Pipe v0.50.7

Sandbox on Windows

• sandbox/run.py works from a Windows clone. Git stored the scripts with CRLF line endings, so the container stopped
  at once with exec /opt/sandbox/start.sh: no such file or directory, although the file was there. The image now
  strips them, and shell scripts always check out with LF
• sandbox/run.py no longer prints a ConnectionResetError stack trace on Windows while it waits for Pipe to start

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.7
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.7

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.7 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.6

Setting Pipe up on a server from pipe web

• Installing on a server from the pipe web wizard works. Since v0.43.0 every attempt stopped right after the login
  because of a wrong method name
• The wizard no longer takes over a Pipe installed in another directory. It used to install a second copy in
  /opt/pipe, which replaced the running container and cut it off from its data and the Telegram bot; now it finds
  the existing install, by container or systemd service, and connects to it
• On Windows, Pipe's SSH key and app.json are readable only by their owner. A key readable by anyone else was
  ignored by OpenSSH, so the tunnel ended with code 255 right after a successful install
• When the SSH tunnel fails, the message shows what ssh said instead of the exit code alone

Server installer

• AlmaLinux, Rocky and RHEL can be installed: their repositories have no Docker, so the installer adds
  download.docker.com
• Minimal systems without /etc/localtime no longer fail: Docker created a directory in its place and the container
  would not start, also on later attempts
• When the image cannot be pulled, the installer says so instead of claiming the release image does not exist

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.6
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.6

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.6 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.5

Recordings without a model provider

• The demo recordings on the website and in the READMEs, in English and Polish, no longer show a provider logo or a
  model name

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.5
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.5

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.5 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.4

A plainer website

• The website and the documentation changed color: a verdigris green replaced the blue on buttons, links and the
  diagrams, on a lighter graphite background
• Removed the decoration: the background grid, the moving light under the header, the pulsing dot in the menu, the
  all-caps labels, the tinted quotes and the arrow on the button
• The documentation start page lists its pages in a plain list, without cards and without the pipe animation
• The home page now shows the valve first, with what Pipe does on its own and what it asks about, and the whole pipe
  further down, next to where you talk to it. The text around both was rewritten to match
• New headline, also in both READMEs: "Pipe looks after your Linux server and messages you when something breaks"
• New link preview images, dark, with the new headline, showing that routine fixes run on their own and important
  changes wait for your yes

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.4
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.4

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.4 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.3

Clearer pipe diagrams

• The pipe diagram now tells one story: your question goes to the language model, its command stops at the valve and
  the fuse, reaches the server, and the result comes back past the gauge. Each part lights up as the command passes it
• The language model moved in front of the valve, so the diagram shows that the model proposes and Pipe decides what
  runs
• In the valve scene each command stops at the classifier, which lights up in the color of the route it picks
• The gauge is called "Czujnik" in the Polish version

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.3
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.3

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.3 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.2

The website shows what Pipe is

• New section "A pipe between you and your server" on the website: an animated diagram of commands going to the
  server and alerts coming back, through a valve, a fuse and a gauge, with a language model you can swap
• An animated scene opens "What it does on its own": real commands reach the classifier and split three ways
• Both diagrams are also in the README, in English and Polish. They are plain SVG files and stop moving when the
  system asks for reduced motion
• The website and the documentation are now dark only
• The documentation menu is split into four groups and marks the current page; quotes and "Experimental" notes have
  their own colors
• Corrected the website's limitations: conversations survive a backend restart

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.2
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.2

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.2 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.1

Patching from the /web page shows the real result

• Patching from the public /web page could end with "The install failed" and a bare "Error" even though it had
  worked. Refreshing the pipe-web container, the last step, cuts the page's connection, so the result never reached
  the browser. The page now goes back for the result after the connection drops
• When the connection does not come back, the card says it lost the connection before the result, instead of claiming
  that the install failed
• Protocol: the new read-only patch_status command returns the progress and result of the running or just finished
  patch. It starts nothing

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.1
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.1

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.1 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.50.0

