- Add is_global column to adb_vector_configs and mcp_servers (schema + migration)
- Add _verify_config_access() and _verify_report_access() helpers
- Apply ownership checks to ~70 endpoints (OCI explore, actions, GenAI, MCP, ADB, reports, embeddings, terraform)
- Reports are 100% private (even admin can't see others')
- Add user_id to embedding metadata + filter in _vector_search/_vector_search_multi
- Remove cross-user ADB fallback in _get_active_adb_configs
- Add auth (token query param) to report HTML and compliance report iframes
- Audit log: admin sees all, user/viewer sees only own
- Embedding task status mapped to user
- Frontend: GLOBAL badge on ADB/MCP configs, hide edit/delete for non-admin on global resources
- Export/import includes is_global field
- New OCI Services page with Service Status (auto-detect + overrides) and OCI Health (real-time Oracle status) tabs
- Compliance report: OCI Services section with Cloud Guard recommendations table, back page with Connect with us
- DOCX generation: professional styling with Pillow camouflage strip, green header tables, result boxes
- Separate Download DOCX button in reports page
- Timezone now per-user (not global) — each user configures their own timezone
- ADB connection pre-check before report generation (fail fast 503)
- Compliance report iframe shows friendly HTML instead of JSON 404 during generation
- OCI Health dashboard: proxies ocistatus.oraclecloud.com with search, geo filters, expandable region cards
- Title: "Oracle Cloud Infrastructure (OCI) CIS Foundations Benchmark Assessment"
- Purpose Statement removed, replaced by single Disclaimer (benchmark standard + legal protection)
- Profile Definitions section added (Level 1 and Level 2 descriptions from CIS page 13)
- Level badge on each finding (green Level 1, orange Level 2)
- Level column in benchmark summary table
- Formatting: pre-wrap + line breaks in description/rationale for long policy text
- Resource tables: up to 7 columns (was 4), shows all useful columns per finding type
- Age calculation: time_created/time_expires shown as "2025-01-16 (434d)"
- OCID display: truncated with start+end visible "ocid1...3ikc3ma"
- Column labels: user-friendly names (User, Key ID, Created (Age), etc.)
- Removed id from skip list, added user_name/fingerprint/time_created to priority
- Single ADB connection: _vector_search_multi searches all tables with 1 connection (was 11)
- Smart table skip: _relevant_tables matches query keywords to tables, skips irrelevant ones
- Follow-up enrichment: short questions (≤8 words) enriched with previous user message for RAG context
- CIS filter applied to enriched query (follow-up "qual o comando cli?" inherits "cis 1.1" from previous)
- RAG system prompt: remediation must be COMPLETE with CLI commands in code blocks, never summarized
- Table keyword mapping for all 11 tables (IAM, networking, compute, etc.)
- Applied to both Chat Agent and Consultar Embeddings
- Chunk findings CSV: includes CIS Recommendation number, Section, Status in document header
- Consult embeddings: tenancy dropdown (OCI config selector) for filtered search
- CIS number detection: regex extracts "cis X.Y" from query → TEXT LIKE filter for exact match
- Dynamic top_k: 10 per table when CIS filter active (vs 3 default), 15 global results
- Vector search text_filter: combined vector similarity + TEXT LIKE for precise results
- Purged 121174 legacy docs without tenancy metadata from all CIS tables
- Re-embedded 4364 docs across 7 tables with full CIS metadata
- GPT-5.2 for consult (was GPT-4.1), max_tokens 8000
- Auto-detect embedding model per table dimension (1536/3072) for search queries
- Embedding cache: reuse same embedding for tables with same model (avoid redundant API calls)
- Tenancy filter: strict JSON_VALUE match, no IS NULL fallback (prevents old data leaking)
- Global tables (cisrecom, engineerknowledgebase): no tenancy filter (generic knowledge)
- ADB connection timeout: 15s connect, 30s query
- RAG context: includes extract_date per document, relevance score, source table name
- Context size: 12000 chars max, distributed proportionally across top 8 docs
- ADB offline handling: LLM informed when bases are unavailable
- System prompt updated: clear hierarchy (findings > cisrecom > engineerknowledgebase)
- RAG vs MCP Tools differentiation: stored data vs real-time scan instructions
- Temporal awareness: model prioritizes recent data, supports date comparison
- Text chunking: max 8000 chars per document, large CSV rows split with context header
- Text truncation: _embed_text truncates at 8000 chars before sending to model (prevents 400 errors)
- Purge before re-embed: deletes old docs by tenancy+date before inserting new ones
- Shared embedding status: file-based status (/data/.embed_status/) instead of in-memory dict (fixes multi-worker visibility)
- Progress bar: shows green (OK) + red (failures) segments, percentage, processed/total count
- Better error logging: extracts readable error message from OCI API errors
- Auto-embed report: maps each CSV to its ADB table (summaryreportcsvvector, identityandaccess, networking, etc.)
