adamgell/cmtraceopen v1.5.0

CMTrace Open v1.5.0

on GitHub

Stable downloads: https://download.cmtraceopen.com/?source=github-release

CMTrace Open v1.5.0

Open-source CMTrace log viewer with built-in Intune diagnostics.

What's New

Added

• ESP Diagnostics workspace: Added a dedicated, full-width, no-sidebar workspace for troubleshooting Windows Autopilot Enrollment Status Page, Autopilot Device Preparation, and software deployment failures. It combines scenario/phase progress, actionable evidence-backed findings, workload state, enrollment/profile/registry/event evidence, Delivery Optimization, coverage gaps, and a live What MSIEXEC is doing now sampler on one page. Live Windows sessions continue collecting while the log surface is collapsed or another workspace is active; captured CMTrace Open evidence folders, manifests, CABs, and ZIPs are also supported. Features include failure detection (InstallationState / ErrorHresult from Sidecar registry), live current-task hero showing what's installing now with progress, session capture/replay (export live/failed sessions as JSON for offline analysis), workloads search/filter (name, ID, status) plus Failed / Running / Installed / Queued category chips, section jump navigation (sticky bar with per-section jump pills and return-to-top), and timeline GUID→name resolution (Intune app names in event stream). Read-only throughout except one opt-in, backed-up remediation action: on Windows with elevation, a Force past ESP button backs up the failing app's registry key, sets InstallationState=3, clears ErrorHresult, and offers one-click restore—allowing a Try again to proceed when ESP is blocked by a false negative.
• Bounded live deployment evidence: Added curated IME, ConfigMgr, Patch My PC, PSAppDeployToolkit, installer, and shallow high-signal temporary-log discovery with rotation/truncation handling and explicit retention limits. The live-log surface is collapsed by default, vertically resizable when docked, expandable to the full workspace, and available from a prominent Open live logs app-chrome action. No deep-scan or full-drive route is provided.
• Optional ESP Microsoft Graph enrichment: When the existing Graph option is enabled and its WAM connection is already authenticated, the workspace can add managed-device, Autopilot profile/event, ESP configuration, app, policy, certificate, platform-script, and remediation context while preserving raw local IDs. Per-section permission, offline, throttled, skipped, beta, partial, cancelled, and ambiguous-device states remain visible; connecting never queues work or opens a second sign-in flow. The managed-device correlation now captures the device's Entra device ID via NetGetAadJoinInformation (the same source Windows dsregcmd uses), so device matching resolves reliably and Graph sections enrich even on re-imaged VMs where serial-number fallback would fail.
• User-triggered Graph permission upgrade: Settings now offers Request missing permissions for an authenticated partial WAM connection. One explicit click re-requests the fixed five delegated read permissions; successful candidates can add capabilities without removing working ones. Unchanged, cancelled, denied, or failed outcomes retain the existing in-memory partial connection, while a stale outcome leaves the newer authoritative authentication state untouched. Startup and ESP refresh never initiate the upgrade, and tokens remain excluded from IPC and logs.
• Window state persistence (#260, closes #253): The app now restores its window size, position, and maximized state across launches via the official Tauri window-state plugin, so a resized, moved, or maximized window comes back the way you left it. The configured 1200×800 geometry remains the first-launch default.

Changed

• Administrator coverage guidance and retained sessions: ESP Diagnostics now checks elevation on workspace entry, recommends administrator access before collection when needed, and offers an explicit administrator restart on supported Windows builds. Non-elevated sessions remain usable but identify the protected registry, event-log, process-command-line, SYSTEM-temp, and user-temp evidence that could not be read. Every device and user enrollment session remains available through latest, all-session, and individual-session views.
• Redesigned native application menu: Reworked and synchronized the native application menu — a centralized action layer behind the menu items, synchronized menu state, and platform-consistent accelerators. Window items (Toggle Details/Info panes, Always on Top) now live under a View submenu, with Always on Top preserved as a checkable item that reflects and persists the window's pinned state.
• Rust MSRV raised to 1.88 (#289): The minimum supported Rust toolchain moved from 1.77.2 → 1.88, required by the sha2 0.11 and serde_with/darling 0.23 upgrades in this release. The sha256 hex formatting was reworked to be sha2 0.11-ready ahead of the crate bump, and CI's MSRV gate now validates against 1.88.

