v0.20.0

Changelog

• 32ed2f6 Merge remote-tracking branch 'marbor-new/main' into new-name
• f954dba branding: capitalize Marbor + improve banner styling
• d7ca35a build(deps): bump lucide-react from 1.27.0 to 1.33.0 in /ui (#81)
• 589c519 build(deps): bump modernc.org/sqlite from 1.56.0 to 1.57.0 (#77)
• 8f69d5e build(deps-dev): bump @vitejs/plugin-react from 6.0.5 to 6.1.0 in /ui (#80)
• 188eac8 build(deps-dev): bump eslint-plugin-react-refresh in /ui (#79)
• 8165c2e build(deps-dev): bump vite from 8.2.1 to 8.2.2 in /ui (#78)
• ec6c270 chore(release): v0.20.0
• 1d5a8cb chore(rename): complete Phase 1 hard-cutover codebase rename to marbor
• 3182923 chore: complete remaining mesh -> marbor rename (UI, internal, CLI, configs, docs)
• d1e0851 chore: complete residual mesh -> marbor rename
• 9edd2fd chore: regenerate marbor.demo.db for marbor_agent schema rename
• ed6b455 ci(pages): add timeout to deploy job
• 7e96f10 docs(bench/ui): purge dead BENCH-RUNBOOK.md pointers, rename-era MESH_URL vars, real ui README
• 74580b4 docs(readme): centered hero header with marbor branding
• 7ca5b5b docs(runtime): document why MLX is indistinguishable from llama.cpp
• 1cee94b feat(activity): unified fleet activity feed with kind taxonomy and CLI parity
• 784849e feat(admin): expose agent-stale flag on the nodes API
• b82fb12 feat(dashboard): pair Saved-vs-Cloud with Fleet Capacity above the fold
• 56b7b74 feat(dashboard): restructure around fleet health and capacity
• 2a4949e feat(demo): Cloud Providers card fully interactive on /demo/
• 5482666 feat(ui): collapsible sidebar nav with persisted desktop toggle
• 04f2400 fix(admin): bound HF config.json architecture fields against int64 overflow
• 0df1529 fix(admin): check crypto/rand errors, serialize schedule writes, encode JSON properly, audit login/reset
• fdc6722 fix(admin): close login role/status enumeration oracle
• 5e5c043 fix(admin): decode settings body outside the shared config lock
• 09e4fc0 fix(admin): distinguish unreadable system memory from a genuine 0 MB reading
• b5ecda2 fix(admin): eliminate settings-PATCH map aliasing and lost-update races
• ddcfc35 fix(admin): extend P131 overflow guard to the GGUF/Ollama arch input path
• d44ee05 fix(admin): gofmt SystemInfo struct field alignment
• 09fd943 fix(admin): make benchmark job ID collision-proof
• 3a5f207 fix(admin): stop fabricating "all RAM free" when MemAvailable is exhausted
• 38e27b6 fix(admin): stop mislabeling agent/api VRAM readings as nvidia-smi
• 4d70a12 fix(admin): surface ErrUnloadUnsupported as a clear 4xx, not an opaque 502
• 1bf9b83 fix(admin): validate HF repoID, default runtime to node's declared value, cap config cache
• 0c12ac8 fix(agent): add HTTP server timeouts to close slowloris exposure
• 03b82f1 fix(agent): add missing argv terminator to unload command
• 811b62f fix(agent): cap request body size on model pull/delete/unload handlers
• 7f9af74 fix(agent): correct process-liveness detection across three drivers
• 6c6f9f1 fix(agent): explicit --enroll always takes precedence over an existing token
• 98f4226 fix(agent): reject a service Config with only one of CertPath/KeyPath set
• 4aee270 fix(agent): reject leading-dash model names and add argv terminators
• c764ffe fix(agent): reject pid<=0 in readPIDFile
• a2c9145 fix(agent): remove ineffective liveProc PID-reuse guard
• c87addc fix(agent): require admin scope for arbitrary runtime commands
• f6117c6 fix(agent): retain live process handle to close a PID-reuse window
• ae8a760 fix(agent): retry transient runtime-version failures, recover refresh panics
• b9dc518 fix(ansible): register-gpus.yml asserted pre-rename mesh_url var, breaking every run
• 57b231a fix(ansible): remove duplicate register key breaking retry/health-poll
• dbd774d fix(ansible/docs): agent enrollment sent the runtime port as the AGENT's port
• eda6cb9 fix(audit): log a rate-limited warning when AppendAuditLog fails
• b88d6cb fix(auth): hold the lock across Refund's limiter lookup-plus-refund
• 5e6317f fix(auth): make Reload's key-map swap atomic
• b0531f6 fix(auth): parse date-form expires_at in local time, not UTC
• e25ed77 fix(bench): normalize --target trailing slash, drop racy drain goroutine, fix rounding