- Section embed: new endpoint POST /api/embeddings/report/{rid}/section with per-section button in UI
- Table validation: checks registered ADB tables before embedding, reports missing tables
- Auto-detect embedding dimension: reads table dim and selects correct model (3072→large, 1536→small)
- ADB RAW(16) ID fix: all vector inserts use HEXTORAW() for UUID (fixes ORA-01465)
- Float32 vectors: all inserts use array.array('f') for FLOAT32 compatibility
- Embedding status: real-time progress polling (Embedding X/Y — table: Z)
- Loading per section: spinner only on the section being embedded, not all
- Removed individual file embed buttons (only section + full report)
- Summary CSV chunking: groups by CIS section with tenancy + extract_date metadata
- Findings CSV chunking: each row becomes a document with structured content
- README: documented all 11 required ADB vector tables with descriptions
- Oracle PDF style: decorative left strip, ORACLE brand header, red section titles, green table headers
- Cover page: removed rectangle, clean layout matching Oracle reference PDF
- Print: @page margin:0 + thead/tfoot table trick for per-page header/footer spacing without browser URL/date
- RAG remediation: fixed fallback dumping entire CIS chunk instead of just remediation section
- Findings: removed break-inside:avoid that caused empty pages, emoji replaced with [CSV] text
- Tables: break-inside:avoid on rows, section headers break-after:avoid, thead repeats on page break
- Compliance polling: useEffect-based with cleanup, auto-expand on ready, re-check on section toggle
- Explorer: silent polling during start/stop (no flickering)
- HTML report starts minimized, auto-expands on fresh generation
- Include dist/ in git for deployment
- Professional Oracle-format compliance report with RAG remediation from ADB vector store
- React 19 SPA at /app/ (16 pages, TypeScript, Vite, Zustand, i18n pt/en 625 keys)
- Report delete endpoint, embed individual report files into vector store
- Terraform ZIP download (client-side, pure JS)
- Explorer silent polling during start/stop (no flickering)
- HTML report and compliance report sections start minimized
- Token auth fix for compliance report CSV download links
- Explorer: KPI stats bar with cached counts (SQLite), background refresh,
enhanced views for VCNs/Subnets/LBs/Buckets, start/stop for DB Systems,
MySQL, Container Instances, dead state filtering across all 36 endpoints
- Prompt Generator: same knowledge pipeline as Terraform Agent — resource
type detection + official docs from GitHub + compact resource reference
- Fix: NetworkFirewallPolicySummaryCollection not iterable (.items accessor)
- Skip ADB vector search for Terraform Agent (uses local SQLite resource reference instead)
- Show error message in terminal when plan fails validation (no more stuck "Aguardando execução")
- Write region validation error to plan_output field for terminal display
- Fix Plan/Re-plan button visibility for all workspace states (including stuck planning/applying)
- Block terraform plan if model omits variable "region" (prevents wrong-region provisioning)
- Rollback button on apply failure with ROLLBACK confirmation modal
- SSH public key field in OCI configs, auto-injected into terraform.tfvars
- Split-panel layout: terminal right (40%), files/plan/resources below chat (60%)
- reasoning_effort uppercase fix for OCI SDK
- Plan button persists after destroy status
- Add CONSULT_SYSTEM_PROMPT (concise data viewer, not compliance assistant)
- Add _enrich_doc_content to extract text from metadata.text when TEXT column is short
- Enriches context with recommendation number, chapter, tenancy, section
- Improves RAG context quality for all vector search flows
- Build GenAI config from OCI credentials when no genai_configs exist
- Uses GPT-4.1 as default model with RAG system prompt
- Fixes _call_genai signature (system_prompt via gc dict, not kwarg)
- Detect VECTOR_DIMENSION_COUNT per table before querying
- Map dimensions to correct embedding model (1536→small, 3072→large)
- Cache query embeddings by dimension to avoid redundant API calls
- All tables now searchable regardless of which model generated them
- Official resource docs injection from registry.terraform.io (on-demand fetch + SQLite cache)
- Smart tfvars auto-generation from declared variables (tenancy_ocid, user_ocid, etc.)
