v22.6.14: WolfRouter traceroute one-click install + distro-aware fallback

- /api/traceroute distinguishes ENOENT from other failures and now also
  returns install_command (sudo apt-get/dnf/pacman/zypper install -y
  traceroute) so the UI's copy-paste fallback is correct on RHEL / Arch
  / SUSE, not just Debian/Ubuntu.
- WolfRouter Trace tab uses install_command for the manual fallback;
  defaults to apt only if the backend didn't send one (older nodes).
- System Check page surfaces the missing traceroute binary proactively
  with a one-click Install button, alongside tcpdump/conntrack/etc.
- installer::packages gains a "traceroute" mapping for all four distro
  families plus unit tests pinning the mapping (so a future PACKAGES
  refactor can't silently drop it).
- CLAUDE.md gains a "Quality Bar — The Anthropic Test" section that
  ties the existing global no-TODO / no-guess / Codex-review rules
  together as a single quality gate.

Reported by Adam Cogswell 2026-04-30: Visual TraceRoute tab failing on
Ubuntu minimal images that ship without traceroute, with no in-app way
to fix it.

Author: Paul C

CLAUDE.md

@@ -67,6 +67,21 @@ All frontend code lives in `web/`:
 
 **Serde conventions**: All structs use `#[serde(rename_all = "snake_case")]` for enums. Fields that may be absent from older JSON configs need `#[serde(default)]`. The frontend sends/receives snake_case JSON matching Rust field names.
 
+## Quality Bar — The Anthropic Test
+
+**Every change must meet the bar Anthropic PBC themselves would hold this code to if they were shipping it.** Before declaring any work done, ask: *"If Anthropic engineers had to ship this exact diff under their name, would they?"* If the honest answer is "no" or "not quite", the work is not done.
+
+Concretely, this means:
+- **No half-measures.** All branches implemented, all error paths handled, all edge cases addressed. If three platforms exist (Proxmox/libvirt/native), all three work — not two-and-a-stub.
+- **No guessed values.** Every constant, ID, format, and protocol detail comes from reading the source — never from memory or "this looks right".
+- **No dead code, no TODOs, no "follow-up later".** Finish the work or raise the scope question explicitly *before* writing the partial version.
+- **Re-read the diff before declaring done.** Closure bugs, async-without-await, dead variables, unused branches — catch them yourself, don't ship them for Codex/review to find.
+- **Be honest about what was tested.** Compile-passes ≠ feature-works. Don't claim "production-ready" without exercising the actual code path. Surface known untested paths in the closing summary.
+- **The user-facing surface matters as much as the code.** Visible feedback for user actions, accessible interactions, no silent failures. A correct backend with a broken UX is not shipped quality.
+- **Defaults must be safe.** Public surfaces (status pages, logs, error messages) never leak internals, credentials, AI output, or host data unless explicitly intended.
+
+This rule overrides "ship it fast" instincts. If the bar isn't met, say so plainly and either finish the work or stop and ask.
+
 ## Important Conventions
 
 - All Rust source files start with the copyright header (`// Written by Paul Clevett` / `// (C)Copyright Wolf Software Systems Ltd`)

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "22.6.13"
+version = "22.6.14"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"

src/api/mod.rs

@@ -4137,14 +4137,23 @@ pub async fn traceroute_handler(
             // no in-app remedy.
             let is_missing = e.kind() == std::io::ErrorKind::NotFound
                 || e.raw_os_error() == Some(2 /* ENOENT */);
+            // Build the manual-install command for THIS host's distro
+            // so the UI's copy-paste fallback isn't apt-only on RHEL /
+            // Arch / SUSE machines.
+            let install_command = if is_missing {
+                let distro = crate::installer::detect_distro();
+                let (mgr, args) = crate::installer::pkg_install_cmd(distro);
+                Some(format!("sudo {} {} traceroute", mgr, args))
+            } else { None };
             return HttpResponse::InternalServerError().json(serde_json::json!({
                 "error": if is_missing {
-                    "traceroute isn't installed on this host. Click the button below to install it (apt/dnf/pacman), or run the install manually.".to_string()
+                    "traceroute isn't installed on this host. Click the button below to install it, or run the install manually.".to_string()
                 } else {
                     format!("Failed to run traceroute: {}", e)
                 },
                 "missing_tool": if is_missing { Some("traceroute") } else { None },
                 "install_package": if is_missing { Some("traceroute") } else { None },
+                "install_command": install_command,
             }));
         }
         Err(e) => {

