feat(copilot): actionable recommendations — one-click safe fixes

Copilot recommendations now carry the finding's SAFE remediation.action
through context → brief → UI, and the briefing shows an "Apply fix" button
(admin) that calls the same guarded posture.remediate path (e.g.
fw-reconcile through the lockout guard), then re-briefs. Risky fixes stay
guided (link only); copilot remains advise-only. 1 test.

Full suite: 1825 passing across 116 suites.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: bogdanpricop

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "8.9.43-alpha.1",
+  "version": "8.9.44-alpha.1",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/js/pages/copilot.js

@@ -59,12 +59,15 @@ const CopilotPage = {
         <div class="card-body" style="padding:0">
           ${(b.recommendations || []).length === 0 ? '<div class="empty-msg"><i class="fas fa-circle-check" style="color:var(--green)"></i> Nothing pressing — your estate looks clean.</div>'
             : `<table class="data-table"><thead><tr><th style="width:80px">Sev</th><th>What</th><th>Why</th><th style="width:150px"></th></tr></thead>
-              <tbody>${b.recommendations.map(r => `
+              <tbody>${b.recommendations.map((r, i) => `
                 <tr>
                   <td><span class="badge" style="background:${this._SEV[r.severity] || '#8b949e'};color:#fff">${Utils.escapeHtml(r.severity)}</span></td>
                   <td><strong>${Utils.escapeHtml(r.title)}</strong>${r.host ? `<div class="text-sm text-dim">${Utils.escapeHtml(r.host)}</div>` : ''}</td>
                   <td class="text-sm text-dim">${Utils.escapeHtml(r.why || '')}</td>
-                  <td style="text-align:right">${r.link ? `<a class="btn btn-xs btn-secondary" href="${Utils.escapeHtml(r.link)}"><i class="fas fa-arrow-right"></i> ${Utils.escapeHtml(r.action || 'Open')}</a>` : ''}</td>
+                  <td style="text-align:right;white-space:nowrap">
+                    ${(r.fixAction && this._isAdmin) ? `<button class="btn btn-xs btn-primary" data-cp-fix="${i}"><i class="fas fa-wand-magic-sparkles"></i> Apply fix</button> ` : ''}
+                    ${r.link ? `<a class="btn btn-xs btn-secondary" href="${Utils.escapeHtml(r.link)}"><i class="fas fa-arrow-right"></i> ${Utils.escapeHtml(r.action || 'Open')}</a>` : ''}
+                  </td>
                 </tr>`).join('')}</tbody></table>`}
         </div>
       </div>
@@ -85,6 +88,21 @@ const CopilotPage = {
     this._renderTranscript();
     el.querySelector('#cp-send')?.addEventListener('click', () => this._ask());
     el.querySelector('#cp-q')?.addEventListener('keydown', (e) => { if (e.key === 'Enter') this._ask(); });
+    el.querySelectorAll('[data-cp-fix]').forEach(btn => btn.addEventListener('click', () => this._applyFix(parseInt(btn.getAttribute('data-cp-fix'), 10), btn)));
+  },
+
+  async _applyFix(idx, btn) {
+    const rec = (this._brief.recommendations || [])[idx];
+    if (!rec || !rec.fixAction) return;
+    const ok = await Modal.confirm(`Apply the safe fix for “${rec.title}”? (Goes through the firewall lockout guard.)`, { confirmText: 'Apply fix' });
+    if (!ok) return;
+    if (btn) { btn.disabled = true; btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i>'; }
+    try {
+      const r = await Api.remediatePosture(rec.fixAction);
+      if (r && r.ok === false) { Toast.error(r.error || 'Fix failed'); }
+      else { Toast.success('Fix applied'); }
+      await this._load(true);
+    } catch (err) { Toast.error(err.message); if (btn) { btn.disabled = false; btn.innerHTML = '<i class="fas fa-wand-magic-sparkles"></i> Apply fix'; } }
   },
 