Fixed

• Failure detection and phase propagation: The reducer now reads the authoritative per-app Sidecar registry (InstallationState / ErrorHresult) instead of the mid-state OMA-DM diagnostics value, so failed apps now correctly report as Failed with their error code (e.g. 0x80079C69), and the session phase reflects Failed when any tracked app fails. Previously, a failed app could remain stuck showing inProgress.
• Graph app enrichment (referencedAppIds): The frontend was silently dropping app GUIDs from Graph requests by matching against a bare GUID with an anchored regex, but real Win32 workload identifiers are decorated (Win32App_<guid>_1). Now GUIDs are extracted from the decorated identifier, so the request carries the full list of apps to Graph and the Applications section enriches instead of skipping.
• Capture/replay validation (FILETIME QWORDs): Session captures (40+ MB on real devices) were failing to load because registry FILETIME values are ~1.34e17, above JavaScript's safe-integer limit. The wire validator now accepts any integer-valued number for display-only registry values while keeping strict safe-integer validation for structural counts. Both real captures now round-trip cleanly.
• Import button routing: "Import captured evidence" now routes a session JSON to the replay loader (not the bundle analyzer), so either import button works for session files.
• Decorated GUID handling across the UI: Timeline entries, findings, and the workload table now uniformly extract GUIDs from decorated identifiers and resolve them to app names via the shared name map, so workload identifiers like Win32App_<guid>_1 render as "Citrix Workspace" or "Windows Autopatch Client Broker" instead of raw GUIDs across every surface.
• Message column sizing on open (#292, closes #254): Opening a log almost always produced a horizontal scrollbar, because the Log Text column auto-expanded to the widest line in the file, capped only by a 1200px bound unrelated to how much room the window actually had. The measured width is now clamped to the space genuinely left over — container width minus the other visible columns and the row-marker gutter, floored at the column's own minWidth — so a freshly opened file fits the window. Explicit Fit this column (double-click) and drag-resize still widen past the viewport: once a width is user-owned, the auto-sizer leaves it alone.

Security

• Read-only analysis with one backed-up write action: ESP Diagnostics performs registry queries, event/process observation, bounded file reads/tailing, archive inspection, and read-only Graph GETs (including bounded $batch POSTs whose subrequests are GET-only). Analysis findings and UI surfaces remain fully read-only. One explicit opt-in exception exists: the Actions section (Windows-only, local non-replayed sessions, elevation-required) offers Force past ESP on a failed app — it backs up the Sidecar key values, sets InstallationState=3, and clears ErrorHresult so ESP stops blocking, after which a Try again can proceed; a one-click Restore reverts the backup. The button requires explicit confirmation stating it writes to the device, does not install the app, and requires administrator access. It does not sync MDM, retry/install software, control services, import registry files, or mutate Intune. Graph uses the existing memory-only WAM token path and five delegated read scopes; authorization headers and raw response bodies are not logged.
• ESP evidence privacy and archive limits: Sensitive identity/NodeCache fields are classified and masked by default, installer command lines are sanitized before IPC/logging, raw hardware hashes are excluded from normal surfaces, and CAB/ZIP inputs enforce entry, size, path, type, and extraction-root limits with cleanup.
• Close time and serde_with advisories (#290): Dropped the vendored time 0.3.36 backport and its [patch.crates-io] override; time now resolves from crates.io at 0.3.54, closing GHSA-r6v5-fh4h-64xc (stack-exhaustion DoS) — which the backport did not cover — and restoring cargo audit visibility that the path dependency had hidden. serde_with moves 3.17.0 → 3.21.0, closing GHSA-7gcf-g7xr-8hxj (KeyValueMap panic). Both patched releases required the Rust 1.88 MSRV from #289. The RFC 2822 nesting-bound regression test is retained and now guards the upstream crate instead of a local copy.

Build & CI

• Pin the last floating action refs (#274): download-metrics.yml was the only workflow still referencing actions by mutable tag (actions/checkout@v7, actions/setup-node@v7); every other call site in the repo is SHA-pinned with a # vX.Y.Z trailer, and .github/dependabot.yml documents the github-actions ecosystem as "proposes SHA pin updates when new versions release". It is also the least safe place to keep a floating ref rather than the most harmless: the workflow runs unattended on a 17 0 * * * cron with permissions: contents: write, passes GITHUB_TOKEN into the collector, and pushes commits to the download-metrics branch — and it is covered by no required status check, so a failure surfaces silently. Both steps are now pinned to the same SHAs the rest of the repo uses. These two tags were also the sole reason Dependabot titled the recent action bumps "from 4 to 7" (it reports the lowest version present in the repo).
• Point Dependabot's cargo ecosystem at the workspace root (#274): The cargo entry in .github/dependabot.yml was still set to directory: "/src-tauri", but #240 moved the workspace lockfile to the repo root — there is no src-tauri/Cargo.lock. As a result Dependabot had opened no cargo pull requests since that move, so Rust dependencies never self-healed while npm-side bumps kept arriving weekly. Now set to /.
• Release download-metrics collector: Added tools/download-metrics, an isolated, privacy-preserving collector that snapshots public GitHub release download counts on a daily 17 0 * * * cron and derives per-release and per-asset metrics into committed snapshot, latest-assets, and summary outputs on a dedicated download-metrics branch. It ships with design docs, its own pinned TypeScript toolchain and test suite, and the download-metrics.yml workflow.
• Harden the metrics collector (#291, closes #263, #264): The collector now excludes draft releases from snapshots — every stable release exists as a draft with its assets already uploaded until a human publishes it, so the scheduled run could otherwise fold draft assets into snapshots, and a naive per-page filter would have truncated pagination and mass-tombstoned live assets — and it refuses to write output at, below, or containing the repository root. The nightly job's worktree moved to ${RUNNER_TEMP}.
• Playwright e2e suite in CI (#294, #293): Added an E2E (Playwright) job to cmtrace-ci.yml that runs the end-to-end suite on every PR (Node-only — the Tauri IPC shim mocks the backend and Vite serves the app), and disambiguated the ESP app-name locators that had silently regressed while nothing watched the suite. The opt-in screenshot harness stays excluded.
• Screenshot capture harness (#251): Added an opt-in Playwright screenshot harness (npm run screenshots) and committed the README screenshots it generates.
• Repository hygiene: Stopped tracking Playwright test artifacts and added them to .gitignore (#252); removed the obsolete main.yml workflow (#262).