src/installer/packages.rs

@@ -65,6 +65,19 @@ const PACKAGES: &[PackageMapping] = &[
         suse: Some("tcpdump"),
         service_unit: None,
     },
+    PackageMapping {
+        // Used by the Visual TraceRoute tab in WolfRouter and the
+        // /api/traceroute endpoint. Ubuntu minimal / cloud images ship
+        // without it by default — Adam Cogswell 2026-04-30 reported
+        // the tab failing with no in-app install path.
+        logical: "traceroute",
+        binary: "traceroute",
+        debian: Some("traceroute"),
+        rhel: Some("traceroute"),
+        arch: Some("traceroute"),
+        suse: Some("traceroute"),
+        service_unit: None,
+    },
     PackageMapping {
         logical: "conntrack",
         binary: "conntrack",
@@ -303,3 +316,46 @@ fn svc_active(unit: &str) -> bool {
         .args(["is-active", "--quiet", unit])
         .status().map(|s| s.success()).unwrap_or(false)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The Visual TraceRoute one-click installer in WolfRouter and the
+    /// System Check page both look up the logical name "traceroute"
+    /// and assume every supported distro can resolve it. If somebody
+    /// later refactors PACKAGES and drops a row, that breakage would
+    /// be invisible until a real user hit it. Pin it down here.
+    #[test]
+    fn traceroute_mapping_resolves_for_all_distros() {
+        let pkg = PACKAGES.iter().find(|p| p.logical == "traceroute")
+            .expect("traceroute logical name must be in PACKAGES");
+        for d in [
+            DistroFamily::Debian,
+            DistroFamily::RedHat,
+            DistroFamily::Arch,
+            DistroFamily::Suse,
+        ] {
+            assert_eq!(
+                resolve(pkg, d), Some("traceroute"),
+                "traceroute mapping missing for distro {:?}", d
+            );
+        }
+        assert_eq!(pkg.binary, "traceroute");
+    }
+
+    /// Every logical name advertised through the System Check UI's
+    /// "Install" button must be in this table — otherwise the button
+    /// 400s with "unknown package". Keep the list of expected logical
+    /// names checked here; failing this test means a callsite was
+    /// added without a corresponding row.
+    #[test]
+    fn known_logical_names_are_present() {
+        for logical in &["traceroute", "tcpdump", "conntrack"] {
+            assert!(
+                PACKAGES.iter().any(|p| p.logical == *logical),
+                "expected logical name {:?} in PACKAGES", logical
+            );
+        }
+    }
+}

src/systemcheck.rs

@@ -165,6 +165,7 @@ pub fn run_checks() -> Vec<DependencyCheck> {
     out.push(simple_auto("tcpdump", "Networking", &["--version"],
         "packet capture (Packets tab in WolfRouter)",
         hint("tcpdump", "tcpdump", "tcpdump", "tcpdump")));
+    out.push(check_traceroute());
     out.push(simple_auto("pppd", "Networking", &["--version"],
         "PPPoE dial-up (WolfRouter WAN)",
         hint("ppp", "ppp", "ppp", "ppp")));
@@ -498,6 +499,37 @@ fn check_kernel_module(modname: &str, category: &str, why: &str) -> DependencyCh
     }
 }
 