• 1999334 fix(bench): validate N, check prerequisites, fix scratch-file cleanup and error paths
• cf0efa1 fix(bench): verify actual VRAM eviction before firing a cold TTFT sample
• 02f8a19 fix(ci): add timeout-minutes to the four jobs missing one
• 8f601be fix(ci): fail release job loudly on Pages-deploy dispatch error
• 12b2cd6 fix(ci): register QEMU emulation for arm64 docker release builds
• 01c335d fix(ci): scope pages.yml permissions to the job that needs them
• f713bdc fix(cli): classify 404/405/409/422 as user errors on read-only GET paths
• 89a8e8b fix(cli): fail non-zero when the completion script write fails
• 31b1798 fix(cli): gate 503 passthrough on the health-check path only
• ea5f1b8 fix(cli): local session read failure is a user error, not a server error
• 2d425b3 fix(cli): repair bash/zsh completion after a positional argument, and its syntax entirely
• c5b1462 fix(cli): surface terminal-restore errors, restore echo on SIGINT
• bbffdfe fix(cli): write the session file atomically via temp-then-rename
• 5cdc188 fix(compose): bind Grafana to loopback by default in the monitoring overlay
• b721ad9 fix(config): avoid octal misinterpretation in numeric-IP SSRF guard
• 3a1c27c fix(config): close SSRF gap on cloud providers/webhook, reject duplicate key tokens
• 23c6f85 fix(config): close SSRF guard bypass via integer-encoded hosts
• 15aeaa9 fix(config): extend port-collision check to admin, validate session-affinity TTL, dedupe repeat wildcard-bind warning
• 4326a6b fix(demo): hash the seeded demo admin session token
• b54b584 fix(demo): honor stream:false, bind listeners before printing the banner
• 2069739 fix(demo): inline the demo database so the standalone compose file is self-contained
• 06603ae fix(demo): opt demotraffic into its own non-localhost guard for the compose network
• c40fb06 fix(demo): strip seeded mlx-node row, bind admin/metrics to loopback
• cfe831a fix(demotraffic): distinguish a truncated stream from a genuine 0 tokens
• e7a566a fix(demotraffic): mark synthetic traffic and require opt-in for non-localhost
• 6ea8160 fix(docs): aggregate mismatched labels in the cloud-fallback-rate alert
• 252616f fix(docs): correct grammar left over from mesh -> marbor rename
• 420ced2 fix(gen-docs): mark required flags in group-page FLAGS section
• d1ee4d8 fix(infra): CI hardening, image pinning, arm64 docker, install.ps1 TLS (P365-P374)
• 49f40fd fix(infra): installer sudo -E exit handling for agent role
• 3a817e4 fix(infra): installer/gate/smoke hardening, docs-site URL scheme allowlist (P375-P386)
• 58b4ac7 fix(install): default to a per-user path for non-elevated Windows installs
• c93e8c7 fix(install): disable crash-looping systemd unit before nohup fallback
• 67abce5 fix(install): quote systemd unit paths so a space doesn't break parsing
• f47e776 fix(install): send probe_network's banner to stderr, not stdout
• cc27608 fix(install): verify downloaded binary checksum before execution
• c759cc2 fix(install.sh): add missing else-branch to checksum-download fallback
• a726828 fix(loadtest): reject an invalid -max-inflight instead of hanging or panicking
• ea8caa3 fix(main): fail fast on listener bind errors
• 48f867b fix(main): give each server its own fresh shutdown budget
• 7efeb40 fix(main): shutdown/config-validation/startup-UX hardening (P309-P314)
• f9ea455 fix(marboragent): bound runDownload's stderr capture to 64KB
• 38c3d0c fix(marboragent): broaden launchd log predicate beyond subsystem-only
• 50c77bf fix(marboragent): check cert expiry, add SANs, write TLS cert/key atomically
• 71562f7 fix(marboragent): compare bearer token in constant time
• 423b771 fix(marboragent): expire cached runtime version after 30 minutes
• 99147b1 fix(marboragent): fix Windows service stop-wait race and elevation check
• b996c1f fix(marboragent): give Intel GPU per-device stats a fair timeout share
• 2543869 fix(marboragent): give every control action its full timeout, not lock-wait-reduced
• acc2785 fix(marboragent): graceful shutdown on Windows service Stop/Shutdown
• 9c84afb fix(marboragent): guard nil-error fallback and n<=0 in control helpers
• f9152f0 fix(marboragent): harden ProcessDriver PID-file handling
• 04d39d9 fix(marboragent): make Stop() actually fail when reap can't be confirmed
