v0.6.0

Compare with previous release

Added

• Add opt-in, separately authorized restarts for exact systemd units and full Docker container IDs, with live target rechecks before each action.
• Add a checked 0.5.0 migration command that prepares a separate candidate, preserves bearer credentials, and reports grants that need manual review.
• Add hostlens uninstall preview and apply commands that remove verified 0.6.0 services and binary without scanning large mounted filesystems; the command clearly reports retained accounts and administrator data.
• Add verified install and upgrade previews and root-only apply commands; a plan digest guards changes, and a failed activation restores installed files.
• Add bounded service discovery and journal evidence, plus Docker health, stats, and logs, with separate profile grants for sensitive output.
• Add policy explain for local rule decisions and payload-free repair audit events for each attempted restart.

Changed

• Replace the MCP catalog with eleven typed host, service, and Docker tools; clients must update calls and profile grants.
• Start with read-only access and explicit observe or repair roles and per-tool target grants; matching denials override grants.
• Ship one Linux amd64 or arm64 binary per archive with dedicated gateway, Docker observer, and repair systemd units.
• Build with Go 1.27.1 and current stable MCP, system, Docker, CLI, and filesystem libraries.
• Require an explicit expiry or never choice when creating or rotating a token, so credentials no longer become non-expiring by omission.

Fixed

• Command help and flags come from Cobra and work without a configuration file.
• Docker observation and repair now use fixed operations and bounded responses instead of accepting raw API paths.
• Installation guides now use the binary's verified installer for service accounts and protected files, then show the first MCP call, optional Docker access, repair activation, and bounded uninstall.
• MCP discovery and results carry no reusable public cache policy, preventing cross-client reuse of profile-specific metadata.

Removed

• Remove the previous file, package, and raw diagnostic tools and their configuration fields; their grants do not carry into 0.6.0. Follow the upgrade guide before replacing 0.5.0.

v0.5.0

Compare with previous release

Changed

• Lifecycle checksum checks now stream installed files, reducing memory used during observer reconciliation and removal.
• Docker inventories now evaluate each collection grant once per response, reducing repeated policy work for large listings.
• Shared service sandbox settings now come from one template fragment, keeping the three systemd units consistent.
• Release archive verification now streams member checksums, limiting memory use when validating large binaries.
• Docker resource listings now index only the reference types they report, reducing work on large inventories.
• TLS restart checks now hash certificate and key files as a stream, avoiding whole-file memory allocation on reload.
• Live Docker validation runs against a private disposable engine in CI, exercising container, image, volume, and network observations without using host workloads.
• Systemd matrix cases now require their declared native architecture, so an amd64 engine cannot report an arm64 lifecycle pass.
• Normal diagnostic calls use one backend request instead of checking backend status again; generation mismatches still resynchronize before collection.
• Gateway result validation reuses its serialized payload when responding to clients, reducing repeated encoding.
• Docker inventory pages now construct payloads only for returned items, reducing work for large inventories and later pages.
• Docker inventory policy checks avoid building unused resource forms when a collection grant suffices, reducing allocations on large inventories.
• Process inspection reuses one bounded link-read buffer per request, reducing temporary memory for hosts with many open descriptors.
• The tool registry now requires a separate reserved role for future remediation tools; current diagnostic tokens cannot receive that role.
• Trusted-proxy client address parsing now avoids allocating a forwarding-chain slice on each request.

Fixed

• Installation examples now select the host architecture and prompt for the one-time token secret, so the first diagnostic call works on both supported architectures without placing the secret in shell history.
• Docker observer reconciliation now refuses unowned or replaced executable, unit, and socket paths before granting observer authority.
• Configuration validation now rejects a shared diagnostic and administrative IPC path even when Docker diagnostics are disabled.
• Backend tool calls now reject a second JSON document in their arguments before collection, closing an ambiguous IPC parsing path.
• Container statistics now accept Docker's unlimited PID sentinel and omit the unavailable limit instead of failing the observation.
• Installation and release manifests now reject undeclared fields before lifecycle changes or candidate acceptance.
• Docker container denials now apply to every current name across inventory, detail, stats, logs, and disk-usage results, preventing alias-based policy bypasses.
• Docker network reference counts include each container attached to a shared network.
• Malformed or null Docker responses now fail collection instead of producing empty observations.
• Disk-usage rows without a matching name inventory are omitted with an explicit evidence gap, so unused resources are not claimed with incomplete references.
• The gateway rejects oversized backend responses and trailing JSON instead of accepting an incomplete or ambiguous IPC message.
• The backend and Docker observer now reject trailing or oversized IPC messages in both directions, closing partial-decoding gaps.
• Local status and reload commands now reject malformed or oversized replies instead of printing a truncated success response.
• Upgrades now discover bundled profiles under paths containing glob characters and stop on unexpected profile read failures, preserving review of policy changes.
• Configuration reload now requires positive backend acknowledgements and rejects inconsistent generation fingerprints before reporting success.
• The Docker observer now applies trusted, bounded configuration reads and closes its inherited socket descriptor after adoption.
• Docker refusals now report status without forwarding daemon or observer error bodies to clients.
• Truncated Docker container inventories now block selector resolution and unused-resource estimates, preventing false resource conclusions from incomplete references.
• Container detail, stats, and logs now recheck current aliases against policy before returning evidence, closing a rename race even for stable-ID selectors.
• Disk-usage results now identify untagged images as dangling, matching the image inventory and advisory cleanup candidates when references are stable.
• Lifecycle commands now reject oversized or trailing installation state before changing resources, avoiding partial manifest reads.
• Archive extraction now rejects oversized or trailing release manifests before trusting their checksums, limiting malformed candidate input.

v0.4.0

Compare with previous release

Added

• Every MCP tool now publishes a result schema (outputSchema) next to its argument schema in tools/list, and the whole contract ships as the machine-readable snapshot docs/v1/tools.json in every release archive and as a standalone checksummed release asset; clients can validate requests and results against the published member names.
• Tool descriptions are specific, unique, and validated at startup, so a client can show what each tool observes without guessing.
• A backend result that fails its tool's published schema fails the call with a response_shape issue instead of returning an unvalidated payload.

