fix: never commit package-lock.json, clean install in update.sh, bump v0.5.0

package-lock.json generated on Windows includes win32 rollup binary but
not linux-x64-gnu, breaking the frontend build on the server.

- Add package-lock.json to .gitignore and remove it from git tracking
- update.sh: rm -rf node_modules + package-lock.json before npm install
  so the server always generates a platform-correct lock file from scratch
- update.sh: remove --silent from build steps so errors are visible
- .gitignore: fix stale whm/cpanel dist paths → nixserver/nixclient

.gitignore

@@ -6,15 +6,20 @@ dist/
 .DS_Store
 Thumbs.db
 
+# package-lock.json is platform-specific (rollup native binaries differ between
+# Windows dev machines and Linux servers). Never commit it — the server generates
+# its own on each install.
+package-lock.json
+
 # Prisma
 server/prisma/dev.db
 server/prisma/dev.db-journal
 
 # Build outputs
 server/dist/
-whm/dist/
-cpanel/dist/
+nixserver/dist/
+nixclient/dist/
 
 # Vite
-whm/.vite/
-cpanel/.vite/
+nixserver/.vite/
+nixclient/.vite/

CHANGELOG.md

@@ -6,6 +6,38 @@ Pre-1.0 versions treat MINOR as feature releases and PATCH as bug fixes.
 
 ---
 
+## [0.5.0] — 2026-04-11
+
+### Bug Fixes
+- **Rollup native binary missing on Linux** — `package-lock.json` was generated on Windows and committed to git. It included the Windows rollup binary (`@rollup/rollup-win32-x64-msvc`) but not the Linux one (`@rollup/rollup-linux-x64-gnu`), causing the frontend build to fail on the server with `Cannot find module @rollup/rollup-linux-x64-gnu`.
+- **`package-lock.json` added to `.gitignore`** — lock files are platform-specific and must never be committed. The server now generates its own fresh lock file on every update.
+- **`update.sh` now does a clean install** — deletes `node_modules/` and `package-lock.json` before `npm install` on every update run to guarantee platform-correct native binaries. Also drops `--silent` from build commands so errors are visible.
+- **`.gitignore` corrected** — removed stale `whm/` and `cpanel/` dist paths, added correct `nixserver/` and `nixclient/` paths.
+
+---
+
+## [0.4.9] — 2026-04-11
+
+### Bug Fixes
+- **`update.sh` fails when `package-lock.json` has local changes** — `git pull --ff-only` aborted with "Your local changes would be overwritten by merge" whenever npm had modified the lock file on the server. Fixed by running `git checkout -- package-lock.json` before the pull to discard local changes to the generated lock file.
+
+---
+
+## [0.4.8] — 2026-04-11
+
+### Bug Fixes
+- **Login page showing stale hardcoded version** — "NixServer v0.3.2 · Port 2087" was hardcoded. Now fetches version live from `GET /api/health` (no auth required) on mount.
+- **Login page subtitle** — "Web Host Manager" replaced with "Admin Panel" to remove any WHM trademark association.
+
+---
+
+## [0.4.7] — 2026-04-11
+
+### Bug Fixes
+- **Login broken after v0.4.6 update** — `package-lock.json` still mapped the workspace as `@nixpanel/whm`. After renaming the package to `@nixpanel/nixserver`, npm workspace resolution failed during `npm install`, causing the frontend build to break and leaving the panel unresponsive. Fixed by regenerating `package-lock.json` with the correct package name.
+
+---
+
 ## [0.4.6] — 2026-04-11
 
 ### Changes

nixserver/src/pages/Login.tsx

@@ -1,7 +1,8 @@
-import React, { useState } from 'react'
+import React, { useState, useEffect } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { useAuth } from '../contexts/AuthContext'
 import { Shield } from 'lucide-react'
+import axios from 'axios'
 
 export default function Login() {
   const { login } = useAuth()
@@ -10,6 +11,13 @@ export default function Login() {
   const [password, setPassword] = useState('')
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
+  const [version, setVersion] = useState<string | null>(null)
+
+  useEffect(() => {
+    axios.get('/api/health', { timeout: 5_000 })
+      .then(r => setVersion(r.data.version ?? null))
+      .catch(() => {})
+  }, [])
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault()
@@ -35,7 +43,7 @@ export default function Login() {
             <Shield size={24} className="text-white" />
           </div>
           <h1 className="text-white text-xl font-bold">NixServer</h1>
-          <p className="text-[#64748b] text-sm mt-1">Web Host Manager</p>
+          <p className="text-[#64748b] text-sm mt-1">Admin Panel</p>
         </div>
 
         {/* Form */}
@@ -81,7 +89,7 @@ export default function Login() {
         </form>
 
         <p className="text-center text-[#64748b] text-xs mt-4">
-          NixServer v0.3.2 · Port 2087
+          NixServer{version ? ` v${version}` : ''} · Port 2087
         </p>
       </div>
     </div>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixpanel-server",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "private": true,
   "workspaces": [
     "server",

scripts/update.sh

@@ -14,12 +14,19 @@ INSTALL_DIR="${1:-/opt/nixpanel}"
 [[ -d "$INSTALL_DIR/.git" ]] || error "NixPanel not found at $INSTALL_DIR"
 
 step "Pulling latest code"
+# package-lock.json is not tracked (platform-specific), but discard any other
+# locally modified tracked files that could block a fast-forward pull
+git -C "$INSTALL_DIR" checkout -- . 2>/dev/null || true
 git -C "$INSTALL_DIR" pull --ff-only
 success "Code updated"
 
 step "Installing dependencies"
 cd "$INSTALL_DIR"
-npm install --workspaces --include-workspace-root --silent
+# Delete node_modules and any stale lock file so npm regenerates them fresh
+# for this platform (avoids the rollup native binary mismatch between
+# Windows dev machines and Linux servers)
+rm -rf node_modules package-lock.json
+npm install --workspaces --include-workspace-root
 success "Dependencies ready"
 
 step "Running migrations"
@@ -30,8 +37,8 @@ success "Migrations applied"
 
 step "Rebuilding frontends"
 cd "$INSTALL_DIR"
-npm run build --workspace=nixserver --silent
-npm run build --workspace=nixclient --silent
+npm run build --workspace=nixserver
+npm run build --workspace=nixclient
 # Ensure Apache (www-data) can read the rebuilt assets
 chmod 755 "$INSTALL_DIR/nixserver" "$INSTALL_DIR/nixclient"
 find "$INSTALL_DIR/nixserver/dist" -type d -exec chmod 755 {} \;
@@ -42,7 +49,7 @@ success "Frontends rebuilt"
 
 step "Rebuilding server"
 cd "$INSTALL_DIR/server"
-npm run build --silent 2>/dev/null || npx tsc 2>/dev/null || true
+npm run build 2>/dev/null || npx tsc 2>/dev/null || true
 success "Server rebuilt"
 
 step "Restarting service"

server/src/app.ts

@@ -73,7 +73,7 @@ export async function buildApp() {
 
   fastify.get('/api/health', async () => ({
     status: 'ok',
-    version: '0.4.6',
+    version: '0.5.0',
     timestamp: new Date().toISOString(),
   }))