• db6e89d fix(marboragent): make service Stop actually stop on darwin
• d64f2ae fix(marboragent): prefer edge-family temperature keys consistently
• 54427ce fix(marboragent): reap spawned processes to prevent zombie accumulation
• a9dd655 fix(marboragent): reject unsafe characters in the systemd unit file on install
• b1ff0a6 fix(marboragent): resolve launchd domain once, use it consistently
• c1ea630 fix(marboragent): score discovery candidates by exact-match/active state
• eee37d1 fix(marboragent): serialize control actions, make process Start idempotent
• ab89241 fix(marboragent): skip Signal probe on Windows instead of string-matching
• 2d1606e fix(marboragent): strip control chars in plist, disambiguate darwin status
• 41b2767 fix(marboragent): surface enrollment rejection reason, validate --port range
• 16e1945 fix(marboragent): validate token before writing systemd EnvironmentFile
• c9d14ac fix(marboragent): warn when serving plaintext HTTP
• ba9cbb3 fix(metrics): bound LocalDegradation's labels through the cardinality cap
• 8ce7512 fix(mocknode): guard keep_alive eviction with a warm-check, real done-chunk shape
• a4ab3d1 fix(mocknode): send a terminal finish_reason chunk on /v1/completions
• 5242d29 fix(proxy): close three client-disconnect and token-count observability gaps
• 45f50a0 fix(proxy): fail fast on unparseable request bodies in Anthropic translation
• 1da4f63 fix(proxy): only rewrite Content-Type for actually-translated Ollama paths
• 77d7520 fix(proxy): pass Anthropic error envelopes through unchanged
• 2c2392a fix(proxy): prefer server-set X-Request-ID in panic logs over client header
• 6f26781 fix(proxy): refresh RecordModelUse for the node/model that actually served the request
• 88bd470 fix(proxy): translate stop sequences and top_p in Anthropic cloud fallback
• 5d5c69f fix(rename): correct website brand still showing ollama-mesh
• a323a2b fix(rename): finalize Marbor identity coherence post-triple-gate audit
• e7175f2 fix(rename): finalize Phase 1 - correct agent enroll contract, keep ROADMAP deferred, untrack binaries
• ded88fb fix(rename): finalize Phase 1 - repoint URLs, add cutover contract tests
• 62f0351 fix(rename): gate cosmetics - Marbor Agent comments, client error, whitespace
• 0cc0839 fix(rename): repoint install, IndexNow, and runbook URLs
• 25796c1 fix(rename): resolve Phase 1 audit findings
• 0178acf fix(router): bound-check ensureHeadroom against in-flight reservations too
• a2b9f70 fix(router): bound-check model size before evicting for headroom
• 64a40a9 fix(router): close three Start-loop and admin-API hazards
• 8d5ffa1 fix(router): dedup concurrent predictive warm triggers per cycle
• c465227 fix(router): discover --network host Ollama containers
• b8732ff fix(router): discovered docker node URL uses container's private port
• b3e51e6 fix(router): drop dead TTL guard in stickyNode cleanup, exempt auto runtime
• a4d2e72 fix(router): guard agent-poll overlap, close AddNode duplicate race, cap showCache
• 11e526b fix(router): guard backgrounded docker/nvidia/predictive tickers
• 5512e2a fix(router): guard pingWarmupModels against overlapping cycles per node
• 9d147e1 fix(router): guard poll interval default, clean up removed-node state, reset stale telemetry on URL change
• 6994be4 fix(router): honor docker.socket tcp:// endpoint on Windows
• 69d8472 fix(router): keep session affinity alive across a capacity-only miss
• 856fd9a fix(router): key nvidia-smi GPU stats by minor_number, not document order
• 40e9fa6 fix(router): normalize implicit-port https targets before pinned dial
• 0dad94e fix(router): only mark discovered Docker URL after AddNode succeeds
• 1689fda fix(router): protect in-flight models from eviction, fix thrash-guard timing
• e551eab fix(router): prune schedLastFired when schedules are replaced
• 71f86c1 fix(router): publish QueueDepth gauge from a fresh atomic load
• fdba46e fix(router): reconcile stale model digests once per poll cycle
• a302113 fix(router): release warm reservation on scheduler/predictive ping failure
• a29a113 fix(router): require the actual --network host signature, not any missing-IP case
• 38ca521 fix(router): route warmup pings through the TLS-pinning transport
• e549b1b fix(router): run scheduled warmup/unload dispatch off the main tick loop
