Release 1.7.7

- CHANGELOG: cut the 1.7.7 release (dated 2026-06-15); reset Unreleased.
- VERSION: 1.7.6 -> 1.7.7.
- Manuals (DA + EN): bump version stamps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -11,6 +11,56 @@ Version numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.7.7] — 2026-06-15
+
+### Changed
+
+- **Share modal no longer leaves a stale link in the create box** — after clicking "Create", the generated-link preview row ("Copy link:") stayed visible at the top of the modal even though the new link was already listed under Active links with its own Copy button — so it looked like the form hadn't cleared. The redundant preview row is removed; creating a link now resets the form and briefly highlights the new entry in the Active links list, where it can be copied. (The 1.7.4 fix cleared the input fields but not this preview row.)
+
+### Added
+
+- **Reverse-proxy / HTTPS setup guide** — new `docs/setup/ZORAXY_SETUP.md` walks through putting the scanner behind Zoraxy with a Let's Encrypt certificate on a LAN-only deployment: DNS A-record to a private IP, ACME via DNS-01 challenge (HTTP-01 cannot reach a LAN-only host), proxy rule to `127.0.0.1:5100`, binding the app to loopback with `--host 127.0.0.1`, and scanner-specific verification (SSE streaming, HTTPS share links, self-update). Linked from the README (new "HTTPS / reverse proxy" section) and SECURITY.md.
+
+### Fixed
+
+- **SECURITY.md corrections** — the web UI binds to `0.0.0.0` by default, not `127.0.0.1` as claimed; the MSAL token cache path was still the pre-1.x `~/.gdpr_scanner_config.json` (actual: `~/.gdprscanner/token.json`).
+
+---
+
+## [1.7.6] — 2026-06-11
+
+### Fixed
+
+- **Update restart leaked the listening socket and hopped to port 5101** — Werkzeug marks its server socket inheritable (`srv.socket.set_inheritable(True)`, unconditionally, for its debug reloader), so the in-app update's `os.execv` restart carried the old listening socket into the new process as a zombie listener: same PID listening on both 5100 (never accepted — clients hang) and 5101 (the actual server). The 1.7.3 `SO_REUSEADDR`/grace-period fix couldn't help because the port genuinely was occupied — by the restarting process itself. `_restart_self()` now marks every fd above stderr close-on-exec before the exec (`_mark_fds_cloexec()`, enumerating `/proc/self/fd` on Linux), so the old socket dies with the exec and the new server rebinds 5100 immediately.
+
+---
+
+## [1.7.5] — 2026-06-11
+
+### Fixed
+
+- **Stale UI after updating the server** — Flask served `/static/` files with no `Cache-Control` header, so browsers cached JS/CSS heuristically (often for days). After a server update — including the new in-app self-update, whose post-install reload hit the cache — the backend was new but the frontend stayed old, and fixes appeared "not to work" until a hard refresh. `SEND_FILE_MAX_AGE_DEFAULT = 0` now makes every static file revalidate via ETag: unchanged files answer with a cheap 304, changed files are re-fetched immediately on the next normal page load.
+
+---
+
+## [1.7.4] — 2026-06-10
+
+### Fixed
+
+- **Share modal kept stale input after creating a link** — clicking "Create" only cleared the label field; scope type, user email, date range, and expiry kept their values, so the next link silently inherited the previous link's scope settings. The form-reset logic from `openShareModal()` is now a shared `_resetShareForm()` helper called after every successful create (the generated link row stays visible for copying).
+
+---
+
+## [1.7.3] — 2026-06-10
+
+### Fixed
+
+- **App restart no longer hops to a new port** — the in-app update restart (and any quick stop/start) left connections from the previous instance in TIME_WAIT, and the startup port probe did a plain `bind()` that treats TIME_WAIT as occupied — so the restarted app silently came up on 5101 and the browser's reload poll never found it. The probe now sets `SO_REUSEADDR` (matching how Werkzeug actually binds, so an actively listening port is still detected as occupied), and the requested port gets a 10-second grace period before the auto-increment fallback kicks in, covering the brief window where the old process hasn't fully released the socket.
+
+- **Share links now respect a reverse proxy** — `_getShareBaseUrl()` rewrote every copied share link to `http://<LAN-IP>:5100` (via `/api/local_ip`), which would bypass TLS when the scanner sits behind a reverse proxy (Zoraxy, Caddy, nginx, …): a DPO opening the link would silently fall back to plain HTTP. The LAN-IP rewrite now only applies in the case it was built for — browsing the app at `localhost` over HTTP, where `window.location.origin` would produce links unusable from other machines. Any HTTPS or non-localhost origin is used as-is.
+
+---
+
 ## [1.7.2] — 2026-06-10
 
