Phase 11: remote UX & network attach (0.11.0)

- Live remote-stack logs over a WebSocket proxied through the central app to
  the agent (/ws/agent-logs/{agent}/{stack}); agent gains a WS log endpoint.
- Deploy to a remote host from the UI: host selector in the New Stack editor
  and template dialog; templates instantiate onto an agent via the proxy.
- Network attach/detach: expandable inspect view per network with
  connect/disconnect + container picker; GET /{id}/containers, POST connect/disconnect.
- Remove dead pages/Placeholder.tsx.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/networks.py

@@ -36,6 +36,12 @@ class NetworkCreate(BaseModel):
     attachable: bool = True
 
 
+class ContainerRef(BaseModel):
+    container: str
+    aliases: list[str] | None = None
+    force: bool = False
+
+
 @router.get("")
 def list_networks(_user: User = Depends(get_current_user)) -> list[dict]:
     return network_service.list_networks()
@@ -43,7 +49,58 @@ def list_networks(_user: User = Depends(get_current_user)) -> list[dict]:
 
 @router.get("/{network_id}")
 def inspect_network(network_id: str, _user: User = Depends(get_current_user)) -> dict:
-    return network_service.inspect_network(network_id)
+    try:
+        return network_service.inspect_network(network_id)
+    except DockerError as exc:
+        _map(exc)
+
+
+@router.get("/{network_id}/containers")
+def network_containers(
+    network_id: str, _user: User = Depends(get_current_user)
+) -> list[dict]:
+    try:
+        return network_service.connectable_containers(network_id)
+    except DockerError as exc:
+        _map(exc)
+
+
+@router.post("/{network_id}/connect")
+def connect_container(
+    network_id: str,
+    body: ContainerRef,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    try:
+        network_service.connect_container(network_id, body.container, body.aliases)
+    except DockerError as exc:
+        _map(exc)
+    audit_service.record(
+        session, user=user.username, action="network.connect", target=network_id,
+        detail=body.container, ip=_ip(request),
+    )
+    return {"ok": True}
+
+
+@router.post("/{network_id}/disconnect")
+def disconnect_container(
+    network_id: str,
+    body: ContainerRef,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    try:
+        network_service.disconnect_container(network_id, body.container, body.force)
+    except DockerError as exc:
+        _map(exc)
+    audit_service.record(
+        session, user=user.username, action="network.disconnect", target=network_id,
+        detail=body.container, ip=_ip(request),
+    )
+    return {"ok": True}
 
 
 @router.post("", status_code=201)

backend/routers/templates.py

@@ -8,10 +8,12 @@ from sqlmodel import Session
 
 from auth import get_current_user, require_admin
 from database import get_session
+from models.agent import Agent
 from models.stack import Stack
 from models.template import TemplateInstantiateRequest, TemplateSaveRequest
 from models.user import User
-from services import audit_service, compose_service, template_service
+from services import agent_service, audit_service, compose_service, template_service
+from services.agent_service import AgentError
 
 router = APIRouter(prefix="/api/templates", tags=["templates"])
 
@@ -72,7 +74,7 @@ def delete_template(
 
 
 @router.post("/{template_id}/instantiate", status_code=201)
-def instantiate(
+async def instantiate(
     template_id: str,
     body: TemplateInstantiateRequest,
     request: Request,
@@ -83,11 +85,32 @@ def instantiate(
     if not tpl:
         raise HTTPException(status_code=404, detail="Template not found")
 
+    rendered = template_service.render(tpl["yaml"], body.values)
+
+    if body.agent_id is not None:
+        agent = session.get(Agent, body.agent_id)
+        if not agent:
+            raise HTTPException(status_code=404, detail=f"Agent {body.agent_id} not found")
+        try:
+            result = await agent_service.call(
+                session, agent, "POST", "/agent/stacks",
+                json={"name": body.name, "yaml": rendered, "env": None},
+            )
+        except AgentError as exc:
+            raise HTTPException(
+                status_code=exc.status if exc.status >= 400 else 502,
+                detail={"error": exc.error, "detail": exc.detail},
+            )
+        audit_service.record(
+            session, user=user.username, action="template.instantiate",
+            target=f"{agent.name}/{result.get('id')}", detail=template_id, ip=_ip(request),
+        )
+        return {"id": result.get("id"), "name": body.name, "agent_id": agent.id}
+
     stack_id = compose_service.slugify(body.name)
     if session.get(Stack, stack_id) or os.path.isdir(compose_service.stack_dir(stack_id)):
         raise HTTPException(status_code=409, detail=f"Stack '{stack_id}' already exists")
 
-    rendered = template_service.render(tpl["yaml"], body.values)
     compose_service.write_compose(stack_id, rendered)
     stack = Stack(id=stack_id, name=body.name, description=tpl.get("description"))
     session.add(stack)
@@ -96,4 +119,4 @@ def instantiate(
         session, user=user.username, action="template.instantiate",
         target=stack_id, detail=template_id, ip=_ip(request),
     )
-    return {"id": stack_id, "name": body.name}
+    return {"id": stack_id, "name": body.name, "agent_id": None}

backend/routers/ws.py

@@ -4,10 +4,16 @@ from __future__ import annotations
 import asyncio
 import json
 
+import contextlib
+
+import websockets
 from fastapi import APIRouter, Query, WebSocket, WebSocketDisconnect
 from jose import JWTError
+from sqlmodel import Session
 
 from auth import decode_token
+from database import engine
+from models.agent import Agent
 from services import compose_service
 
 router = APIRouter(tags=["ws"])
@@ -82,6 +88,47 @@ async def ws_service_logs(
         pass
 
 
+@router.websocket("/ws/agent-logs/{agent_id}/{stack_id}")
+async def ws_agent_logs(
+    websocket: WebSocket,
+    agent_id: int,
+    stack_id: str,
+    token: str | None = Query(default=None),
+):
+    """Proxy live compose logs from a remote agent through to the browser."""
+    await websocket.accept()
+    if not await _authorize(websocket, token):
+        return
+
+    with Session(engine) as session:
+        agent = session.get(Agent, agent_id)
+    if not agent:
+        await websocket.send_text(json.dumps({"type": "error", "detail": "agent not found"}))
+        await websocket.close()
+        return
+
+    base = agent.url.rstrip("/")
+    ws_url = ("wss://" + base[8:] if base.startswith("https://")
+              else "ws://" + base[7:] if base.startswith("http://")
+              else "ws://" + base)
+    ws_url += f"/agent/ws/logs/{stack_id}?token={agent.token}"
+
+    try:
+        async with websockets.connect(ws_url, open_timeout=10, ping_interval=20) as upstream:
+            async for message in upstream:
+                await websocket.send_text(
+                    message if isinstance(message, str) else message.decode("utf-8", "replace")
+                )
+    except WebSocketDisconnect:
+        pass
+    except Exception as exc:  # noqa: BLE001
+        with contextlib.suppress(Exception):
+            await websocket.send_text(json.dumps({"type": "error", "detail": str(exc)}))
+    finally:
+        with contextlib.suppress(Exception):
+            await websocket.close()
+
+
 @router.websocket("/ws/events")
 async def ws_events(
     websocket: WebSocket,