• 2083baa fix(router): skip predictive prewarm when a warm reservation is already active
• bdf0981 fix(router): stop fabricating nvidia telemetry on parse failure and fix data race
• 510eec1 fix(router): unloadModel returns a sentinel error for unsupported runtimes
• b96e4a1 fix(router): warm a node's models sequentially in WarmModels
• 1782294 fix(router): wrap IPv6 host literals in brackets when building agent URLs
• d613437 fix(runtime): never guess a runtime signature match, agent-side and shared
• b25b49d fix(runtime): validate response shape before confirming Ollama auto-detect
• a66ce4f fix(store): agree with NewProbe's unknown-runtime default in SupportedFieldsFor
• 181da8a fix(store): bind secret ciphertext to its row with AAD, atomic key-file write
• d993bb6 fix(store): correct Store interface's nil-safety doc comment
• 38e2bcb fix(store): decrypt AllSettings, fix :memory: connection isolation, transactional DeleteNode
• 3a0250f fix(store): degrade to default on invalid JSON/bool settings values
• 6668d5e fix(store): hash session tokens before storing in sqlite
• 2e886e6 fix(store): sqlite.go correctness fixes (rows.Err, LIKE escaping, ts ordering, trim, UTC)
• 807534f fix(store): stop advertising response_format as supported for Ollama
• 28ed41f fix(store): stop swallowing errors that can corrupt or hide fleet data
• e531e62 fix(ui): add R10 confirm dialogs for delete-model and run-benchmark
• 81557f6 fix(ui): attach ScrollWheel's wheel handler as a non-passive native listener
• 82bc139 fix(ui): catch handleLogout's bare logout() call
• 8ed3557 fix(ui): clamp soft-budget percent input, reject negative context-window token counts
• 1cd0535 fix(ui): clear password fields on Cancel in the user portal change-password form
• 7f54102 fix(ui): close node-identity race gaps in the Agent/Control modal
• 5d4b808 fix(ui): combobox dropdowns on mobile don't pull keyboard unless typing, render correctly
• 0611464 fix(ui): combobox middle-tap toggles closed like CustomSelect
• df5fea3 fix(ui): combobox on mobile never summons keyboard, menu aligns to input
• bac51d1 fix(ui): compare parsed timestamps for APIKeys' expiry dirty-check
• e79a277 fix(ui): compute the requests page's rolling time window at request time
• c3140fb fix(ui): confirm Undrain, surface offline node-patch failures visibly
• 279351e fix(ui): consistent apiFetch error surfacing, demo-mode/session-expiry gaps (P354-P364)
• 3651734 fix(ui): correlate start() calls and close a prior stream in benchmarkProgress
• 3cc6753 fix(ui): default loadSession's role fallback to 'user' instead of 'admin'
• 8c31f46 fix(ui): derive admin login path from BASE constant (P357)
• 59cd221 fix(ui): disable Approve when no existing key is selected
• 0244ac4 fix(ui): distinct icon for Requests vs Activity
• 49593ae fix(ui): distinguish network/server errors from real credential failures
• a7876b0 fix(ui): dropdowns usable on mobile - touch, z-index, viewport clamp
• c6f0506 fix(ui): eliminate icon vertical jitter on collapse and slim scrollbar to 2px
• f033357 fix(ui): eliminate theme flash-of-unstyled-content on hard load
• a5a7a04 fix(ui): encode key/node names in revokeKey and removeNode URLs
• 4676f7b fix(ui): fail toward visibility on BudgetBanner's settings-fetch failure
• a3c8f8a fix(ui): guard Benchmark's history refresh against post-unmount state-sets
• 572cf66 fix(ui): guard Benchmark's model-list fetch against a stale node's response
• fca1c30 fix(ui): guard DateTimePicker against unparseable values, reset time on clear
• ea8db64 fix(ui): guard GPUNodes' 10s/30s poll ticks against out-of-order resolution
• d811b13 fix(ui): guard ModelConfigModal's load effect against node-switch races
• 1aa69ea fix(ui): guard NaN numeric inputs and validate logit_bias shape in ModelConfigModal
• 776386b fix(ui): guard Routing's loadData/action handlers against unmount, scope strategy-change errors
• 0732697 fix(ui): guard Sparkline against non-finite data points
• 73b7511 fix(ui): guard Warmup's six-request poll waterfall against out-of-order resolution
• 7450259 fix(ui): guard against stale HF search results and node-switch races
• ca91126 fix(ui): guard the 2s live-requests poll against out-of-order resolution
• 7d50aac fix(ui): make the demo deployment path-independent
