v0.1.24-alpha

İmzalı sürüm (ed25519). manifest.json ve manifest.json.sig release'e dahildir; açık anahtar depoda keys/pops_release_ed25519.pub.pem. Doğrulama için bkz. keys/README.md. Ajan için POps-Agent-*-win-x64.msi önerilir (sessiz kurulum ve özellikleri: Installer/README.md); zip eski elle kurulum yoludur. Ajan paketleri Windows'ta SmartScreen uyarısı verebilir (Authenticode imzası henüz yok). MSI kendi .NET 10 çalışma zamanını getirir; uç noktada önceden bir şey kurmak gerekmez. Pardus/Debian için pops-agent_*_all.deb (Debian 12 / Pardus 23 ve sonrası; kurulum: Agent-Linux/README.md).

For operators, in short:

1. Security first: PHP2Shell (CVE-2026-109618, CVE-2026-109619). Update the PHP of a native server now
   (AlmaLinux/RHEL 9: dnf update 'php*', Debian/Ubuntu: apt upgrade) and restart PHP-FPM. The Docker panel image of
   this release runs PHP 8.3.36. Details under Security.
2. A rebuilt panel for everyday work. One Bilgisayarlar section (lab tiles, the lab's PCs, a list) and a full
   page per PC with its problems and how to fix them; labelled buttons; Sistem ve Güncelleme and Ayarlar as
   sidebar sections. Same features, same API.
3. Agent fixes from the second external review, tried on a real PC and on a throwaway Windows machine in CI:
   • uninstalling during a quarantine or an exam no longer leaves the PC without network;
   • an exam no longer gets shorter or longer when the PC clock is wrong;
   • winget uses only the winget source, installs the newest version, retries once without a scope when the package
     has no machine installer, and says where the package landed;
   • a refused shutdown or restart is reported as an error;
   • large file transfers no longer stop after 100 seconds, and transfer errors are in plain Turkish;
   • no BITS when the server CA is pinned; the peer cache also works in labs with public IPv4 addresses.
4. Keep file transfer off on a PC like remote command and remote screen, and pick features to install off from the
   enrollment token dialog, which now shows the ready msiexec command.
5. Before updating a native server: migration 0033 adds one column. Reinstall /usr/local/sbin/pops-backup from
   this release for the weekly backup retention. Then send the new agent from Sistem ve Güncelleme.
6. Known limitation: behind Cloudflare's Free or Pro plan, a file transfer over 100 MB fails (one request per
   file); see the troubleshooting guide.

Try it without installing: https://demo.pashacore.com.tr (demo / demo, read-only).

Added

• Panel: keep file transfer off on a PC, and choose features to install off. The capability policy on
  Cihaz kaydı ve güvenlik covers file transfer next to remote command and remote screen: the server keeps a
  standing "off" request (set-capabilities files_enabled, migration 0033), re-sends it when the agent reconnects
  reporting it on, and refuses file transfers to that PC meanwhile (#199). The enrollment token dialog lists remote
  command, remote screen, file transfer, exam mode, power actions, messages and in-lab package sharing; the result
  shows the ready msiexec command with NAME_ENABLED=0 for each feature ticked, so a staff PC can be installed with
  them off from the first start (#198).
• Simulator lab distribution. tools/agent_simulator.py --labs N creates short-lived SIM-LAB-* enrollment
  tokens and spreads simulated agents evenly across them for realistic class and report testing. Thanks to
  @adity982 (#170, closes #72).
• pops-tls check [--days N] for monitoring. Exits 0 while the server certificate is valid for more than N days (default 30, the threshold renew uses), 1 with one line when it has N days or fewer left or has expired, and 2 when there is no certificate. It changes nothing on disk, so a cron mail or a monitoring plugin can run it. pops-tls show marks the "Kalan" line with "uyarı" inside the threshold. Thanks to @RajGahoi (#155, closes #112).

