v25.2.44: trim vault secret values + honest compose-editor Save wording

Author: Paul C

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "25.2.43"
+version = "25.2.44"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"

Cargo.toml

@@ -34178,14 +34178,21 @@ async fn secrets_save(
     let mut secrets = load_secrets();
     let now = now_iso();
 
+    // Trim the value the same way we trim the key. A pasted credential or
+    // token almost always carries a trailing newline (copied from a
+    // terminal / password manager), which then gets injected into the
+    // container verbatim — the value LOOKS correct everywhere it's shown but
+    // downstream auth fails with no visible cause. `trim()` only touches
+    // leading/trailing whitespace, so internal structure (e.g. multi-line
+    // PEM bodies) is preserved.
     if let Some(existing) = secrets.iter_mut().find(|s| s.key == key) {
-        if let Some(ref v) = body.value { existing.value = v.clone(); }
+        if let Some(ref v) = body.value { existing.value = v.trim().to_string(); }
         if let Some(ref d) = body.description { existing.description = d.clone(); }
         existing.updated = now;
     } else {
         secrets.push(SecretEntry {
             key: key.clone(),
-            value: body.value.clone().unwrap_or_default(),
+            value: body.value.as_deref().unwrap_or("").trim().to_string(),
             description: body.description.clone().unwrap_or_default(),
             created: now.clone(),
             updated: now,

src/api/mod.rs

@@ -647,7 +647,8 @@ fn synthesise_compose_template(app_id: &str, d: &DockerTarget) -> String {
     out.push_str("# Auto-generated docker-compose.yml for ");
     out.push_str(app_id);
     out.push_str(".\n");
-    out.push_str("# Edit freely — saving re-runs `docker compose up -d`.\n");
+    out.push_str("# Edit freely. Save writes this file; click \"Up\" in Compose Stacks\n");
+    out.push_str("# to apply it (`docker compose up -d`) and inject any vault secrets.\n");
     out.push_str("services:\n");
 
     // Main service.

src/appstore/mod.rs

@@ -5152,6 +5152,7 @@ <h3 id="compose-editor-title">Edit Stack</h3>
                         </div>
                     </div>
                 </div>
+                <div style="padding:8px 16px 0; font-size:11.5px; color:var(--text-muted); line-height:1.5;">Save writes the compose &amp; <code>.env</code> files. To apply them, click <strong>▶ Up</strong> on the stack — that runs <code>docker compose up -d</code> and injects vault secrets. (Restart does <em>not</em> re-read compose/env changes.)</div>
                 <div class="modal-footer" style="display:flex; justify-content:space-between;">
                     <div>
                         <button class="btn btn-sm" onclick="validateComposeYaml()" style="font-size:12px;">Validate</button>

web/index.html

@@ -61067,7 +61067,10 @@ async function saveComposeFiles() {
                     body: JSON.stringify({ name, content: env }),
                 }),
             ]);
-            showToast(`Stack "${name}" saved`, 'success');
+            // Saving only writes the files — it does NOT re-run docker
+            // compose. Tell the operator to click Up to apply, so a change
+            // that references a new vault secret doesn't silently stay stale.
+            showToast(`Stack "${name}" saved — click ▶ Up to apply the changes`, 'success', 5000);
         } else {
             // Create new stack
             const name = document.getElementById('compose-create-name').value.trim();
@@ -61085,7 +61088,7 @@ async function saveComposeFiles() {
                 showToast(data.error || 'Failed to create stack', 'error');
                 return;
             }
-            showToast(`Stack "${name}" created`, 'success');
+            showToast(`Stack "${name}" created — click ▶ Up to start it`, 'success', 5000);
         }
         closeComposeEditor();
         loadComposeStacks();