 ### Fixed

README.md

@@ -534,6 +534,14 @@ API endpoints: `GET /api/update/check`, `POST /api/update/apply`, `GET/POST /api
 
 ---
 
+### HTTPS / reverse proxy
+
+The scanner itself serves plain HTTP. For encrypted transport on a LAN — recommended, since scan results contain CPR numbers — put it behind a TLS-terminating reverse proxy and bind the app to loopback (`--host 127.0.0.1`) so the proxy is the only way in. Share links automatically follow the HTTPS hostname, and the browser Clipboard API (Copy buttons) works natively in a secure context.
+
+See [ZORAXY_SETUP.md](docs/setup/ZORAXY_SETUP.md) for a complete walkthrough: Zoraxy, Let's Encrypt via DNS-01 challenge (required when the hostname resolves to a private IP), proxy rule, and the scanner-specific verification steps.
+
+---
+
 ### Article 30 report
 
 The **Art.30** button in the filter bar generates a GDPR **Article 30 Register of Processing Activities** as a Word document (`.docx`).
@@ -737,6 +745,7 @@ See [SUGGESTIONS.md](SUGGESTIONS.md) for the full feature roadmap with implement
 | `docs/manuals/MANUAL-DA.md` | End-user manual in Danish (15 sections) — served at `/manual?lang=da` |
 | `docs/setup/M365_SETUP.md` | Step-by-step Microsoft 365 setup guide |
 | `docs/setup/GOOGLE_SETUP.md` | Step-by-step Google Workspace setup guide |
+| `docs/setup/ZORAXY_SETUP.md` | HTTPS via Zoraxy reverse proxy — LAN-only deployment with Let's Encrypt DNS-01 |
 | `build_gdpr.py` | PyInstaller build script — generates `m365_launcher.py`, packages desktop app |
 | `lang/en.json` | English translations (source of truth) |
 | `lang/da.json` | Danish translations (primary language) |

SECURITY.md

@@ -55,9 +55,9 @@ Out of scope:
 
 - CPR numbers are stored in the SQLite database as **SHA-256 hashes only** — never in plaintext
 - SMTP passwords are stored in `~/.gdprscanner/smtp.json` with chmod 600
-- Microsoft OAuth tokens are stored in the MSAL token cache in `~/.gdpr_scanner_config.json`
+- Microsoft OAuth tokens are stored in the MSAL token cache in `~/.gdprscanner/token.json`
 - Scan results are stored locally in `~/.gdprscanner/scanner.db` — never transmitted externally
-- The web UI binds to `127.0.0.1` by default — it is not designed to be exposed to the internet
+- The web UI binds to `0.0.0.0` by default so reviewers on the LAN can reach it — it is not designed to be exposed to the internet. For encrypted transport, put it behind a TLS-terminating reverse proxy and bind the app to loopback with `--host 127.0.0.1` — see [docs/setup/ZORAXY_SETUP.md](docs/setup/ZORAXY_SETUP.md)
 
 ---
 

VERSION

@@ -1 +1 @@
-1.7.2
+1.7.7

docs/manuals/MANUAL-DA.md

@@ -1,6 +1,6 @@
 # GDPR Scanner — Brugermanual
 
-Version 1.7.2
+Version 1.7.7
 
 ---
 
@@ -671,4 +671,4 @@ For en typisk skole- eller kommunescanning er omkostningen ubetydelig — Claude
 
