v2.0.1

The tag and its commit are signed with the maintainer's SSH key (docs/signing-key.pub); scripts/ops/deploy.sh --ref v2.0.1 --verify checks it. Earlier versions are described in CHANGELOG.md.

Upgrade notes

• https users sign in once more. Over https the session cookie is now __Host-jr_session; sessions from before the
  upgrade are not carried over, so every device that comes in through tailscale serve (or another https proxy) shows
  the login page once. Plain http sessions stay valid.
• pnpm start / pnpm dev with a web password: the host keeps its no-password access only with
  JOB_RADAR_WEB_BIND=127.0.0.1 in .env (the server then listens there). Without it the server listens on every
  interface and every request needs the password, http://localhost too; pnpm run doctor warns. pnpm start now
  needs the development dependencies (tsx). Compose installs need nothing.

Added

• README screenshots and a demo GIF, generated from fictional demo data with pnpm demo:shots. A leak guard refuses
  to write the images if a page shows a machine path, a user name or a private string.
• Signed releases: the maintainer's public key is published as docs/signing-key.pub;
  scripts/ops/deploy.sh --ref <tag> --verify checks the tag against it before deploying.
• Accessibility: a skip-to-content link, a page title on every page (English and Chinese), and an end-to-end
  accessibility test.

Changed

• Documentation fact-check: .env.example gaps, Linux and systemd coverage, Compose 2.24 or newer, the PUID/PGID step,
  and pnpm run doctor everywhere (plain pnpm doctor is pnpm's built-in command).

Fixed

• Saving the settings page writes only the values you changed into data/config, so later changes to the shipped factory
  defaults reach you. setup --status no longer writes any files.
• The Docker image builds again: next build type-checks only the app sources, not the end-to-end tests that the image
  does not contain.
• Light theme: the error red is darker (#c8322a) for 4.5:1 text contrast; keyboard and screen-reader fixes in the
  settings tabs, quick filters, top bar, heading order, landmarks, scroll regions and the command palette; larger
  kanban targets on mobile.

Removed

• The one-off migration helpers for private 1.x installs: pnpm sources:migrate, pnpm models:migrate,
  pnpm ai:usage-backfill, and the read-only compatibility mode for the old channels.yaml + companies.yaml pair. The
  old files are now ignored, and ai.yaml no longer accepts the old providers.*.models / pricing keys. Upgrade a 1.x
  install with the 2.0.0 release first.

Security

• The local login exemption no longer trusts request headers a client can send: it is on only while
  JOB_RADAR_WEB_BIND is a loopback address and the web listens there.
• Failed-login limits: the per-source limit uses the address the nearest proxy saw; the limit across all sources is a
  growing wait instead of a lock, which a browser that is still signed in skips; both are logged.
• "Sign out everywhere" on the settings page ends every web session (session generation in
  data/config/.web-session-generation).
• Link checks and the recheck of watched jobs check the resolved address when they connect (no DNS rebinding into the
  Docker network or the host), with the configured time limit.
• Config and profile files seeded on first run are owner-only from the moment they are created.
• Docs: when to set JOB_RADAR_WEB_LOCAL_LOGIN=1 (TCP forwards, containers on the same network).