Changed

• Argument validation derives from the tool's input schema: malformed or unrelated arguments now fail with invalid_arguments before any backend contact.
• get_hostlens_info is available to health-role tokens whose holder has the hostlens audit grant (previously the diagnostics role).
• The diagnostics backend IPC now carries typed tool arguments; MCP clients are unaffected because the gateway owns the client-facing envelope.
• Audit and Docker tool failure paths return schema-valid empty payloads instead of bare empty data objects; issue codes and isError behavior are unchanged.

v0.3.0

Compare with previous release

Added

• Create non-expiring bearer tokens with hostlens token create --expires never: the token stays valid until revoked or rotated, rotation imposes a finite retirement deadline on the old token, and create, list, and rotate display such tokens with an expires of never; binaries from before this change reject them instead of granting indefinite validity.

Changed

• Overhaul the README into a landing page: workflow and fact badges, a copy-paste quick start with a minimal config, feature and refusal tables, a Mermaid architecture diagram, and a documentation matrix; all prose stays ASCII with plain punctuation.
• Document the maintainer-approved publish flow: release drafts are published on the GitHub Releases page after review instead of staying unpublished.

v0.2.0

Compare with previous release

Added

• Record build provenance attestations for every release asset so repository readers can verify that archive bytes were built by this repository's workflow with gh attestation verify; while the repository is private the workflow reports attestations as explicitly unavailable (GitHub does not offer them for user-owned private repositories) and delivery stays checksum-verified.
• Accept RFC 6750 bearer scheme spellings: bearer and BEARER authorization headers now authenticate like Bearer on the MCP gateway and metrics endpoint; rejection behavior for malformed credentials is unchanged.
• Refuse Docker engine sockets that grant world access: the observer previously accepted world-readable sockets, which are root-equivalent on the host; group-restricted sockets (mode 0660 root:group) are unaffected.
• Ship version-coherent documentation: archive copies of OPERATIONS.md, INSTALL.md, and VALIDATION.md now name the release version they ship in instead of stale development literals.
• Run native arm64 systemd acceptance: restricted and standard lifecycle cases execute on ubuntu-24.04-arm hosted runners instead of amd64-only coverage.
• Build release notes from the hand-maintained changelog section for the tagged version; the publish job fails loudly when the section is missing instead of falling back to a commit list.
• Archive documentation now ships link-clean: repository-only links to openspec records, RELEASING.md, and SPEC.md are rewritten to versioned GitHub URLs, and archive acceptance verifies every shipped link resolves.

Changed

• Bring the gateway systemd unit to the full sandbox baseline: syscall filtering with native-architecture pinning, personality, realtime, and namespace locks now apply to the network-facing gateway, all three services protect clock, hostname, kernel logs, and IPC namespaces, and the gateway and observer additionally hide other users' processes and non-PID proc files; the diagnostic backend keeps system-wide /proc visibility because audit evidence reads it.
• Cut the internal test suite wall time from 18.3s to 11.9s with warm compiler cache by merging 42 zero-delta tests into their covering tests, shrinking deadline-driven waits to config values, and running independent tests in parallel; statement coverage stays at 85.8%.
• Delete verified dead code from the observer contract (ValidName, UniqueSize, References/ResourceRefs, Response.Negotiated, EngineInfo mode flags, summary size fields, Request.Offset/Limit); the diagnostic backend and observer ship version-coherent.
• Raise internal test coverage from 77.5% to 85.9% with observer transport, listener, archive, lifecycle, CLI, gateway, and CPU-health tests; document the intentionally uncovered surface in docs/v1/VALIDATION.md.
• Run CI once per pull request: workflow pushes now trigger only for the default branch instead of double-running the full suite for PR branches.
• Propose weekly Dependabot updates for GitHub Actions and the tools/dev Go modules; SHA-pinned action bumps remain deliberate reviews.
• Stop double-uploading goreleaser metadata to CI candidates: the tested-candidate artifact carries only archives and checksums.

Fixed

• Ship a version-coherent Docker observer: tagged releases previously reported 0.1.0-dev from hostlens-docker-observer version because the observer carried a duplicate version literal no release build injected; all three executables now share the release version and acceptance asserts it.
• Enforce the telemetry size limit for all writers: the exposition buffer embedded bytes.Buffer, whose promoted ReadFrom let io.Copy-style writers bypass the 1 MiB ceiling.
• Refuse bearer verification from an untrusted token store directory: reads now require the parent directory to be a real directory owned by root or the effective user without group or other write access, closing a directory-swap credential-injection path; administrative changes apply the same owner check.
• Enforce the collector inspection limit for command output: the bounded capture buffer embedded bytes.Buffer, whose promoted ReadFrom let exec's copy path bypass the ceiling and capture unbounded output.
• Make release delivery idempotent: a retried publish run now refuses to create a duplicate draft when the release already exists.

v0.1.0

Full Changelog: https://github.com/Monska85/hostlens/commits/v0.1.0