Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Changed

• Settings is a hub. The page opens on an Overview of area cards (Lens bar, Collection, Thresholds and checks, Fleet limits, Notifications, Assistant, Storage, Security and access, Console server) with a list of areas on the left, or a list and a full screen area on a phone. Search finds any of the 128 settings and edits it in place, Essentials and All hide the advanced rows, and a dot marks a value changed in the console. Collectors are switches you press, degraded and critical limits share one row with a zone bar, and nothing scrolls sideways on a phone. GET settings gives each setting an area, section, adv, unit, title, hint (and option, subsection, pair where they apply) and the list of areas.
• Settings save as you go. A switch, choice or pill saves when pressed, a number or field when you press Enter or leave it, a refused value shows on its row and goes back, and a note offers Undo for six seconds. The Apply and save bar is gone. The password forms, adding a person, channel or MCP server, the mail server settings and the Assistant's model card (Save the model) stay explicit. Notifications is drawn as rows and cards in all six tabs.
• Notifications, Assistant, Storage and Security are drawn in the hub. Rows and cards like the other areas: a usage bar and a list of servers in Storage, the model, behaviour and MCP servers as rows in the Assistant, password and secret rows in Security, and the Notifications forms in hub cards with tabs that scroll on a phone. Nothing sideways on a phone. The save behaviour and every route are unchanged.
• The main menu collapses to its icons. A toggle at the top of the console menu shrinks it to icons with a tooltip on each; the choice is kept in the browser.
• The console is built from small files. Its sources are split per page under src/main/bx/console and joined at build time; the script and stylesheet are minified (about 26 percent and 14 percent smaller). Pages are built when their tab opens, so the console starts with a fraction of the DOM, and a thin neon bar runs while a page loads. The debug bar is unchanged. The build needs node for the minifier (-PskipMinify=true skips it).

Added

• The Overview is the fleet. It shows the state of the whole fleet (healthy, degraded, critical, silent, gone), fleet totals with the worst server named, the fleet as a table or cards (kept per browser), and the slowest requests, SQL, outgoing HTTP calls, MCP servers and AI agents across the servers, with a legend of the limits and a Customize button. With one server it is the same page with one row. Routes GET overview/fleet and GET overview/reports, see Overview.
• Groups, kinds and versions. New settings server.group and server.kind (environment LENS_SERVER_GROUP and LENS_SERVER_KIND). The fleet is sorted and filtered by group. Each server has an icon for what it runs in (a host, Docker, Kubernetes, Podman, LXC, AWS Lambda, ECS, Cloud Run, Azure; Docker Swarm is set by hand), and shows its BoxLang and Java version, with the servers that differ marked. The identity of every server, in instance.json and the server block of each snapshot, now carries group, kind, kindLabel, icon, ephemeral, kindDetail, boxlang, java and bxlens.
• Gone servers. A server that has not saved its health for 15 minutes leaves the fleet and moves to a Gone tab, which suits containers that come and go. An admin can Forget a gone server (BoxLang+, typed id, audited as server.forget).
• Limits you can change. New live settings fleet.heapWarn, fleet.heapCrit, fleet.cpuWarn, fleet.cpuCrit, fleet.errorWarn, fleet.silentSec and fleet.goneMin, with the volume limits volumes.warnPct and volumes.critPct, in a Fleet card in Settings. A warn value at or above its critical value is refused.
• Free sees this server on the Overview and a blurred count of the other servers found in the store folder, with an upgrade card. Nothing about those servers is read or sent.
• The saved report of each server (reports.json) now carries the latency counts of its URLs, so the slowest route of a fleet has a real p95.

Fixed

• The version badge no longer reads the console state before it is loaded.

• The BxLens version is shown as a badge in the console header and next to the title of the Settings page (for example v1.0.0-snapshot). The hover text has the full version with the build number. It comes from the module version that the build writes, so there is nothing to set.