/patch bumps compose tags and package.json overrides

• /patch images now bumps the image: tag in the compose file when pull brings nothing newer under the current
  tag: redis:7.2.3 to redis:7.2.5. The file goes into the journal, so /undo restores it, and it is put back at
  once if the new image cannot be pulled. The release line stays: mysql:8.0 goes to 8.0.x, never to 8.4. Images
  outside Docker Hub and tags that come from a variable (${TAG}) are left alone
• /patch apps now writes overrides to package.json (pnpm.overrides with pnpm) for transitive dependencies that
  are still vulnerable after the update. The package is skipped when the fix needs a new major version or the lockfile
  holds several major versions of it, because forcing one version would break the packages that need the other

The /web container is patched again

• A vulnerable pipe-web image could stay unpatched for a day: after one attempt that changed nothing it was put on
  hold, even though its tag (caddy:2.11-alpine) moves to new releases, and the report said to change the tag in
  compose, which this container does not have. Every /patch now pulls the image and recreates the container when
  there is a newer one
• When there is no newer image, pipe-web gets the fixes from its system's repository, like other images, and a later
  pull no longer moves it back to the unpatched image
• A failed pull or a /web page that is off now shows in the result, and a failed pull leaves the running container
  in place

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.50.0
docker pull ghcr.io/kvmyk/pipe-telegram:0.50.0

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.50.0 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.49.2

The /update result reaches every channel

• After /update the result ("Pipe updated to ...") reached only the channel that reconnected to the restarted
  backend first. It was usually Telegram, and pipe web got nothing (the message is not in the dashboard inbox
  either). It could also happen the other way round
• Every event now carries the time it was published, and a client that reconnects says what it saw last: the backend
  first sends what it missed. pipe web does it through the browser's standard SSE reconnect (Last-Event-ID, and per
  device in the polling mode of /web), so it also gets alerts that came during a dropped connection. The Telegram bot
  remembers its last event, and after its own restart (an update replaces its container too) it picks up the update
  result without repeating older alerts
• Protocol: subscribe takes an optional since, and events have a ts field. Older clients work as before

Fixes

• The pipe web bridge no longer waits in a connection's cleanup after it was interrupted. Such a connection could
  linger and later close a socket that already belonged to another request, which gave an empty answer now and then

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.49.2
docker pull ghcr.io/kvmyk/pipe-telegram:0.49.2

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.49.2 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pipe v0.49.1

The description matches what Pipe does

• The tagline is now "A sysadmin that never sleeps, does the routine work itself and asks about what matters" (in
  Polish: "Admin, który nie śpi, rutynę robi sam, a o ważne sprawy pyta"), in both READMEs, on the website, in the
  search and link-preview descriptions and on the social preview images. The old "never touches anything without
  asking" stopped being true in v0.48.0
• The example conversation on the website shows Pipe fixing the nginx config by itself, with a backup and a check,
  and asking before deleting old reports. The "on its own / after your yes / never" table lists what Pipe really
  does without asking
• The README demo GIFs were recorded again: the nginx fix runs without an approval card, marked "without asking"
• The pipe web welcome and the Telegram /start message say that routine fixes happen by themselves and important
  things wait for your yes; the empty Changes tab mentions changes made without asking too

Polish documentation

• The Polish docs (docs/pl/) are written with Polish characters (ą, ę, ł, ó, ś, ż...) instead of plain ASCII,
  like the Polish README and website

Fixes

• The language switch on the website and in the docs is vertically aligned with the other links in the top bar
• scripts/demo/record.py works again (it now opens the map tab first), and scripts/demo/social_preview.py
  renders the social preview images
• A CLI reconnect test no longer hangs now and then (the fake backend could stop before accepting the connection)

---

Images (linux/amd64, linux/arm64):

docker pull ghcr.io/kvmyk/pipe:0.49.1
docker pull ghcr.io/kvmyk/pipe-telegram:0.49.1

Signature (cosign, keyless):

cosign verify ghcr.io/kvmyk/pipe:0.49.1 \
  --certificate-identity-regexp '^https://github.com/Kvmyk/Pipe/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com