add xo-server-ssh executable that ease a connection to the hypervisors
Without parameters it list the pool uuid/master ip
With a pool uuid parameter it opens a sshg connection to the pool master
With a pool uuid and ip, it will reuse the pool credentials to connect to the slave host
* feat(mcp): support HTTP_PROXY, HTTPS_PROXY, NO_PROXY env vars
* chore(changelog): mention MCP proxy env var support
* refactor(mcp): delegate proxy env handling to undici
the cleanVm script was a monolith in charge of cleaning the backup,
detecting any corrupted data, deleting the irrecoverable one, removing
and merging older backups
this PR do a complete rewrite, using the RemoteDisk abstraction and add
tests
xo-server uses two libraries for its web server:
http-server-plus — a multi-protocol server facade that multiplexes HTTP and HTTPS listeners behind a single EventEmitter interface ( introduced here JsCommunity/http-server-plus@ec63f3f )
stoppable — wraps the server to track open connections for graceful shutdown, using an internal reqsPerSocket Map (server._pendingSockets) (introduced here : 782505b )
Fix
@vates/http-server-plus (fork of JsCommunity/http-server-plus): add 'secureConnection' to the forwardedEvents list so that webServer.on('secureConnection', handler) is propagated to underlying https.Server instances at listen() time.
xo-server/src/index.mjs: register the missing handler that stoppable was supposed to add but never did:
Change the backups so they stop using their own task system, and use the same system as XO Tasks.
For the moment, it shouldn't affect the users, but when the previous backup logs will be old enough to be erased, this will allow us to have shorter loading times for backup logs.
XO-52
* chore: upgrade dependencies with known security vulnerabilities
* Update Node.js version in CI workflow
* chore: upgrade additional security dependencies
* chore: stabilize yarn.lock path-to-regexp entry
* chore: bump minimum version ranges for security-patched dependencies
* chore: update CHANGELOG.unreleased.md with security upgrades
* chore: revert vite upgrade to 6.4.1 (6.4.2 breaks vue-tsc)
* chore: fix vite upgrade and pin vue to 3.5.28
This PR adds the new @xen-orchestra/mcp package — an MCP (Model Context Protocol) server that enables AI assistants (Claude Desktop, Claude Code, or any MCP-compatible client) to query a Xen Orchestra infrastructure in read-only mode.
Configure dependency injection + configure authentication middleware for openapi (copy of what actually exists in the current REST API. Will be improved later when implementing ACL/resource set)
