Skip to content

v0.6.0 stable

Choose a tag to compare

View all tags
@LEADBERG-studio LEADBERG-studio released this 03 Aug 20:01
· 14 commits to main since this release
v0.6.0
a6bc661

Tunnellio v0.6.0

Summary

  • The API token is now the most capable credential, not a hard prerequisite. Three connection modes work entirely without it, and a plan limit is no longer reported as an authentication failure.

Highlights

  • Credential-aware modes. With an API token everything works. With only an SSH key you still get ssh_stable, tcp_stable and tcp_random. With no credentials at all the two keyless bridge modes still work. In those three modes the API token is never read and never validated.
  • Plan limits are not auth failures. 403 plan_required on the advisory POST /v1/meta used to become an AuthError and abort the entire connect, even for transports that never needed that metadata. It is now a distinct PlanRequiredError and the launch continues.
  • Offline SSH plan. A reserved domain plus its bound key already contains everything needed to connect, so the client builds the SSH command locally with no API call.

Availability matrix

Credentials Available modes
API token everything: full API flow, ssh_stable, tcp_stable, tcp_random
SSH key only ssh_stable, tcp_stable, tcp_random
nothing tcp_stable, tcp_random 
# No credentials at all
.\tunnellio.exe connect --transport tcp-bridge --domain random --local-port 3000 --run

# Reserved domain, still no API token
.\tunnellio.exe connect --transport tcp-bridge --domain existing:mcp --local-port 3000 --run

# Reserved domain plus your own SSH key, still no API token
.\tunnellio.exe connect --transport ssh --domain existing:mcp --local-port 3000 --run

Artifacts

  • tunnellio.exe
  • tunnellio-windows-x64-v0.6.0.zip
  • tunnellio-source-v0.6.0.zip

Usage notes

  • Operations that genuinely use the Integration API still require a token: creating a domain or key, cloud proxy, OAuth flows and --transport auto. Nothing there changed.
  • POST /v1/meta and POST /v1/capabilities are advisory. When a plan refuses them, whatever was unavailable is listed in the degraded array of the JSON result.
  • When capabilities are unknown, the client no longer enforces local guesses about what the account may do. The server stays the source of truth and rejects anything it does not allow. When capabilities are known, every gate behaves exactly as before.
  • Backward compatible: existing configs, commands and flags are unchanged.

Changelog

  • Added tunnellio/modes.py with the credential matrix: resolve_mode(), available_modes(), requires_api_token(), requires_ssh_key().
  • connect derives the token requirement from the mode the launch resolves to, instead of demanding one up front.
  • Added Planner.build_offline_ssh_plan() for direct SSH to a reserved domain with no API call.
  • connect routes to the keyless bridge endpoint automatically for tcp_stable and tcp_random when no token is configured.
  • Added PlanRequiredError, PLAN_REQUIRED_CODES and is_plan_limit(); a plain forbidden with no plan wording is still an AuthError.
  • Added Capabilities.known / Capabilities.unknown() and PlanResult.degraded.
  • Fixed bridge --save-profile, which always crashed because _save_profile() called meta.to_dict() while the keyless path passes meta=None by design.
  • Added tests/test_errors.py and tests/test_modes.py; 91 tests pass across errors, modes, planner, cli, client, bridge, config and oauth.

Verification

  • Live-checked with the shipped binary and no API token: ssh_stable builds the correct reverse-forward command locally, tcp_stable and tcp_random reach the public keyless endpoint and receive a real server-issued domain.
  • Confirmed that an API-only flow (--domain new:...) still refuses to run without a token.

Notes for GitHub publication

  • Upload the binary and zip from this release subfolder.
  • Recheck that the changelog matches CHANGELOG.md for the target version.
  • Recheck that the version number in the title matches the shipped artifacts.
Assets 5
Loading