Hub stage 8: settings drift, webhook notices, profiles

The drift check now also covers the settings baseline and the Blocked
and Allowed lists baseline; the drift dialog offers Open compare,
Accept as baseline and Revert to baseline for them. Old drift.json
files still load.

HUB_WEBHOOK_URL (and an optional HUB_WEBHOOK_SECRET for an HMAC
signature) receives drift.found, drift.cleared and write.failed
notices, only on change, without values, never blocking a request and
never logging the address beyond its host. Admins see the webhook
status and can send a test from About and from the drift dialog.

Profiles bundle the hub's app, settings and lists baselines. Applying
one to a server runs install, app configs, settings and lists in order
after a preview; a failed step stops that server's later steps and
Retry failed resumes from it. Profiles export and import as a file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/drift.test.ts

@@ -1,11 +1,12 @@
 // @vitest-environment node
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { parseConfig } from './config.ts'
 import { Drift } from './drift.ts'
-import { writeBaseline, writeOverrides } from './store.ts'
+import { writeBaseline, writeListsBaseline, writeOverrides, writeSettingsBaseline } from './store.ts'
+import { Webhook } from './webhook.ts'
 import { Upstream } from './upstream.ts'
 
 const json = (o: unknown): string => JSON.stringify(o, null, 2)
@@ -14,6 +15,9 @@ interface FakeServer {
   apps: Record<string, string>
   down: boolean
   denyConfig: boolean
+  settings: Record<string, unknown>
+  blocked: string[]
+  allowed: string[]
 }
 
 let dir: string
@@ -38,10 +42,14 @@ const fakeFetch = (async (input: string | URL | Request) => {
     if (server.denyConfig) return Response.json({ status: 'error', errorMessage: 'Access was denied.' })
     return reply({ config: server.apps[name] ?? null })
   }
+  if (apiPath === 'settings/get') return reply(server.settings)
+  if (apiPath === 'blocked/export' || apiPath === 'allowed/export') {
+    return new Response((apiPath === 'blocked/export' ? server.blocked : server.allowed).join('\n') + '\n', { headers: { 'content-type': 'text/plain' } })
+  }
   return reply({})
 }) as typeof fetch
 
-function make() {
+function make(webhook?: Webhook) {
   const config = parseConfig({
     HUB_SERVERS: 'a=http://127.0.0.1:1,b=http://127.0.0.1:2',
     A_TOKEN: 'ra',
@@ -49,7 +57,7 @@ function make() {
     HUB_DATA: dir,
     HUB_CACHE_SECONDS: '0',
   })
-  const drift = new Drift(config, new Upstream(config, fakeFetch, () => clock), () => clock)
+  const drift = new Drift(config, new Upstream(config, fakeFetch, () => clock), () => clock, { webhook })
   return { config, drift }
 }
 
@@ -58,7 +66,8 @@ const baseline = (app: string, text: string) =>
 
 beforeEach(() => {
   dir = mkdtempSync(path.join(tmpdir(), 'hub-drift-'))
-  servers = { a: { apps: {}, down: false, denyConfig: false }, b: { apps: {}, down: false, denyConfig: false } }
+  const blank = (): FakeServer => ({ apps: {}, down: false, denyConfig: false, settings: {}, blocked: [], allowed: [] })
+  servers = { a: blank(), b: blank() }
   calls = []
   gate = null
   clock = Date.parse('2026-10-31T10:00:00Z')
@@ -83,7 +92,7 @@ describe('drift check', () => {
     servers.b.apps.Blocker = json({ ttl: 99 })
     const { drift } = make()
     const state = await drift.check()
-    expect(state.apps).toEqual([{ app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', kind: 'differs' }])
+    expect(state.apps).toEqual([{ kind: 'app', name: 'Blocker', app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', status: 'differs' }])
     expect(drift.count()).toBe(1)
   })
 
@@ -103,7 +112,7 @@ describe('drift check', () => {
     expect((await drift.check()).apps).toEqual([])
     // A wrong local value is drift.
     servers.b.apps.Blocker = json({ ttl: 30, db: '/elsewhere.db' })
-    expect((await drift.check()).apps.map((e) => [e.server, e.kind])).toEqual([['b', 'differs']])
+    expect((await drift.check()).apps.map((e) => [e.server, e.status])).toEqual([['b', 'differs']])
   })
 
   it('lists a server that does not answer as unreadable, and does not count it', async () => {
@@ -112,7 +121,7 @@ describe('drift check', () => {
     servers.b.down = true
     const { drift } = make()
     const state = await drift.check()
-    expect(state.apps).toEqual([{ app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', kind: 'unreadable' }])
+    expect(state.apps).toEqual([{ kind: 'app', name: 'Blocker', app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', status: 'unreadable' }])
     expect(drift.count()).toBe(0)
   })
 