 ---
 
-*GDPR Scanner v1.7.2 — teknisk opsætning og konfiguration: se README.md*
+*GDPR Scanner v1.7.7 — teknisk opsætning og konfiguration: se README.md*

docs/manuals/MANUAL-EN.md

@@ -1,6 +1,6 @@
 # GDPR Scanner — User Manual
 
-Version 1.7.2
+Version 1.7.7
 
 ---
 
@@ -671,4 +671,4 @@ For a typical school or municipality scan the cost is negligible — Claude Haik
 
 ---
 
-*GDPR Scanner v1.7.2 — for technical setup and configuration see README.md*
+*GDPR Scanner v1.7.7 — for technical setup and configuration see README.md*

docs/setup/ZORAXY_SETUP.md

@@ -0,0 +1,130 @@
+# HTTPS via Zoraxy Reverse Proxy
+
+Step-by-step guide for putting GDPRScanner behind [Zoraxy](https://github.com/tobychui/zoraxy) with a Let's Encrypt certificate, on a LAN-only deployment.
+
+Why bother on an internal network:
+
+- **Encryption in transit** — the scanner streams CPR numbers, document previews, and share links. Serving that over plain HTTP to DPO reviewers is itself a compliance finding.
+- **Secure context** — the browser Clipboard API (share-link Copy buttons) only exists on HTTPS or localhost. Over plain HTTP the app falls back to a legacy copy mechanism.
+- **A real hostname** — `https://gdprscanner.example.dk` instead of `http://10.x.x.x:5100` in share links, bookmarks, and emails.
+
+This guide assumes Zoraxy runs **on the same host** as the scanner. If it runs elsewhere, replace `127.0.0.1:5100` with the scanner host's LAN IP and firewall port 5100 to the Zoraxy host only.
+
+---
+
+## 1. DNS record
+
+Create an A-record for the hostname pointing at the server's **LAN IP**:
+
+```
+gdprscanner.example.dk    A    10.x.x.x
+```
+
+A public DNS record pointing at a private IP is fine — outsiders can resolve the name but cannot route to the address, which is exactly the "LAN-only" goal.
+
+> **Consequence:** because the server is not reachable from the internet, Let's Encrypt's default HTTP-01 challenge cannot work. The certificate **must** be issued via the **DNS-01 challenge** (step 4). If you prefer not to publish the internal IP at all, use an internal/split-horizon DNS record instead — DNS-01 still works since it validates against the public DNS zone, not the server.
+
+---
+
+## 2. Install Zoraxy
+
+```bash
+mkdir -p /opt/zoraxy && cd /opt/zoraxy
+wget -O zoraxy https://github.com/tobychui/zoraxy/releases/latest/download/zoraxy_linux_amd64
+chmod +x zoraxy
+```
+
+`/etc/systemd/system/zoraxy.service`:
+
+```ini
+[Unit]
+Description=Zoraxy reverse proxy
+After=network.target
+
+[Service]
+WorkingDirectory=/opt/zoraxy
+ExecStart=/opt/zoraxy/zoraxy
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+```
+
+```bash
+systemctl daemon-reload && systemctl enable --now zoraxy
+```
+
+Open the management UI at `http://<server-ip>:8000` and create the admin account.
+
+> Menu names below may differ slightly between Zoraxy versions — the concepts to look for are: ACME certificate with DNS challenge, host-based proxy rule, TLS on the incoming port.
+
+---
+
+## 3. Incoming port and TLS
+
+In Zoraxy's global settings:
+
+- Set the incoming proxy port to **443** and enable **TLS**.
+- Enable **force-redirect port 80 → 443** so plain-HTTP visits upgrade automatically.
+
+---
+
+## 4. Certificate via ACME (DNS-01)
+
+In **TLS / SSL Certificates → ACME**:
+
+1. Enter the hostname (`gdprscanner.example.dk`).
+2. Enable the **DNS challenge** and select the DNS provider that hosts your zone (Cloudflare, Simply.com, etc.).
+3. Paste the provider's **API token/credentials** — created in the DNS provider's control panel.
+4. Request the certificate. Zoraxy renews it automatically.
+
+If your DNS host has no API, Zoraxy can generate a **self-signed certificate** as a fallback — it works, but every client machine must trust it manually. Getting a DNS API token is the better one-time investment.
+
+---
+
+## 5. Proxy rule
+
+**HTTP Proxy → New Proxy Rule**:
+
+| Field | Value |
+|---|---|
+| Matching hostname | `gdprscanner.example.dk` |
+| Target | `127.0.0.1:5100` |
+| TLS to target | Off (the scanner speaks plain HTTP locally) |
+
+---
+
+## 6. Close the side doors
+
+**Bind the scanner to loopback** so only Zoraxy can reach Flask. Wherever the scanner is started (systemd unit or `start_gdpr.sh`), add:
+
+```bash
+--host 127.0.0.1
+```
+
+After a restart, `http://<server-ip>:5100` stops responding by design. The in-app self-update restart preserves the argument.
+
+Optional hardening:
+
+- Add a Zoraxy **Access Rule** whitelisting your LAN CIDR (e.g. `10.0.0.0/8`) on the proxy rule.
+- Firewall the Zoraxy **management port 8000** to admin machines only.
+
+---
+
+## 7. Verify the scanner-specific behaviour
+
+1. `https://gdprscanner.example.dk` loads with a valid padlock; `http://` redirects.
+2. **Run a scan and watch result cards stream in live** — that is the Server-Sent Events connection (`/api/scan/stream`) passing through the proxy. If progress stalls while the scan log advances, look at proxy buffering/timeout settings.
+3. Create a **share link** — it must start with `https://gdprscanner.example.dk/view?token=…`. The app uses the page origin automatically on HTTPS (the LAN-IP rewrite only applies when browsing at localhost). The Copy buttons now use the native Clipboard API.
+4. **Settings → General → Software update → Check for updates** still works (outbound git fetch is unaffected by the proxy).
+
+---
+
+## Troubleshooting
+
+| Symptom | Cause / fix |
+|---|---|
+| Certificate request fails | HTTP-01 attempted against an unreachable host — make sure the **DNS challenge** is selected and the API credentials are for the zone's actual DNS host |
+| Cards don't stream during scans | Proxy buffering the SSE response — check Zoraxy timeout/buffering settings for the rule |
+| Share links still show the LAN IP | Page was loaded via the old `http://<ip>:5100` URL — use the HTTPS hostname; links follow the page origin |
+| `http://<ip>:5100` still reachable | The `--host 127.0.0.1` flag is missing from the scanner's launch command |

