fix: never commit package-lock.json, clean install in update.sh, bump v0.5.0

package-lock.json generated on Windows includes win32 rollup binary but
not linux-x64-gnu, breaking the frontend build on the server.

- Add package-lock.json to .gitignore and remove it from git tracking
- update.sh: rm -rf node_modules + package-lock.json before npm install
  so the server always generates a platform-correct lock file from scratch
- update.sh: remove --silent from build steps so errors are visible
- .gitignore: fix stale whm/cpanel dist paths → nixserver/nixclient

.gitignore

@@ -6,15 +6,20 @@ dist/
 .DS_Store
 Thumbs.db
 
+# package-lock.json is platform-specific (rollup native binaries differ between
+# Windows dev machines and Linux servers). Never commit it — the server generates
+# its own on each install.
+package-lock.json
+
 # Prisma
 server/prisma/dev.db
 server/prisma/dev.db-journal
 
 # Build outputs
 server/dist/
-whm/dist/
+nixserver/dist/
-cpanel/dist/
+nixclient/dist/
 
 # Vite
-whm/.vite/
+nixserver/.vite/
-cpanel/.vite/
+nixclient/.vite/

CHANGELOG.md

@@ -6,6 +6,23 @@ Pre-1.0 versions treat MINOR as feature releases and PATCH as bug fixes.
 
 ---
 
+## [0.5.0] — 2026-04-11
+
+### Bug Fixes
+- **Rollup native binary missing on Linux** — `package-lock.json` was generated on Windows and committed to git. It included the Windows rollup binary (`@rollup/rollup-win32-x64-msvc`) but not the Linux one (`@rollup/rollup-linux-x64-gnu`), causing the frontend build to fail on the server with `Cannot find module @rollup/rollup-linux-x64-gnu`.
+- **`package-lock.json` added to `.gitignore`** — lock files are platform-specific and must never be committed. The server now generates its own fresh lock file on every update.
+- **`update.sh` now does a clean install** — deletes `node_modules/` and `package-lock.json` before `npm install` on every update run to guarantee platform-correct native binaries. Also drops `--silent` from build commands so errors are visible.
+- **`.gitignore` corrected** — removed stale `whm/` and `cpanel/` dist paths, added correct `nixserver/` and `nixclient/` paths.
+
+---
+
+## [0.4.9] — 2026-04-11
+
+### Bug Fixes
+- **`update.sh` fails when `package-lock.json` has local changes** — `git pull --ff-only` aborted with "Your local changes would be overwritten by merge" whenever npm had modified the lock file on the server. Fixed by running `git checkout -- package-lock.json` before the pull to discard local changes to the generated lock file.
+
+---
+
 ## [0.4.8] — 2026-04-11
 
 ### Bug Fixes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixpanel-server",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "private": true,
   "workspaces": [
     "server",

scripts/update.sh

@@ -14,12 +14,19 @@ INSTALL_DIR="${1:-/opt/nixpanel}"
 [[ -d "$INSTALL_DIR/.git" ]] || error "NixPanel not found at $INSTALL_DIR"
 
 step "Pulling latest code"
+# package-lock.json is not tracked (platform-specific), but discard any other
+# locally modified tracked files that could block a fast-forward pull
+git -C "$INSTALL_DIR" checkout -- . 2>/dev/null || true
 git -C "$INSTALL_DIR" pull --ff-only
 success "Code updated"
 
 step "Installing dependencies"
 cd "$INSTALL_DIR"
-npm install --workspaces --include-workspace-root --silent
+# Delete node_modules and any stale lock file so npm regenerates them fresh
+# for this platform (avoids the rollup native binary mismatch between
+# Windows dev machines and Linux servers)
+rm -rf node_modules package-lock.json
+npm install --workspaces --include-workspace-root
 success "Dependencies ready"
 
 step "Running migrations"
@@ -30,8 +37,8 @@ success "Migrations applied"
 
 step "Rebuilding frontends"
 cd "$INSTALL_DIR"
-npm run build --workspace=nixserver --silent
+npm run build --workspace=nixserver
-npm run build --workspace=nixclient --silent
+npm run build --workspace=nixclient
 # Ensure Apache (www-data) can read the rebuilt assets
 chmod 755 "$INSTALL_DIR/nixserver" "$INSTALL_DIR/nixclient"
 find "$INSTALL_DIR/nixserver/dist" -type d -exec chmod 755 {} \;
@@ -42,7 +49,7 @@ success "Frontends rebuilt"
 
 step "Rebuilding server"
 cd "$INSTALL_DIR/server"
-npm run build --silent 2>/dev/null || npx tsc 2>/dev/null || true
+npm run build 2>/dev/null || npx tsc 2>/dev/null || true
 success "Server rebuilt"
 
 step "Restarting service"

server/src/app.ts

@@ -73,7 +73,7 @@ export async function buildApp() {
 
   fastify.get('/api/health', async () => ({
     status: 'ok',
-    version: '0.4.8',
+    version: '0.5.0',
     timestamp: new Date().toISOString(),
   }))