v0.5.1

Deployment visibility: pinned toolbar icon and an RMM-ready script

A managed security extension users cannot see is one they cannot act on, so every registry-based artifact now force-pins Check to the toolbar: Chrome via toolbar_pin=force_pinned, Edge via its own spelling toolbar_state=force_shown, both derived from the shared registry-writes table so the .reg files and GPO script can never drift (Firefox was already pinned via default_area: navbar).

• RMM deployment script (check-rmm-deploy.ps1): a new standalone PowerShell artifact built for RMM platforms running as SYSTEM. It force-installs, pins, and writes the tenant's full policy and branding to HKLM for Chrome and Edge, and drops the Firefox distribution\policies.json (backing up any existing one, written BOM-free). Checkboxes on the Artifacts tab preset the three $Include* browser toggles before download, and they stay plain editable variables afterward. Parses clean on PowerShell 5.1 and 7.

Guided rules editing

The Rules draft tab grew from a bare JSON textarea into a guided editor:

• Easy add, front and center: type a plain domain (or paste a URL), choose exclusion or trusted-login, and the anchored regex is generated for you, with subdomain coverage optional. No regex knowledge needed for the common case.
• The common delta keys are one-entry-per-line fields; added indicators and raw overrides live under an Advanced JSON block, and Edit raw JSON still exposes the whole delta as one document.
• An effect summary describes the saved draft and diffs it against the currently published version ("+1 trusted login pattern vs published v1", items on hover).
• Publish guard: Publish ships the last saved draft, and now warns when the editor holds unsaved edits.
• The Policy tab opens with a deployed with policy banner making the split explicit: policy settings ship inside the deployment artifacts and need a policy re-push, while rules content is fetched remotely on the update interval.

Setup wizard

• The branding-defaults step gains primary color and the instance default logo upload.
• Entering a Default CIPP server URL now also enables the fleet-wide CIPP reporting default (unless already decided), so the URL actually reaches artifacts instead of sitting inert behind a per-tenant switch.
• The header brand links to the tenant list.

Deploy-button copies: CI and operations fixes

Running a real deploy surfaced several rough edges, all fixed:

• workers_dev and preview_urls are declared explicitly in wrangler.jsonc, resolving two deploy warnings; preview URLs stay off because their hostnames are never covered by the Access application.
• Copy CI is now expected green: the fail-closed tests pin their own Access values, the hygiene UUID check exempts wrangler.jsonc (your provisioned database id lives there), and CodeQL skips itself on private repos.
• The runbook documents the deploy-button realities: workflows are stripped from fresh copies (one-time bootstrap required before the Sync upstream workflow exists), releases that change workflow files need a manual update pass, and Dependabot version updates should be disabled on copies.

Documentation

• New monitoring guide (docs/monitoring.md): which failure modes the dashboard catches (revoked-GUID stragglers, stale fetches) versus which only Cloudflare's tools can see (typo'd GUID 404 drumbeats, enumeration probes, fleet-volume drops), with Workers Logs recipes and a suggested cadence.
• New implementation plan for deployment health signals (docs/plans/deployment-health.md) covering the fetch sparkline, health verdicts, and an Analytics Engine dataset.
• Backlog: scoped items for the tenant onboarding wizard (top priority), a primary-color swatch with picker, and Sync upstream token support.
• Wizard, rules, policy, and artifacts screenshots recaptured; wiki regenerated.

Upgrading

From a deploy-button copy, run the Sync upstream workflow from the Actions tab, or git pull and npm run deploy. Copies created before this release have no workflows at all (the deploy button cannot push them); see the runbook's one-time bootstrap under "Updating a deployed instance". No D1 migration is required.

Full changelog: v0.4.0...v0.5.1