Changed

• Panel rebuilt for everyday work (#198). Every page was rebuilt on the same engine and API, without a
  backend change: one Bilgisayarlar section (lab tiles with status squares, the lab's PCs, a flat list) and a full
  PC page (pc?id=) with the problems and their fixes and tabs for general, hardware, software, updates, history,
  events and files; labelled buttons with one primary action per page and the rest in a Diğer menu; lists as the
  main content, rows that open the item; Sistem ve Güncelleme and Ayarlar sections as sidebar sub-items, with
  server and agent updates shown as steps. No KPI tiles or decorative charts on the working pages; statistics stay on
  Raporlar.
• Agent: winget pins the newest version and says where a package landed (#202). Without a version the agent first
  reads the newest version in the winget source and installs that one, so --scope machine can no longer quietly
  install an old release that still had a machine-scope installer (in the field Anki fell back from 26.09.3 to
  2.1.65); the output says which version was chosen. A second line says where the package landed: machine-wide, or
  only in the SYSTEM account's profile, where the PC's users do not see it.
• Agent: file transfer errors in plain Turkish (#202). A broken upload or download no longer shows a raw .NET
  message such as Error while copying content to a stream.; it says what happened (for example that the connection
  was cut and that a proxy's size limit, such as Cloudflare's 100 MB, may be the cause) with the original error in
  brackets. HTTP 413, DNS, connection and TLS errors have their own texts.
• Docs: file transfers through a proxy's size limit in troubleshooting (#201).
• Backend dependencies: asyncpg 0.32, redis 8.1, pydantic 2.14 and FastAPI 0.143 (#165, #166, #172, #174).
  • asyncpg keeps the pool's min_size connections open (POps: 2 per worker) and fixes a pool deadlock after a protocol abort.
  • redis-py 8 talks RESP3 by default with compatible responses; the multi-worker Redis job passes unchanged.
  • pydantic 2.14 and FastAPI 0.143 need no code change; FastAPI's automatic OpenTelemetry setup is now opt-in and
    POps never used it. Starlette 1.8 is skipped: it needs Python 3.11 and the backend still supports 3.10 (D-20).
  • All of them come from the hash-locked requirements.lock on the next server update.
• Agent: .NET packages 10.0.13 (Microsoft.Extensions.Hosting, System.Diagnostics.EventLog, System.Management and
  System.ServiceProcess.ServiceController; #177, #178, #182, #183, #191).
• Docker images: refreshed python:3.12-slim and php base image digests (#187, #189).
• Agent: the Worker is split into command handlers and a per-agent context (steps a0–a5, b1–b4, d; #162, #163, #192–#195). A CommandDispatcher routes each server action to its own handler class: execute, winget, tasks, Vision and capabilities, exam, file transfer, power, messages and more. CapabilityGate sends every capability_denied from one place. The connection loop, the sender and the tray message routing have their own classes. The agent's folders, runtime state (capabilities, modules, credentials, server trust, HTTP client, update state), the machine seams (firewall, kiosk, exam, file transfer) and the DNS policy monitor are instances held by one AgentContext instead of statics. Worker.cs shrinks from 2,203 to about 710 lines. Behaviour is unchanged. Two small additions: the exam handler releases its resources when the agent stops, and the network change listener is removed when the Worker stops. Design note: docs/design/worker-split.md.