• Threads (JVM > Threads) show who blocks whom (blockedBy, waitingOn, held locks, daemon, CPU use now from a bounded sampler, a stack key), blocked chains under their root holder, groups of threads with the same stack, a pool summary with busy percent, and up to five in-memory snapshots to compare for likely stuck threads (POST threads/snapshot, GET threads/snapshots, GET threads/compare). The JVM page also gives attention (from the findings, which stay) and threads.pools.

• System is now the machine under BoxLang: type (physical, virtual machine, container) with the cloud and instance type from the DMI texts, operating system, kernel, CPU model and count, memory and swap, container and Kubernetes names, container CPU and memory limits (cgroup v1 and v2), machine and BoxLang uptime, live CPU, load, memory, swap, disk I/O, network, open files and CPU throttling, and 15 minutes of history from a small bounded sampler. What an operating system cannot report is null and listed in unsupported. No external process is started. The old system keys stay.

• System storage shows the folders that matter (logs, the BxLens store, the BoxLang home, temp and the working directory) with their volume and status, and every other mount under "other", with kernel and in-memory file systems listed there only.

• Environment has highlights (runtime, container, Java, heap max, time zone), one list of variables, JVM arguments and system properties with a source, a hidden flag and a JDK noise flag per row, and counts. The older keys stay for the diagnostic bundle.

• One runtime detector (MiniServer, CommandBox, servlet container, command line) shared by the System, Environment and Web server pages.

• System detail for the tabs CPU, Memory, Disks, Network and Processes: per core CPU with frequency, temperature, context switches and interrupts, memory with cache, available, swap in and out and page faults, disks (kind, mounts, busy, read and write, queue), network interfaces (speed, state, in, out, errors, drops), TCP counts and retransmissions, DNS servers and gateway, the top 20 processes by CPU and by memory (names only, never a command line; open files and disk I/O where the system allows), one hour of history, and a shared "Needs attention" list (full locations, load, low memory, swapping, container throttling, a pinned core, a hot process, a saturated disk, interface errors, TIME_WAIT). Linux reads /proc and /sys; macOS and Windows use the bundled OSHI library through one bridge class, restricted to calls that start no external process. What a system cannot give is null and listed in unsupported. The health snapshot keeps the old keys, the attention list and 15 minutes of history, without the process list and the per core readings.

• First Release

• MCP rate limits in AI observability (needs bx-ai 3.7 or later on the hosted servers). The MCP page and the page of each hosted server show the rate limit: a Rate limited tile and column, a Rate limit card (limits, blocked, store errors, history kept, trusted proxies), Top consumers for today, 7 days, 30 days and all time, a sample of recent hits, and hints. Clients are an IP or a short hash, never a key.

• An admin can pause or resume a hosted MCP server, turn its rate limit off or on, reset the counters and clear the stats from its page (BoxLang+, refused when the console is read only, audited as ai.mcp.host).

• Two alert rules, MCP rate limited and MCP rate limiter failing (17 rules now), that can be switched on and off alone. The AI rule no longer sends those items. New setting collectors.aiobs.mcpRateLimited (30 blocked calls in 10 minutes).

• The daily, weekly and monthly reports have an MCP rate limits section: calls and blocked calls per MCP server and the top clients.

• Free gets a fourth counter, MCP calls blocked, and a locked preview.

• JVM page (Runtime, after System): heap and every memory pool, garbage collection from a bounded ring of the last 100 collections with cause notes, time in GC, allocation rate, threads by state, classes and JIT, buffers, open files, JVM flags with plain suggestions, a "Needs a look" box and a 15 minute history. Threads moved into it as a tab. New route jvm, collector jvm, health snapshot part jvm, and jvm.json in the diagnostic bundle.

• Web server page (Runtime, admin only): the runtime (MiniServer, CommandBox or a servlet container), listeners, workers, request counters, findings and a 15 minute history, read only from what the server reports. collectors.webserver.enabled, route webserver, also in the health snapshot for other servers. See docs/reference/web-server-data.md.