• cd71e85 fix(ui): match skip-cap detection on a structured error code, not a message substring
• 41cc22c fix(ui): mobile drawer ignores desktop collapse and restores transform
• ff2aee3 fix(ui): mobile sweep at 375px - eliminate horizontal scroll, restore truncation, enforce tap-target floors
• ae58d1c fix(ui): persist budget banner dismissal on live builds
• 0cc1f54 fix(ui): persist demo banner dismissal on live builds
• ee26213 fix(ui): quote and escape CSV fields in exportToCSV
• 08f7b85 fix(ui): recognize the new "api" vram_source value
• 7cc641a fix(ui): reject non-positive/decimal routing rule priorities
• a6a395e fix(ui): reliable smooth collapse and preload tabs for instant switching
• 493b382 fix(ui): remove sidebar scrollbar and center icons when collapsed
• 50bc3db fix(ui): restore header justify so mobile X stays at right edge
• 966bbfa fix(ui): restore verify_load on pull-progress reload instead of inferring it from status
• 1a76d9a fix(ui): scope the forced-demo banner dismissal to the session, not forever
• f2d6ba7 fix(ui): show a distinct message when the model catalog is unavailable
• 8470178 fix(ui): smooth centered icons without justify snap
• aa474fd fix(ui): stop Dashboard's summary poll from resetting to mount-time zeros
• 065644a fix(ui): stop Demo Mode toggle from silently discarding unsaved settings
• 2db3199 fix(ui): stop Warmup's 10s poll from wiping unsaved NodeCard edits
• 97afc80 fix(ui): stop caching explain failures permanently, guard against post-unmount state-sets
• 88b3465 fix(ui): stop demo-mode cancel from firing a real DELETE, dedup SSE streams
• 9f4cf95 fix(ui): stop falling back to mock cloud providers on a live fetch failure
• 605ff0a fix(ui): stop flashing the Saved vs Cloud card on every 5s poll
• ab3dfd3 fix(ui): stop flashing the full-page skeleton on every 30s refresh
• 0ae903a fix(ui): stop mangling decimals in the cloud spend-cap inputs
• ce3151e fix(ui): stop routing /admin/login to the user-portal login form
• 7d2dfa7 fix(ui): stop trimming password before login submit
• 907877f fix(ui): surface schedule pause/resume failures instead of an unhandled rejection
• e6f45c2 fix(ui): tooltips not clipped and keyboard accessible
• 3052b96 fix(ui): validate approve-create limits, guard ApproveModal's mount fetches
• 19743ee fix(ui): validate create-key rate limit before submit
• a415cf6 fix(uninstall): guard systemctl daemon-reload against aborting the script
• a8edfb3 fix(uninstall): honor SIGTERM failure, fix false success, wait for exit
• 963eac3 fix(uninstall): verify pidfile identity before signaling on Linux
• 7962b40 fix(uninstall.sh): verify process identity before kill, wait+SIGKILL fallback, validate manifest filenames
• eab287d fix: em dashes to hyphens, dashboard demo overflow, gpu draining highlight
• c81113b fix: full-app mobile (375px) + light-mode UI sweep
• bed15b2 fix: mobile drawer used 100vh - theme toggle unreachable behind phone browser chrome
• 59732ab fix: revert dashboard demo overflow fix (broke layout), fix gofmt
• 9e829a2 fix: seed demo live requests on first render, refresh website dashboard screenshot
• 7340c6f fix: settings toggle switches squeezed by long labels - add shrink-0
• 350ff7e fix: stale port 11435 in marbor bench defaults and User Portal connect panel
• d5eb314 fix: wait for usage-flush goroutine to exit before final save on shutdown
• 17d875b intial name update commit
• e21e34b readme: add Website badge, simplify Docs badge label
• ec88df2 readme: simplify badges to match clean style (Obscura-inspired)
• 653c9b9 readme: unify second badge row style (Build/Release/License)
• f287bd9 refactor(agent): complete internal identity migration and agent flag cutover
• 7e20ddc refactor(agent): rename nodeagent package to marboragent
• 64119b4 refactor(module): complete Marbor identity - migrate Go module to github.com/Anirudhx7/marbor
• 355012c refactor(router): simplify reconcileModelDigests to flat maps
• 19147ea refactor(store): rename node_agent schema to marbor_agent
• 9f2e7b4 refactor(ui): extract shared DrainConfirmModal from Drain/Undrain modals
• 66b4c34 refactor(ui): ultra-smooth sidebar collapse with slim overlay scrollbar
• 518aeae website: unify badge styling across nav, hero kicker, footer