   _renderTranscript() {

public/js/pages/whatsnew.js

@@ -9,6 +9,14 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '8.9.44-alpha.1',
+      date: '2026-07-13',
+      title: 'Copilot — actionable recommendations (one-click safe fixes)',
+      changes: [
+        { type: 'feature', text: 'Copilot recommendations that map to a SAFE remediation now offer an “Apply fix” button right in the briefing (admin) — it reuses the exact same guarded path as Posture (e.g. re-apply drifted firewall rules through the lockout guard), then re-briefs. Risky fixes still stay guided (deep-link only). The copilot stays advise-only; the one-click is limited to actions that create no new exposure. Ties Copilot → Posture remediation into one flow.' },
+      ],
+    },
     {
       version: '8.9.43-alpha.1',
       date: '2026-07-13',

src/__tests__/copilot.test.js

@@ -19,6 +19,16 @@ describe('copilot rule-based briefing', () => {
     // blueprint drift becomes a recommendation
     expect(recs.some(r => /drifted/.test(r.title))).toBe(true);
   });
+
+  test('carries a safe one-click fixAction through from the finding', () => {
+    const recs = brief.recommend({ findings: [
+      { severity: 'medium', title: 'drifted', detail: 'd', remediation: { label: 'Re-apply', link: '#/firewall', action: { type: 'fw-reconcile', hostId: 2 } } },
+      { severity: 'high', title: 'no fix', detail: 'x', remediation: { label: 'Open', link: '#/x' } },
+    ] });
+    const drift = recs.find(r => r.title === 'drifted');
+    expect(drift.fixAction).toEqual({ type: 'fw-reconcile', hostId: 2 });
+    expect(recs.find(r => r.title === 'no fix').fixAction).toBeNull();
+  });
   test('summaryLine reflects counts', () => {
     expect(brief.summaryLine({ grade: 'C', score: 60, counts: { critical: 1, high: 0, medium: 2 }, hosts: [{}, {}] }))
       .toMatch(/grade C \(60\/100\).*1 critical.*2 medium.*2 host/);

src/services/copilot/brief.js

@@ -13,6 +13,9 @@ function recommend(ctx) {
       severity: f.severity, title: f.title, why: f.detail || '',
       action: (f.remediation && f.remediation.label) || 'Review',
       link: (f.remediation && f.remediation.link) || null,
+      // Carry a SAFE one-click action (e.g. re-apply firewall drift) so the
+      // Copilot can offer "Apply fix" straight from the recommendation.
+      fixAction: (f.remediation && f.remediation.action) || null,
       host: f.host || null,
     });
   }

src/services/copilot/context.js

@@ -20,10 +20,12 @@ async function assemble() {
     out.score = scan.global.score; out.grade = scan.global.grade; out.counts = scan.global.counts;
     const hostName = new Map((scan.hosts || []).map(h => [h.hostId, h.name]));
     out.findings = (scan.findings || []).filter(f => !f.muted).slice(0, 12).map(f => ({
-      severity: f.severity, checkId: f.checkId, title: f.title,
+      severity: f.severity, checkId: f.checkId, title: f.title, key: f.key,
       host: f.hostId != null ? (hostName.get(f.hostId) || `host ${f.hostId}`) : null,
       detail: f.detail,
-      remediation: f.remediation ? { label: f.remediation.label, link: f.remediation.link } : null,
+      // Keep the SAFE one-click action (if any) for the UI path — the LLM path
+      // trims findings down separately and never sees this.
+      remediation: f.remediation ? { label: f.remediation.label, link: f.remediation.link, action: f.remediation.action || null } : null,
     }));
     out.hostScores = (scan.hosts || []).map(h => ({ name: h.name, grade: h.grade, score: h.score }));
   } catch (e) { log.debug('posture context failed', { error: e.message }); }

src/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the application version.
 // Updated automatically by: npm version X.Y.Z  (via scripts/sync-version.js)
 // server.js reads this to inject into index.html at startup — no build step needed.
-module.exports = '8.9.43-alpha.1';
+module.exports = '8.9.44-alpha.1';