gdpr_scanner.py

@@ -317,6 +317,11 @@ app = Flask(__name__,
             template_folder=_os.path.join(_BASE_DIR, "templates"),
             static_folder=_os.path.join(_BASE_DIR, "static"))
 
+# Static files must revalidate on every load (cheap 304s via ETag). Without
+# this there is no Cache-Control header and browsers cache JS/CSS heuristically
+# for days — after a self-update the backend is new but the UI stays stale.
+app.config["SEND_FILE_MAX_AGE_DEFAULT"] = 0
+
 # Session secret — derived from machine_id so it survives restarts without a separate file.
 # machine_id is also the Fernet key (base64-encoded 32 bytes); we use its raw bytes as the secret.
 try:
@@ -2261,14 +2266,33 @@ Example --settings file with SMTP:
 
         # Find a free port — auto-increment from the requested port if in use.
         import socket as _socket
+
+        def _can_bind(p: int, host: str) -> bool:
+            with _socket.socket(_socket.AF_INET, _socket.SOCK_STREAM) as s:
+                # Probe with SO_REUSEADDR, matching how Werkzeug binds.
+                # Without it, connections left in TIME_WAIT by a previous
+                # instance (e.g. the in-app update restart) make the port
+                # look occupied and the app silently moves to the next one.
+                s.setsockopt(_socket.SOL_SOCKET, _socket.SO_REUSEADDR, 1)
+                try:
+                    s.bind((host, p))
+                    return True
+                except OSError:
+                    return False
+
         def _find_free_port(start: int, host: str) -> int:
-            for p in range(start, start + 100):
+            # Give the requested port a grace period — after a self-restart
-                with _socket.socket(_socket.AF_INET, _socket.SOCK_STREAM) as s:
+            # the previous process may not have released it yet.
-                    try:
+            deadline = time.time() + 10
-                        s.bind((host, p))
+            while True:
-                        return p
+                if _can_bind(start, host):
-                    except OSError:
+                    return start
-                        continue
+                if time.time() >= deadline:
+                    break
+                time.sleep(0.5)
+            for p in range(start + 1, start + 100):
+                if _can_bind(p, host):
+                    return p
             raise RuntimeError(f"No free port found in range {start}–{start + 99}")
 
