Skip to content

Portal 4.0.18 (withdrawn — use 4.0.19)

Choose a tag to compare

View all tags
@Robertmonkey Robertmonkey released this 13 Aug 01:34
· 1 commit to main since this release
v4.0.18
362fa2b

Caution

This release was withdrawn on 2026-08-12 and is no longer installable. Use 4.0.19 instead.

4.0.18 inherited a broken Dashboard update launcher from 4.0.17. Installing it leaves a Portal that cannot update itself again — the in-portal update button fails immediately at step 1 with stat: cannot statx '/proc/$/fd/3', and the only way off is a command-line update. The workspace fix that 4.0.18 carried is included in 4.0.19.

The signed artifacts have been removed from this release and from https://bridgesllm.ai/releases/4.0.18/, which now returns 404. The tag and source history are left intact deliberately: they record what shipped.

Fixed

Signed-in workspaces load again. 4.0.17 added a post-authorization guard to the shared Socket.IO namespace middleware that rejected admission whenever socket.disconnected was set. Socket.IO assigns connected in _onconnect(), which runs only after namespace middleware resolves, so that condition was unconditionally true during the handshake and every connection was refused with "Authorization changed during connection."

The workspace privacy curtain lifts only on an authorization snapshot whose generation matches the signed-in one, and it has no timeout or fallback, so affected users were held at "Refreshing workspace access…" indefinitely and could not reach the Portal.

Live alerts, metrics, OpenClaw status, and agent-job streams reconnect. All five namespaces share the affected middleware, so the same defect silently ended every live stream in the Portal, not only the workspace handshake.

Revocation that lands while the authorization read is in flight is now tracked explicitly, and a closed engine connection is used as the transport-loss signal. Genuine mid-handshake revocation and transport loss are still refused, and revoked sessions, expired sessions, and superseded authorization generations continue to be rejected with their existing, distinct errors.

Testing

Added a Socket.IO admission suite that opens a real client against the real middleware and asserts both admission and refusal outcomes. The existing namespace suite asserts only on source text and could not observe this class of failure.

Upgrading

Anyone on 4.0.17 should update. Dashboard update, or:

curl -fsSL https://bridgesllm.ai/install.sh | sudo bash -s -- --update

Note on tag history: the public repository is a squashed source export. Versions 4.0.4, 4.0.9 and 4.0.10 shipped without being exported at the time and cannot be tagged honestly after the fact, since the commits that carry them also carry later versions. Those gaps are recorded rather than backfilled with invented tags.

4.0.17 has been withdrawn. Its signed artifacts were removed from this repository and from https://bridgesllm.ai/releases/4.0.17/ on 2026-08-12, which now returns 404, because the defect above made it unusable for every signed-in user with no workaround from the browser. The v4.0.17 tag and its source history are intentionally left in place — they record what shipped. Hosts already on 4.0.17 update to 4.0.18 normally; the updater fetches the target version, not the installed one.

Assets 2
Loading