Setu 0.1.6: plain-text logs, Apps page fits phones, tokio advisory

CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to Setu. Release notes are cut from the section
 matching the tag.
 
+## 0.1.6 — 2026-10-23
+
+### Fixed
+
+- **Site logs are plain text.** The agent strips terminal escape sequences
+  (colours, cursor moves, window titles) from each journal line, so an app
+  that colours its logs under systemd no longer fills the Logs tab with
+  `ESC[32m` noise.
+- **Apps page on phones.** A followed manifest URL no longer widens the
+  app card past the screen, which made the whole page scroll sideways.
+
+### Security
+
+- tokio 1.54.1 and ctutils 0.4.5 (RUSTSEC-2026-0385, RUSTSEC-2026-0386).
+
 ## 0.1.5 — 2026-10-21
 
 Spec: `docs/specs/2026-10-21-setu-0.1.5-design.md`.

Cargo.toml

@@ -13,7 +13,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.5"
+version = "0.1.6"
 edition = "2021"
 license = "AGPL-3.0-only"
 # Never published to crates.io (single binary + private repo); also

crates/agent/src/journal.rs

@@ -40,21 +40,64 @@ pub fn parse_journal_json(text: &str) -> LogStream {
             next = Some(c.to_string());
         }
         match v.get("MESSAGE") {
-            Some(serde_json::Value::String(s)) => lines.push(s.clone()),
+            Some(serde_json::Value::String(s)) => lines.push(strip_ansi(s)),
             // Non-UTF-8 messages arrive as a byte array.
             Some(serde_json::Value::Array(bytes)) => {
                 let raw: Vec<u8> = bytes
                     .iter()
                     .filter_map(|b| b.as_u64().and_then(|b| u8::try_from(b).ok()))
                     .collect();
-                lines.push(String::from_utf8_lossy(&raw).into_owned());
+                lines.push(strip_ansi(&String::from_utf8_lossy(&raw)));
             }
             _ => {}
         }
     }
     LogStream { lines, next }
 }
 
+/// Drops terminal escape sequences (colours, cursor moves, titles) from a
+/// log line. Apps colour their logs whether or not a terminal is reading,
+/// and the panel shows plain text, so `ESC[32mINFO` would arrive as
+/// garbage. Handles CSI (`ESC [ … final`), OSC (`ESC ] … BEL` or
+/// `ESC \\`) and two-byte `ESC x` escapes; any other text is kept.
+pub fn strip_ansi(line: &str) -> String {
+    if !line.contains('\u{1b}') {
+        return line.to_owned();
+    }
+    let mut out = String::with_capacity(line.len());
+    let mut chars = line.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c != '\u{1b}' {
+            out.push(c);
+            continue;
+        }
+        match chars.next() {
+            // CSI: parameters and intermediates up to a final byte in @..~.
+            Some('[') => {
+                for c in chars.by_ref() {
+                    if ('@'..='~').contains(&c) {
+                        break;
+                    }
+                }
+            }
+            // OSC: up to BEL or the string terminator ESC \.
+            Some(']') => {
+                while let Some(c) = chars.next() {
+                    if c == '\u{7}' {
+                        break;
+                    }
+                    if c == '\u{1b}' && chars.peek() == Some(&'\\') {
+                        chars.next();
+                        break;
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    out
+}
+
 /// Read up to `lines` entries after `cursor`.
 /// `program` is `journalctl` in production (a fake script in tests).
 pub async fn read(
@@ -109,4 +152,36 @@ mod tests {
         assert_eq!(s.lines, ["hello", "hi"]);
         assert_eq!(s.next.as_deref(), Some("c2"));
     }
+
+    #[test]
+    fn colour_codes_are_stripped_from_messages() {
+        // What a tracing subscriber writes when it thinks a terminal is
+        // reading: dim timestamp, green level, dim target.
+        let coloured = "\u{1b}[2m2026-10-22T06:37:20Z\u{1b}[0m \u{1b}[32m INFO\u{1b}[0m \u{1b}[2mvyasa::host\u{1b}[0m\u{1b}[2m:\u{1b}[0m docs sync finished";
+        let text = format!(
+            "{}\n{}\n",
+            serde_json::json!({"__CURSOR": "c1", "MESSAGE": coloured}),
+            // journald hands control characters over as a byte array.
+            serde_json::json!({"__CURSOR": "c2", "MESSAGE": "\u{1b}[31mfail\u{1b}[0m".bytes().collect::<Vec<_>>()}),
+        );
+        let s = parse_journal_json(&text);
+        assert_eq!(
+            s.lines,
+            [
+                "2026-10-22T06:37:20Z  INFO vyasa::host: docs sync finished",
+                "fail"
+            ]
+        );
+    }
+
+    #[test]
+    fn strip_ansi_keeps_plain_text_and_drops_osc_titles() {
+        assert_eq!(strip_ansi("plain [text] ok"), "plain [text] ok");
+        assert_eq!(strip_ansi("\u{1b}]0;title\u{7}after"), "after");
+        assert_eq!(
+            strip_ansi("a\u{1b}]8;;http://x\u{1b}\\link\u{1b}]8;;\u{1b}\\b"),
+            "alinkb"
+        );
+        assert_eq!(strip_ansi("bold \u{1b}[1;31mred\u{1b}[0m"), "bold red");
+    }
 }

ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "setu-ui",
   "private": true,
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "scripts": {
     "gen:api": "tsx scripts/gen-api.ts",

ui/src/components/AppsCatalogue.tsx

@@ -84,7 +84,7 @@ function AppCard({ app }: { app: AppInfo }) {
   const list = versions.data ?? [];
   const [latest, ...older] = list;
   return (
-    <li className="group flex flex-col rounded-lg border bg-card p-5 shadow-card transition-colors hover:border-primary/40">
+    <li className="group flex min-w-0 flex-col rounded-lg border bg-card p-5 shadow-card transition-colors hover:border-primary/40">
       <div className="flex items-start gap-3">
         <span className="flex size-10 shrink-0 items-center justify-center rounded-lg bg-primary-subtle text-link ring-1 ring-primary/15">
           <Package className="size-5" aria-hidden="true" />