         actual_port = _find_free_port(args.port, args.host)

routes/updates.py

@@ -118,13 +118,34 @@ def apply_update() -> dict:
             "from": chk["current"], "to": chk["latest"]}
 
 
+def _mark_fds_cloexec() -> None:
+    """Mark every fd above stderr close-on-exec.
+
+    Werkzeug calls ``srv.socket.set_inheritable(True)`` unconditionally
+    (for its debug reloader), so without this the listening socket leaks
+    into the exec'd process: it sits on the port as a zombie listener no
+    one accepts from, the port probe sees the port as busy, and the new
+    server hops to port+1 while clients hang against the dead socket.
+    """
+    try:
+        fds = [int(f) for f in os.listdir("/proc/self/fd")]   # Linux
+    except (OSError, ValueError):
+        fds = list(range(3, 4096))
+    for fd in fds:
+        if fd > 2:
+            try:
+                os.set_inheritable(fd, False)
+            except OSError:
+                pass
+
+
 def _restart_self() -> None:
     """Re-exec the current process so the updated code is loaded.
 
     Keeps the same PID, so it works both under systemd and when launched
-    manually via start_gdpr.sh. Listening sockets are close-on-exec, so
+    manually via start_gdpr.sh.
-    the new process can rebind the port.
     """
+    _mark_fds_cloexec()
     try:
         os.execv(sys.executable, [sys.executable] + sys.argv)
     except OSError:

static/js/CLAUDE.md

@@ -65,7 +65,7 @@ Never revert to `!!window._googleConnected` / `_fileSources.length > 0` — thos
 - **`window.VIEWER_MODE`** — injected by Jinja2. `auth.js` adds `viewer-mode` class to `<body>`; all hide rules are CSS (`body.viewer-mode …`) except `delBtn` which is also guarded in JS.
 - **`window.VIEWER_SCOPE`** — injected alongside `VIEWER_MODE`. If `VIEWER_SCOPE.role` is set, `auth.js` pre-sets `#filterRole` and hides the dropdown.
 - **Token onclick attributes** — Copy/Revoke buttons pass the token as a single-quoted JS string literal, never via `JSON.stringify` (which produces double-quoted strings that break `onclick="…"` attributes).
-- **Share link base URL** — `_getShareBaseUrl()` fetches `/api/local_ip` (LAN IP via UDP probe to `8.8.8.8`) so copied links are routable from other machines. Both `createShareLink` and `copyTokenLink` are `async`. Do not revert to `window.location.origin` — that produces `127.0.0.1` links.
+- **Share link base URL** — `_getShareBaseUrl()` uses `window.location.origin` whenever the page is served over HTTPS or from a non-localhost host (a reverse-proxied hostname or LAN IP is already routable, and rewriting it to `http://<LAN-IP>` would bypass the proxy's TLS). Only when browsing at `localhost`/`127.0.0.1` over HTTP does it fetch `/api/local_ip` (LAN IP via UDP probe to `8.8.8.8`) so copied links work from other machines. The result is cached in `_shareBaseUrl` so Copy buttons stay within the click gesture. Both `createShareLink` and `copyTokenLink` are `async`. Do not make it return bare `window.location.origin` unconditionally — that reintroduces unusable `127.0.0.1` links.
 - **Settings Security pane** — Admin PIN and Viewer PIN groups live in `stPaneSecurity`. `switchSettingsTab('security')` triggers both `stLoadPinStatus()` and `stLoadViewerPinStatus()`.
 