- Multi-region provider: use var.region instead of hardcoded OCI config region
- RPC anti-cycle rule in system prompt
- System prompt auto-sync to DB on restart
- Fix UI flickering: animations scoped to tab switch only (tab-enter class)
- Terraform polling timeout increased to 60 min
- Terminal output updates without full page re-render
- Fix ${IC.bot} literal rendering in chat empty state
- Chat empty state icon scaled to 48px
- README updated to v2.2 with all changes
- Add export/import endpoints for full config backup (OCI, GenAI, MCP, prompts, settings, ADB)
- Export includes private keys (base64) for complete environment migration
- Import merges by ID (skips existing, no duplicates)
- Fix Resource Plan parser to recognize free-form format (model skips ```plan blocks)
- Fix replan not clearing previous apply/destroy outputs
- Fix duplicate CIS Compliance Scanner MCP server on multi-worker startup
- Add Terraform prompt editor with auto-save in menu
- Add Update Network Access endpoint and UI for ADB ACL management
- Add inline prompt editor with auto-save in Terraform agent menu
- Persist resize bar positions across re-renders (Explorer + Terraform)
- Restore full Terraform session state from history (files, plan, outputs, OCI config)
- Parse free-form Resource Plan format (model often skips ```plan blocks)
- Auto-refresh resource state after Start/Stop actions
- Clear previous apply/destroy outputs on Re-plan
- Deduplicate CIS Compliance Scanner MCP server on startup
- Show ACL IPs in Explorer for Autonomous Databases
- Detect user IP via /api/oci/my-ip endpoint
- Add SQLite-based resource type validation with suggestions for invalid types
- Increase Terraform max_tokens from 32K to 100K for large infra generation
- Generate resource reference at startup to survive volume mount overwrites
- Add invalid resource type examples to system prompt (RPC peer, subnet route table)
- Add prompt size logging for Terraform agent
- Translate remaining Portuguese code comment to English
- Add 3-layer protection pipeline for model-generated Terraform code:
1. Frontend auto-split: splits monolithic HCL into multiple files by resource type
2. Backend auto-split: Python port as last defense before writing to disk
3. Backend deduplication: removes monolithic leftovers with duplicate resources
- Fix single-line block expansion to handle ALL HCL blocks (nested included):
ingress_security_rules, egress_security_rules, route_rules, match_criteria, etc.
- Add prompt size logging for terraform agent diagnostics
- Strengthen system prompt: minimum 3 files, final reminder section
Always declare variable "region", remove invalid resource types with
correct alternatives, and ensure RPC dependencies exist on both sides
before peering.
Ensure subnets always reference valid route tables, DRG attachments
point to existing resources, and RPC peering has correct peer_id
and peer_region_name configuration.
Cross-references, CIDRs, security lists, route tables, dependencies,
resource type names, valid arguments, and variable declarations must
all be verified before the model delivers any code.
- fmTf now merges new code blocks with existing S.tfFiles: updated files
are replaced by name, untouched files are preserved, new files are added
- System prompt changed: model generates ONLY the files that need fixing
instead of all 25 files, drastically reducing output size
- Prevents model from discarding existing work when correcting errors
- Inject existing workspace files + plan/apply output into Terraform chat
context so model corrects in-place instead of regenerating from scratch
- Add "REGRA CRÍTICA: Correção de Arquivos Existentes" to system prompt
requiring the model to preserve file structure and fix surgically
- Increase Terraform Agent max_tokens from 16K to 32K
- Remove "Nova conversa" button from Terraform toolbar
- Move Start/Stop Instance and ADB buttons from Terraform Resources
panel to OCI Account Explorer (instances and databases tabs)
- Remove unused _ociResOid helper and old action functions
Change the system prompt from "single file by default" to "multiple files
by default" organized by function (variables.tf, networking.tf, compute.tf,
etc.), which was causing the model to only generate 1-2 files.
- Add dropdown menu (⋮) in Terraform toolbar with "Atualizar Referência TF" button
- Remove standalone reference-status API endpoint, keep only refresh-reference
- Button triggers `terraform providers schema -json` regeneration with progress feedback
- Shows line count and update timestamp after successful refresh
- Update README with new line counts
- Add gen_tf_reference.py to generate OCI Terraform provider resource catalog (~937 resources) from `terraform providers schema -json`
- Auto-inject categorized resource reference into Terraform Agent system prompt to prevent invalid resource type names
- Build-time reference generation in Dockerfile, refreshable via POST /api/terraform/refresh-reference
- Provider alias detection with brace-matching parser for multi-region deployments
- Clean old .tf files before writing new ones on Re-plan
- Message timestamps in terraform chat and history
- Partial DOM rendering to eliminate screen flickering
- Layout overflow fix (no scroll beyond viewport)
