADB ACL management
- Add inline prompt editor with auto-save in Terraform agent menu
- Persist resize bar positions across re-renders (Explorer + Terraform)
- Restore full Terraform session state from history (files, plan, outputs, OCI config)
- Parse free-form Resource Plan format (model often skips ```plan blocks)
- Auto-refresh resource state after Start/Stop actions
- Clear previous apply/destroy outputs on Re-plan
- Deduplicate CIS Compliance Scanner MCP server on startup
- Show ACL IPs in Explorer for Autonomous Databases
- Detect user IP via /api/oci/my-ip endpoint
- Add SQLite-based resource type validation with suggestions for invalid types
- Increase Terraform max_tokens from 32K to 100K for large infra generation
- Generate resource reference at startup to survive volume mount overwrites
- Add invalid resource type examples to system prompt (RPC peer, subnet route table)
- Add prompt size logging for Terraform agent
- Translate remaining Portuguese code comment to English
- Add 3-layer protection pipeline for model-generated Terraform code:
1. Frontend auto-split: splits monolithic HCL into multiple files by resource type
2. Backend auto-split: Python port as last defense before writing to disk
3. Backend deduplication: removes monolithic leftovers with duplicate resources
- Fix single-line block expansion to handle ALL HCL blocks (nested included):
ingress_security_rules, egress_security_rules, route_rules, match_criteria, etc.
- Add prompt size logging for terraform agent diagnostics
- Strengthen system prompt: minimum 3 files, final reminder section