@@ -122,7 +131,7 @@ describe('drift check', () => {
     servers.a.denyConfig = true
     const { drift } = make()
     const state = await drift.check()
-    expect(state.apps.map((e) => [e.server, e.kind])).toEqual([['a', 'unreadable'], ['b', 'not-installed']])
+    expect(state.apps.map((e) => [e.server, e.status])).toEqual([['a', 'unreadable'], ['b', 'not-installed']])
   })
 
   it('keeps `since` across checks and drops the entry once the problem is fixed', async () => {
@@ -147,7 +156,7 @@ describe('drift check', () => {
     expect((await drift.check()).apps[0].since).toBe('2026-10-31T10:45:00.000Z')
   })
 
-  it('changes the kind (and `since`) when the problem changes', async () => {
+  it('changes the status (and `since`) when the problem changes', async () => {
     baseline('Blocker', json({ ttl: 30 }))
     servers.a.apps.Blocker = json({ ttl: 30 })
     servers.b.apps.Blocker = json({ ttl: 99 })
@@ -156,7 +165,7 @@ describe('drift check', () => {
     servers.b.down = true
     clock += 60_000
     const state = await drift.check()
-    expect(state.apps[0]).toMatchObject({ kind: 'unreadable', since: '2026-10-31T10:01:00.000Z' })
+    expect(state.apps[0]).toMatchObject({ status: 'unreadable', since: '2026-10-31T10:01:00.000Z' })
   })
 
