v0.1.3

What's new in v0.1.3

This release makes remote access noticeably faster, makes the proxy self-healing, hardens the
dsh auto-update path, and documents the requirements for putting an external TLS proxy in front.

Fixes & improvements

• gzip compression on the proxy — UI assets (~1.3 MB uncompressed) are now served
  gzip-compressed (~360 KB), cutting remote page loads to roughly a quarter of the bytes. SSE and
  WebSocket streams remain unbuffered (verified against Caddy 2.6: text/event-stream flushes
  immediately, WebSocket passes through untouched).
• Caddy crash self-healing — the entrypoint now watches the proxy and restarts it within
  seconds if it dies (zombie-safe liveness check); config errors still fail fast at startup, and a
  persistently broken proxy is surfaced by the container HEALTHCHECK.
• dsh auto-update only upgrades — dsh-update now compares versions with semver semantics and
  never downgrades a version pinned at build time; installs (build-time and runtime) explicitly
  allow install scripts, since npm approve-scripts does not support global installs and the
  previous allow-list line was dead code.
• --port validation — non-numeric --port values fail with a clear error instead of a
  confusing Caddy config dump.
• WORKDIR fix — the image no longer hardcodes /home/codespace/workspace, which broke
  docker exec on legacy 2.x base images.
• Caddyfile formatting — the generated config now matches caddy fmt style, removing the
  "Caddyfile input is not formatted" warning from startup logs.

CI

• The smoke test now exercises the real update path: uninstall dsh, run dsh-update (uid-1000
  global npm install including native-module install scripts), verify the version and idempotency.
  Previously only the "already up to date" no-op path was covered.
• Workflow permissions are read-only by default; packages/contents write scopes are granted
  only where needed; same-ref runs are serialized to avoid racing the latest tag.

Documentation

• New "External reverse proxy with TLS (WAN)" section in the deployment guide with a working
  nginx example: WebSocket upgrade headers (proxy_set_header Upgrade $http_upgrade /
  proxy_set_header Connection "upgrade"), proxy_buffering off, and raised idle timeouts.
  Proxies that strip these headers silently break the UI's event streams (426 Upgrade Required
  from dsh, periodic aborting with incomplete response in the journal) — the exact failure mode
  fixed in this cycle.
• README (EN/ZH), security notes, deployment guide, and the Compose/Quadlet examples synced with
  the above.

Upgrade notes

• No configuration changes required. If you use an external TLS proxy in front of port 3081,
  make sure it forwards the WebSocket upgrade headers and does not buffer or time out quiet
  streams (see the deployment guide).