• Agent tests run in parallel by default. Only classes that open real processes, pipes or sockets run serially; the shared-state collection is gone, because no test changes a process-wide static any more. A guard test fails CI when a parallel class touches mutable static state, and a second one when product code in POpsAgent or POps.Shared adds a mutable static. Both ignore the hit counters that code coverage adds in CI. CI ran 1,479 tests on .NET 10 and 81 on the .NET Framework 4.7.2 MSI actions.
• Exam mode: the server sends its own time. exam_mode now carries now (unix seconds) next to until. Agents from 0.1.24 take until - now as the time left and count it on a monotonic clock, so a PC clock that is ahead no longer refuses the exam and one that is behind no longer lengthens it. Older agents ignore the field. Schema, example and protocol README updated.
• Docs: release rhythm stated as it is. README, README.tr, ROADMAP and the code-signing page said releases come out weekly, but 0.1.22 and 0.1.23 came out on the same day. They now say at most one planned release a week, with security fixes in between.
• Docs: tool scripts. The docstrings of tools/agent_simulator.py, tools/bench_charts.py, tools/html_sinks/check_html_sinks.py and tools/sign_release.py give Python 3.10+ (the oldest version CI tests) and python3 tools/… examples that run from the repository root. Thanks to @RajGahoi (#90).
• Docs: Turkish contributions. CONTRIBUTING has a short Turkish section, Türkçe katkı, and README.tr links the good first issue and new türkçe labels. Ten first issues are written in Turkish (translations of the FAQ, backup, troubleshooting and quick start guides; a Pardus test of the Linux agent; a spelling and terminology check of the panel's Turkish; a glossary; an exam mode guide for teachers; first-impression feedback on the demo; a review of the pilot school guide).
• Backups: weekly retention. pops-backup now keeps the newest KEEP_MIN backups (3), every backup younger than KEEP_DAYS days (now 7, was 14; 0 turns the rule off) and the newest backup of each of the last KEEP_WEEKLY weeks (4), and deletes the rest. Each backup carries the agent packages kept on the server (about 80 MB per agent version), so with 14 nightly copies the folder kept growing. On a small disk, KEEP_DAYS=0 keeps the last 3 nights plus 4 weekly backups. An existing backup.conf with KEEP_DAYS=14 still keeps two weeks. CI checks the rules on dated folders.
• Docs: README and README.tr describe 0.1.23.
  • Features and how it works: new feature rows for exam mode, file transfer, winget, power actions and messages, Vision v2, organisational units, directory and OIDC sign-in, modules, the GLPI export and several workers with Redis. "How it works" covers the Redis workers, the Linux agent and X-Agent-Features.
  • Security and transparency: the SSO safeguards, tenancy, file transfer tokens, exam mode as a notice (not proctoring), the notices for power actions and messages, the locked-PC Vision banner and every capability switch.
  • Also: the lab peer cache, updated requirements and known limitations, the Linux and Pardus status, 0.1.22 and 0.1.23 in the release history, test counts from the release CI run, and new screenshots from the public demo (screenshots/v0.1.23/).
• Docs: SECURITY.md lists the 0.1.23 controls and four new residual risks: the peer cache port when enabled, Redis inside the trust boundary in multi-worker mode, trust in the directory or SSO provider, and fetched files kept for 7 days.
• Docs: CONTRIBUTING.md's repository layout and CI tables match ci.yml (Linux agent jobs, the Redis job, fuzzing, the lock check, JavaScript unit tests, pytest).