+/// Visual TraceRoute (and the /api/traceroute endpoint) shells out to
+/// `traceroute`. It's not in the core diag-tool bundle and Ubuntu's
+/// minimal / cloud images don't ship it. Surface it on the System
+/// Check page with a one-click install button so an operator who
+/// opens the WolfRouter Trace tab knows up front whether they need
+/// to install something. Adam Cogswell 2026-04-30: "if traceroute is
+/// missing offer the user the chance to install it from a button".
+fn check_traceroute() -> DependencyCheck {
+    let (found, ver) = bin_check("traceroute", &["--version"]);
+    let status = if found { DepStatus::Ok } else { DepStatus::Missing };
+    let detail = if found {
+        "Installed — Visual TraceRoute tab in WolfRouter renders the path map.".into()
+    } else {
+        "Not installed — the WolfRouter Visual TraceRoute tab will fail. Common on Ubuntu minimal / cloud images that omit it from the default package set.".into()
+    };
+    DependencyCheck {
+        name: "traceroute".into(),
+        category: "Networking".into(),
+        status,
+        version: ver,
+        detail,
+        install_hint: if found { None } else {
+            Some(hint("traceroute", "traceroute", "traceroute", "traceroute"))
+        },
+        ai_helpful: false,
+        // One-click install hooked to /api/system/install-package via
+        // the "traceroute" mapping added in installer/packages.rs.
+        install_package: if found { None } else { Some("traceroute".into()) },
+    }
+}
+
 fn check_cron() -> DependencyCheck {
     let (found, ver) = bin_check("crontab", &["-V"]);
     // The binary alone isn't enough — without a running daemon, jobs

web/js/wolfrouter.js

@@ -4336,6 +4336,49 @@
             return;
         }
         if (!resp.ok) {
+            // When traceroute itself isn't installed the backend tags
+            // the response with `missing_tool`. Surface an inline
+            // install button instead of a dead-end error so the user
+            // doesn't have to leave the tab to fix it.
+            // Adam Cogswell 2026-04-30: Ubuntu minimal ships without
+            // traceroute; previous flow had no in-app remedy.
+            if (data && data.missing_tool === 'traceroute') {
+                const pkg = data.install_package || 'traceroute';
+                // Distro-aware manual-install command supplied by the
+                // backend (apt-get / dnf / pacman / zypper). Falls back
+                // to apt only if the server didn't send one — the new
+                // backend always does, so this is belt-and-braces for
+                // cluster nodes still running an older build.
+                const manualCmd = data.install_command || ('sudo apt install ' + pkg);
+                if (status) {
+                    status.innerHTML = `❌ ${wrEsc(data.error || 'traceroute is not installed')} ` +
+                        `<button id="wr-tr-install" class="btn btn-sm btn-primary" style="margin-left:8px;">📦 Install ${wrEsc(pkg)}</button>`;
+                    const btn = document.getElementById('wr-tr-install');
+                    if (btn) btn.onclick = async () => {
+                        btn.disabled = true;
+                        btn.textContent = '⏳ Installing…';
+                        try {
+                            const ir = await fetch('/api/system/install-package', {
+                                method: 'POST', headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({ package: pkg }),
+                            });
+                            const idata = await ir.json().catch(() => ({}));
+                            if (!ir.ok || idata.success === false) {
+                                status.innerHTML = `❌ Install failed: ${wrEsc(idata.error || ir.statusText || 'unknown')}. Try the package manager directly: <code>${wrEsc(manualCmd)}</code>.`;
+                                return;
+                            }
+                            status.textContent = '✅ Installed — re-running trace…';
+                            // Re-fire the original Trace flow so the user
+                            // doesn't have to click again.
+                            wrTracerouteGo();
+                        } catch (e) {
+                            status.innerHTML = `❌ Install errored: ${wrEsc(e.message || String(e))}.`;
+                        }
+                    };
+                }
+                if (goBtn) { goBtn.disabled = false; goBtn.textContent = '🛰 Trace'; }
+                return;
+            }
             if (status) status.textContent = '❌ ' + (data.error || resp.statusText);
             if (goBtn) { goBtn.disabled = false; goBtn.textContent = '🛰 Trace'; }
             return;