   it('never runs two checks at once', async () => {
@@ -187,10 +196,148 @@ describe('drift check', () => {
     const file = JSON.parse(readFileSync(path.join(dir, 'drift.json'), 'utf8'))
     expect(file).toEqual({
       checkedAt: '2026-10-31T10:00:00.000Z',
-      apps: [{ app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', kind: 'differs' }],
+      apps: [{ kind: 'app', name: 'Blocker', app: 'Blocker', server: 'b', since: '2026-10-31T10:00:00.000Z', status: 'differs' }],
     })
     const again = make().drift
     expect(again.get()).toMatchObject({ checkedAt: '2026-10-31T10:00:00.000Z', checking: false })
     expect(again.count()).toBe(1)
   })
 })
+
+const baselineSettings = (settings: Record<string, unknown>) => writeSettingsBaseline(dir, { settings, updatedAt: '2026-01-01T00:00:00Z', updatedBy: 'test' })
+const baselineLists = (blocked: string[], allowed: string[]) => writeListsBaseline(dir, { blocked, allowed, updatedAt: '2026-01-01T00:00:00Z', updatedBy: 'test' })
+
+describe('drift of settings and lists', () => {
+  it('reports shared settings fields that differ from the baseline, by field name only', async () => {
+    baselineSettings({ blockingType: 'NxDomain', defaultRecordTtl: 3600, dnsServerDomain: 'x.example' })
+    servers.a.settings = { blockingType: 'NxDomain', defaultRecordTtl: 3600, dnsServerDomain: 'a.example' }
+    servers.b.settings = { blockingType: 'AnyAddress', defaultRecordTtl: 60, dnsServerDomain: 'b.example' }
+    const { drift } = make()
+    const state = await drift.check()
+    // dnsServerDomain is local: server a is fine even though its value differs.
+    expect(state.apps).toEqual([{ kind: 'settings', server: 'b', since: '2026-10-31T10:00:00.000Z', status: 'differs', fields: ['blockingType', 'defaultRecordTtl'] }])
+    expect(JSON.stringify(state)).not.toContain('AnyAddress')
+    expect(drift.count()).toBe(1)
+  })
+
+  it('reports Blocked and Allowed lists that differ, without a domain', async () => {
+    baselineLists(['ads.example'], ['ok.example'])
+    servers.a.blocked = ['ads.example']
+    servers.a.allowed = ['ok.example']
+    servers.b.blocked = ['ads.example', 'extra.example']
+    servers.b.allowed = ['ok.example']
+    const { drift } = make()
+    const state = await drift.check()
+    expect(state.apps).toEqual([{ kind: 'lists', server: 'b', since: '2026-10-31T10:00:00.000Z', status: 'differs', fields: ['blocked'] }])
+    expect(JSON.stringify(state)).not.toContain('extra.example')
+  })
+
+  it('reads no settings and no lists when there is no baseline for them', async () => {
+    const { drift } = make()
+    await drift.check()
+    expect(calls).toEqual([])
+  })
+
+  it('lists a server that does not answer as unreadable for each baseline, and does not count it', async () => {
+    baselineSettings({ blockingType: 'NxDomain' })
+    baselineLists([], [])
+    servers.b.down = true
+    const { drift } = make()
+    const state = await drift.check()
+    expect(state.apps.map((e) => [e.kind, e.server, e.status])).toEqual([['lists', 'b', 'unreadable'], ['settings', 'b', 'unreadable']])
+    expect(drift.count()).toBe(0)
+  })
+
+  it('counts every kind in one number', async () => {
+    baseline('Blocker', json({ ttl: 30 }))
+    baselineSettings({ blockingType: 'NxDomain' })
+    baselineLists(['x.example'], [])
+    servers.a.apps.Blocker = json({ ttl: 1 })
+    servers.b.apps.Blocker = json({ ttl: 30 })
+    servers.a.settings = { blockingType: 'AnyAddress' }
+    servers.b.settings = { blockingType: 'NxDomain' }
+    servers.a.blocked = ['x.example']
+    const { drift } = make()
+    await drift.check()
+    // a: app and settings; b: lists (the baseline has x.example, b has none).
+    expect(drift.get().apps.map((e) => `${e.kind}:${e.server}`).sort()).toEqual(['app:a', 'lists:b', 'settings:a'])
+    expect(drift.count()).toBe(3)
+  })
+
+  it('loads a drift.json written before stage 8, where `kind` held the status', () => {
+    writeFileSync(
+      path.join(dir, 'drift.json'),
+      JSON.stringify({
+        checkedAt: '2026-10-31T09:00:00.000Z',
+        apps: [
+          { app: 'Blocker', server: 'b', since: '2026-10-31T08:00:00.000Z', kind: 'differs' },
+          { app: 'Other', server: 'a', since: '2026-10-31T08:00:00.000Z', kind: 'not-installed' },
+          { server: 'a', since: 'x', kind: 'bogus', app: 'Z' },
+        ],
+      }),
+    )
+    const { drift } = make()
+    expect(drift.get().apps).toEqual([
+      { kind: 'app', name: 'Blocker', app: 'Blocker', server: 'b', since: '2026-10-31T08:00:00.000Z', status: 'differs' },
+      { kind: 'app', name: 'Other', app: 'Other', server: 'a', since: '2026-10-31T08:00:00.000Z', status: 'not-installed' },
+    ])
+    expect(drift.count()).toBe(1)
+  })
+})
+
+describe('drift notices', () => {
+  const sent: { event: string; items: Record<string, unknown>[] }[] = []
+  const hook = () =>
+    new Webhook(
+      { webhookUrl: 'https://hooks.example/x?token=SECRET', webhookSecret: null, domain: 'hub' },
+      {
+        retryDelayMs: 0,
+        fetch: (async (_url: unknown, init: RequestInit) => {
+          sent.push(JSON.parse(String(init.body)))
+          return new Response('ok')
+        }) as typeof fetch,
+      },
+    )
+
+  beforeEach(() => {
+    sent.length = 0
+  })
+
+  it('tells what newly differs once, and what is cleared, and nothing when nothing changed', async () => {
+    baseline('Blocker', json({ ttl: 30 }))
+    servers.a.apps.Blocker = json({ ttl: 30 })
+    servers.b.apps.Blocker = json({ ttl: 99 })
+    const webhook = hook()
+    const { drift } = make(webhook)
+    await drift.check()
+    await webhook.settled()
+    expect(sent.map((s) => s.event)).toEqual(['drift.found'])
+    expect(sent[0].items).toMatchObject([{ kind: 'app', name: 'Blocker', server: 'b' }])
+
+    clock += 15 * 60_000
+    await drift.check()
+    await webhook.settled()
+    expect(sent).toHaveLength(1)
+
+    servers.b.apps.Blocker = json({ ttl: 30 })
+    await drift.check()
+    await webhook.settled()
+    expect(sent.map((s) => s.event)).toEqual(['drift.found', 'drift.cleared'])
+  })
+
+  it('does not repeat a notice after a restart, and does not call an unreadable server cleared', async () => {
+    baseline('Blocker', json({ ttl: 30 }))
+    servers.a.apps.Blocker = json({ ttl: 30 })
+    servers.b.apps.Blocker = json({ ttl: 99 })
+    await make().drift.check()
+    const webhook = hook()
+    const restarted = make(webhook).drift
+    await restarted.check()
+    await webhook.settled()
+    expect(sent).toEqual([])
+    servers.b.down = true
+    await restarted.check()
+    await webhook.settled()
+    expect(sent).toEqual([])
+  })
+})