Removed

• The 14 old panel screenshots in screenshots/light/; nothing linked to them since the README moved to screenshots/v0.1.23/.

Fixed

• Panel: the PC page's file buttons with ?tab=files. Opening a PC page directly on the files tab stopped the
  page's script before the buttons were wired, so Dosya gönder and Dosya al did nothing (#198).
• Panel: the MAC address on the PC page. The General tab read a field the device list never has, so it always
  showed "—"; it now comes from the hardware inventory (#198).
• Panel: the running version after a manual install. The server stored the running version only from an
  update result, so a PC whose agent was installed or downgraded by hand kept showing the old version. The version
  the agent announces when it connects is now stored as well (#197, found in the 0.1.24 field test).
• winget: "different install technology" is a failure. winget answers 0x8A15002B both for "already up to
  date" and when the requested version uses another install technology than the installed one (for example an MSI
  over an exe install). In the second case nothing was installed but the task showed Tamamlandı; it is now
  Başarısız (#197).
• Agent uninstall log. The firewall clean-up script no longer lets PowerShell progress records split the result
  line in the MSI log (#197).
• Agent: uninstalling removes every POps firewall rule. The MSI's uninstall deletes the quarantine, exam mode and
  peer cache rules (and the unnamed rules of agents before 0.1.4), turns the firewall profiles that were off before a
  quarantine or exam back off, and deletes the quarantine and exam state files. A PC uninstalled during a quarantine
  or an exam is no longer left without network. An upgrade or rollback keeps the rules (#196).
• Agent: the exam length no longer depends on the PC clock. The agent counts from the server's now on a
  monotonic clock, so a changed PC clock cannot shorten or lengthen an exam; it is at most 8 hours, also after a
  restart (#196, server side #158).
• Agent: winget installs use only the winget source. --source winget keeps the msstore source out under
  LocalSystem. A package without a machine-wide installer (0x8A150010) is retried once without --scope machine,
  and the result's first line says which scope was used. Such a package probably installs into the SYSTEM profile,
  where students do not see it (#196).
• Agent: power results say what really happened. Lock and sign-out report after acting, with the Win32 error code
  on failure. A shutdown or restart that shutdown.exe refuses is reported as [HATA] with its exit code, the task
  is Failed and the PC stays on; before, the agent reported [TAMAM] just before acting (#196).
• Agent: large file transfers no longer stop after 100 seconds. File transfers have their own HTTP client: a
  transfer stops only after 2 minutes without data or 2 hours in total (#196).
• Agent: no BITS when the server CA is pinned. With SERVER_CA_CERT set the agent downloads updates directly,
  because BITS cannot use the pinned CA; that saves about 10 minutes per update (#196).
• Peer cache in labs with public IPv4 addresses. The server now offers a PC's own public IPv4 address as a peer
  (from X-Agent-Peer-Cache or the inventory; a public connection address is still not used, as it is usually the
  school's NAT), and the agent accepts peers on its own subnets, private or public. Before, such labs silently got
  no peers (#196).
• Vision: a thumbnail reaches the panel with only its documented fields. The server passed the agent's thumbnail message on to the admin panels as it came, apart from setting hw_id from the connection. An agent could add a pc_name naming another PC. The panel reads only hw_id, so nothing was shown under the wrong PC, but the server's rule is that no agent message reaches the panel in another device's name. Found by the agent_ws fuzz target; the input is now in its regression corpus.
• Docs: stale facts after 0.1.23. Getting started, the Turkish "Neden POps?" guide and the positioning page no longer say there is no Linux agent or no directory sign-in. The Veyon guide lists the peer cache port and points to Sistem → Modüller. The quick start shows the language switch, every capability property and the Linux .deb. The Linux agent README no longer says Mesaj gönder sends the Windows msg command. ROADMAP no longer lists directory sign-in under Later.
• Sistem: an agent that is installing an update shows as updating, not off. The agent's service is stopped during the install, so the PC looked offline and the card said "Hepsi kapalı". PCs with an update in flight are now counted as "güncelleniyor", and "eski ajanı güncelle" doesn't send to them again.

Security

• PHP2Shell (CVE-2026-109618, CVE-2026-109619): the Docker panel image moves to PHP 8.3.36. Both flaws in PHP
  itself allow unauthenticated remote code execution on any PHP that serves web requests (CVSS 9.2–9.8; exploitation
  attempts reported since 21 October 2026). The panel image runs Apache with mod_php, the setup PHP rates as most exposed.
  docker/dashboard.Dockerfile pins the patched php:8.3-apache. Installations with the distribution's PHP (the
  install.sh layout) must update their PHP packages and restart PHP-FPM: AlmaLinux/RHEL 9 dnf update 'php*'
  (fixed in 8.0.30-8.el9_8.alma.1), Debian/Ubuntu apt upgrade. Until then PHP's own stop-gap is
  session.upload_progress.enabled=0 plus memory_limit=-1 set where the application cannot override it (with a
  container or cgroup memory limit as the boundary); updating is the only complete fix. Docker images from the 0.1.23-alpha release still carry PHP 8.3.35: rebuild with docker compose build dashboard or wait for the next release. The demo server was rebuilt and its host PHP updated on 22 October.