From aa948d3ee026ce445761ea6fe17f83208914c6c1 Mon Sep 17 00:00:00 2001
From: Andre Padez <andre.padez@gmail.com>
Date: Tue, 18 Aug 2026 14:15:38 +0000
Subject: [PATCH] panel: a missing `identified` is unknown, not a failed
 identification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The health card reported a healthy Vaultwarden as "Answered, but not a
Vaultwarden". The vault was fine; the two processes were on different versions.

`identified` was added to the sidecar's /_health in 680b8fb. An older sidecar
answers without the field at all, and the panel read missing as false — so a
version skew between officer and officer-vault surfaced as a claim about the
user's server. They are PM2 peers, and `pm2 restart officer` does not restart
`officer-vault`, so that skew is the normal state after updating a plugin
rather than an edge case.

Now only an explicit `false` warns. Missing renders as plain "Answering":
reachable, and honest that the sidecar did not say what it reached.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 web/VaultPanel.tsx | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/web/VaultPanel.tsx b/web/VaultPanel.tsx
index f464eed..92e66e4 100644
--- a/web/VaultPanel.tsx
+++ b/web/VaultPanel.tsx
@@ -253,17 +253,33 @@ export const VaultPanel = () => {
             {health ? (
               <div className="flex flex-col gap-1 text-xs text-muted-foreground">
                 <div className="flex items-center gap-2">
-                  {/* Three outcomes, not two. "Answered but is not a Vaultwarden" is its own state and the
-                      main reason this check exists — pointing at the wrong port on a busy host gives a
-                      perfectly good 200 from something that can never serve a vault. */}
-                  <Pill tone={health.ok ? (health.identified ? 'success' : 'warning') : 'danger'}>
-                    {health.ok ? (health.identified ? 'Vaultwarden' : 'Answered, but not a Vaultwarden') : 'No answer'}
+                  {/*
+                    FOUR outcomes, and the fourth is the one that bit: `identified` is missing entirely
+                    when an OLDER sidecar answers, because it predates the field. Treating missing as
+                    false reported a perfectly good Vaultwarden as "not a Vaultwarden" — a false negative
+                    produced by a version skew between two processes, not by anything about the vault.
+                    (`pm2 restart officer` does not restart `officer-vault`; they are PM2 peers.)
+
+                    So only an explicit `false` is the warning. Absent means the sidecar did not say,
+                    which is honestly reported as plain reachability rather than guessed at in either
+                    direction.
+                  */}
+                  <Pill
+                    tone={!health.ok ? 'danger' : health.identified === false ? 'warning' : 'success'}
+                  >
+                    {!health.ok
+                      ? 'No answer'
+                      : health.identified === false
+                        ? 'Answered, but not a Vaultwarden'
+                        : health.identified === true
+                          ? 'Vaultwarden'
+                          : 'Answering'}
                   </Pill>
                   {health.version && <span>v{health.version}</span>}
                   {health.ms !== undefined && <span>{health.ms}ms</span>}
                   {health.upstreamStatus !== undefined && <span>HTTP {health.upstreamStatus}</span>}
                 </div>
-                {health.ok && !health.identified && (
+                {health.ok && health.identified === false && (
                   <span className={toneText.warning}>
                     Something is listening there, but it did not identify itself as a Vaultwarden. Check the
                     port.