Dependencies

• Rust: tauri-plugin-dialog 2.7.1 → 2.7.2 (#274), realigning the Rust half with the npm half bumped in #272. 2.7.2 is an Android-only fix (MaterialAlertDialogBuilder) with no effect on this app's targets, but the two halves are kept in lockstep by convention — and the frontend suite cannot detect plugin drift at all, since src/test-setup.ts mocks @tauri-apps/plugin-dialog wholesale. Also bumped: sha2 0.10.9 → 0.11.0 (#275), serde_with 3.17.0 → 3.21.0 (#288, #290), uuid 1.20.0 → 1.24.0 (#285), plist 1.7.4 → 1.8.0 (#277), anyhow 1.0.103 → 1.0.104 (#282), chrono 0.4.44 → 0.4.45 (#287), thiserror 2.0.18 → 2.0.19 (#284), serde_json 1.0.149 → 1.0.151 (#283), regex 1.12.3 → 1.13.1 (#281), serde 1.0.228 → 1.0.229 (#286); the vendored time backport was replaced by time 0.3.54 from crates.io (#290).
• Frontend (production): @fluentui/react-components 9.74.3 → 9.74.4, @fluentui/react-charts 9.3.21 → 9.3.22, @tanstack/react-virtual 3.14.6 → 3.14.7, @tauri-apps/plugin-dialog 2.7.1 → 2.7.2 (#272). The only functional change in the group is @tanstack/virtual-core 3.17.4 → 3.17.5, which clamps scrollOffset at a lower bound of 0 and resets the deferred iOS scroll adjustment inside scrollToOffset/scrollToIndex (upstream TanStack/virtual #1229, #1233) — an upstream bugfix that lands in the log list's tail-follow and jump-to-entry paths. Later waves (#259, #280) advanced react / react-dom 19.2.7 → 19.2.8, @fluentui/react-icons 2.0.331 → 2.0.334, and @tanstack/react-virtual to 3.14.8, and @tauri-apps/plugin-window-state 2.4.1 was added (#260) for the restored window geometry.
• Frontend (dev): @testing-library/jest-dom 6.9.1 → 7.0.0 and vite 8.1.4 → 8.1.5 (#271). jest-dom 7 promotes @testing-library/dom to a required peer (satisfied at 10.4.1) and raises its declared minimum Node to 22, while CI pins Node 20; the published bundle uses no Node 22-only APIs and the full suite passes, so this is a supportability note rather than a break. Later dev bumps: @playwright/test 1.61.1 → 1.62.0 and @vitejs/plugin-react 6.0.3 → 6.0.4 (#278).
• GitHub Actions: actions/setup-node 6.4.0 → 7.0.0 (#270), actions/checkout 7.0.0 → 7.0.1 (#268), taiki-e/install-action 2.83.2 → 2.84.0 (#269). Despite Dependabot's "from 4 to 7" titles, main was already SHA-pinned to checkout v7.0.0 everywhere except download-metrics.yml, so the checkout change is a patch across ten steps: v7.0.1 escapes the credentials-file path before git config --unset (actions/checkout #2530), which matters on the Windows signing jobs where that path contains backslashes. Neither major alters any action input — the entire action.yml delta from checkout v4 to v7.0.1 is using: node20 → node24 — and the v7.0.0 fork-PR restriction does not apply, as no workflow here triggers on pull_request_target or workflow_run. Additionally, taiki-e/install-action advanced to 2.85.0 (#256, #276) and github/codeql-action/upload-sarif was bumped (#258).

Windows Downloads