 ## Gotchas

static/js/viewer.js

@@ -5,8 +5,17 @@ import { S } from './state.js';
 let _shareBaseUrl = null;   // cached so Copy buttons can build the URL synchronously
 
 async function _getShareBaseUrl() {
-  // Use the machine's LAN IP so links work for remote users, not just localhost.
   if (_shareBaseUrl) return _shareBaseUrl;
+  // The LAN-IP probe exists only to fix links when the operator browses the
+  // app at localhost — those would be unusable for remote users. Any other
+  // origin (LAN IP, or a reverse-proxied HTTPS hostname) is already routable,
+  // and rewriting it to http://<LAN-IP> would bypass the proxy's TLS.
+  const host = window.location.hostname;
+  if (window.location.protocol === 'https:' ||
+      (host !== 'localhost' && host !== '127.0.0.1' && host !== '[::1]')) {
+    _shareBaseUrl = window.location.origin;
+    return _shareBaseUrl;
+  }
   try {
     const r = await fetch('/api/local_ip');
     if (r.ok) {
@@ -129,9 +138,7 @@ function _shareScopeTypeChanged() {
   if (type === 'user') _initUserAutocomplete();
 }
 
-function openShareModal() {
+function _resetShareForm() {
-  document.getElementById('shareBackdrop').classList.add('open');
-  document.getElementById('shareNewLinkRow').style.display = 'none';
   document.getElementById('shareLabel').value = '';
   document.getElementById('shareExpiry').value = '30';
   const scopeType = document.getElementById('shareScopeType');
@@ -143,6 +150,11 @@ function openShareModal() {
   if (scopeDrop) scopeDrop.style.display = 'none';
   const vf = document.getElementById('shareValidFrom'); if (vf) vf.value = '';
   const vt = document.getElementById('shareValidTo');   if (vt) vt.value = '';
+}
+
+function openShareModal() {
+  document.getElementById('shareBackdrop').classList.add('open');
+  _resetShareForm();
   _renderTokenList();
   fetch('/api/viewer/pin').then(function(r){ return r.json(); }).then(function(d) {
     const el = document.getElementById('sharePinStatus');
@@ -154,7 +166,7 @@ function closeShareModal() {
   document.getElementById('shareBackdrop').classList.remove('open');
 }
 
-async function _renderTokenList() {
+async function _renderTokenList(highlightToken) {
   const list = document.getElementById('shareTokenList');
   list.innerHTML = '<div style="font-size:12px;color:var(--muted);padding:4px 0">' + t('lbl_loading', 'Loading…') + '</div>';
   try {
@@ -209,6 +221,17 @@ async function _renderTokenList() {
         '<button title="' + t('share_revoke', 'Revoke') + '" onclick="revokeToken(\'' + tok.token + '\',this.closest(\'div[style]\'))" ' +
           'style="height:24px;padding:0 8px;background:none;border:1px solid var(--danger);color:var(--danger);border-radius:4px;font-size:11px;cursor:pointer;flex-shrink:0">' + t('share_revoke', 'Revoke') + '</button>';
       list.appendChild(row);
+      // Briefly highlight a freshly created link so it is easy to find and copy.
+      if (highlightToken && tok.token === highlightToken) {
+        row.style.transition = 'border-color .3s, background .3s';
+        row.style.borderColor = 'var(--accent)';
+        row.style.background = 'rgba(80,160,80,.18)';
+        setTimeout(function() { row.scrollIntoView({block: 'nearest'}); }, 0);
+        setTimeout(function() {
+          row.style.borderColor = 'var(--border)';
+          row.style.background = 'var(--bg)';
+        }, 2500);
+      }
     });
   } catch(e) {
     list.innerHTML = '<div style="font-size:12px;color:var(--danger);padding:4px 0">' + t('share_load_error', 'Failed to load links.') + '</div>';
@@ -251,23 +274,16 @@ async function createShareLink() {
     });
     if (!r.ok) throw new Error('Server error ' + r.status);
     const entry = await r.json();
-    const url = (await _getShareBaseUrl()) + '/view?token=' + encodeURIComponent(entry.token);
+    // The new link appears in the active-links list below (each row has its
-    const urlInput = document.getElementById('shareNewLinkUrl');
+    // own Copy button) — reset the form and highlight the just-created row
-    urlInput.value = url;
+    // rather than leaving a stale link preview in the create box.
-    document.getElementById('shareNewLinkRow').style.display = 'block';
+    _resetShareForm();
-    document.getElementById('shareCopyBtn').textContent = t('log_copy', 'Copy');
+    _renderTokenList(entry.token);
-    document.getElementById('shareLabel').value = '';
-    _renderTokenList();
   } catch(e) {
     alert(t('share_create_error', 'Failed to create link:') + ' ' + e.message);
   }
 }
 
-function copyShareLink() {
-  const url = document.getElementById('shareNewLinkUrl').value;
-  _copyText(url, document.getElementById('shareCopyBtn'));
-}
-
 async function copyTokenLink(token, btn) {
   const url = (await _getShareBaseUrl()) + '/view?token=' + encodeURIComponent(token);
   _copyText(url, btn);
@@ -315,12 +331,6 @@ async function revokeToken(token, rowEl) {
     if (!list.children.length) {
       list.innerHTML = '<div style="font-size:12px;color:var(--muted);padding:4px 0">' + t('share_no_links', 'No active links.') + '</div>';
     }
-    // Hide the copy row if the just-revoked token was the last created
-    const newRow = document.getElementById('shareNewLinkRow');
-    if (newRow) {
-      const shownUrl = document.getElementById('shareNewLinkUrl')?.value || '';
-      if (shownUrl.includes(token)) newRow.style.display = 'none';
-    }
   } catch(e) {
     alert(t('share_revoke_error', 'Failed to revoke:') + ' ' + e.message);
   }
@@ -489,7 +499,6 @@ window._shareScopeTypeChanged = _shareScopeTypeChanged;
 window.openShareModal       = openShareModal;
 window.closeShareModal      = closeShareModal;
 window.createShareLink      = createShareLink;
-window.copyShareLink        = copyShareLink;
 window._copyText            = _copyText;
 window.copyTokenLink        = copyTokenLink;
 window.revokeToken          = revokeToken;

templates/index.html

@@ -1094,13 +1094,6 @@ document.addEventListener('DOMContentLoaded', applyI18n);
         </div>
         <button onclick="createShareLink()" style="height:30px;padding:0 14px;background:var(--accent);color:#fff;border:none;border-radius:5px;font-size:12px;cursor:pointer;flex-shrink:0" data-i18n="share_create">Create</button>
       </div>
-      <div id="shareNewLinkRow" style="display:none;margin-top:10px">
-        <div style="font-size:11px;color:var(--muted);margin-bottom:4px" data-i18n="share_copy_link_prompt">Copy link:</div>
-        <div style="display:flex;gap:6px;align-items:center">
-          <input id="shareNewLinkUrl" type="text" readonly style="flex:1;font-size:11px;padding:5px 8px;background:var(--bg2,var(--bg));border:1px solid var(--border);border-radius:5px;color:var(--text);min-width:0">
-          <button onclick="copyShareLink()" id="shareCopyBtn" style="height:26px;padding:0 10px;background:none;border:1px solid var(--border);color:var(--muted);border-radius:5px;font-size:11px;cursor:pointer;flex-shrink:0" data-i18n="log_copy">Copy</button>
-        </div>
-      </div>
     </div>
 
     <!-- Existing tokens -->

tests/test_updates.py

@@ -188,6 +188,23 @@ def test_apply_installs_requirements_when_changed(client, monkeypatch):
     assert "pip" in pip_calls[0] and "-r" in pip_calls[0]
 
 
+# ── Restart fd hygiene ────────────────────────────────────────────────────────
+
+def test_mark_fds_cloexec_unmarks_inheritable_socket():
+    """Werkzeug sets the listening socket inheritable; the restart must undo
+    that or the socket leaks through execv and squats on the port."""
+    import socket
+    import routes.updates as upd
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        s.set_inheritable(True)
+        assert s.get_inheritable() is True
+        upd._mark_fds_cloexec()
+        assert s.get_inheritable() is False
+    finally:
+        s.close()
+
+
 # ── /api/update/settings ──────────────────────────────────────────────────────
 
 def test_settings_roundtrip(client, monkeypatch):