NetPilot 1.8.2

Instaladores de NetPilot 1.8.2 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

A much bigger Warehouse, and remote control for your computers. The Warehouse (licence stock) grows into a
full inventory app for the whole team, and NetPilot gains its own remote control in view-only mode.

• Requests and approvals: ask for material (issues and loans) with a reason, approve or deny, hand out and
  return, and open a fault when something comes back damaged. Handing out creates the real stock movements, and loans
  warn before and when they are due. Notifications by bell and e-mail.
• Fine-grained Warehouse permissions and copy access: give each person exactly what they need (view, request,
  add, edit, hand out, approve, count, print labels, import…) on top of their role, including "add but not delete";
  and copy one user's access to another.
• Adding items with a photo: a three-step wizard where the AI Assistant reads a photo and proposes the item's
  details. Each user can set their own AI key in their profile, or the organisation's key is used.
• Check lists for opening and closing, time tracking (clock in and out, your hours, with the legal
  working-time record kept and exportable by managers, every query audited), and club briefs (upload a PDF and
  the AI pulls the agenda by day, with an .ics calendar).
• Generic import of items, categories, suppliers, stock levels and serial units from CSV or JSON, with a preview
  before saving that never duplicates when repeated.
• Mobile home for the Warehouse: big, accessible buttons per person to request, see what they have, scan,
  approve, hand out and clock in.
• Remote control (view-only): watch a computer's screen through its RMM agent, from the endpoint's page, with its
  own permission and activity log.

NetPilot 1.8.1

Instaladores de NetPilot 1.8.1 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

Mandatory two-step verification: administrators can require two-step verification (MFA) for the whole
organization, by role or for specific users, from Administration → Settings → Access security.

• Grace period of 0 to 30 days from the first time the user signs in while it is required; during it, a notice
  with a countdown. When it ends, the user can only open the Set up two-step verification wizard (QR code, app code
  and recovery codes) before using NetPilot. The policy preview tells how many users it affects and warns if it would
  lock you out.
• Recovery codes: ten single-use codes when it is turned on (stored hashed), to sign in if the phone is lost;
  they can be regenerated from the profile. Signing in with one notifies the user, is logged and lets them set up the
  app again.
• Reset a user's MFA (on their page, Security tab): asks for a reason and to confirm your identity, closes
  their sessions and makes them set it up at their next sign-in. Turning it on, turning it off, resetting it, using a
  recovery code and changing the policy are recorded in the change log.
• Corporate sign-in: LDAP users use NetPilot's verification like local users. With OIDC the provider's
  verification (Entra ID, Google…) is trusted by default; the policy can also require NetPilot's code.
• API tokens do not go through two-step verification (they are not interactive) and keep working. RMM identity
  confirmation does not change and does not accept recovery codes. The policy does not apply in the demo.
• Safer: an app code cannot be used twice; sign-in limits failed attempts (10 in 10 minutes); turning on
  verification no longer replaces an active one without confirming your identity and the server no longer accepts a
  secret sent by the browser; changing another user's password asks you to confirm your identity, is logged and closes
  their sessions; LDAP users can turn verification off; netpilotctl reset-password --disable-2fa also deletes the
  recovery codes, closes the user's sessions and is logged. Closing a user's sessions also cuts what they had open in
  RMM (terminals, remote desktop, download and RustDesk links) and the backup links.
• The change history of user accounts (including the reasons for a reset) is only shown to administrators.

User page (Administration → Users): each user has a page with Summary, Access, Security and History.
The list shows the two-step verification status (enabled, required with its deadline, blocked, from the provider)
and a summary of their access.

Access by sections, locations and departments: besides the role, Access on the user page can limit what they
see, without a license and always enforced by the server (a request outside their access answers 403 or 404):

• Sections and areas: the sections of the side menu (Inventory, Warehouse, Catalog, Network, Connectivity,
  Operations, Documentation, RMM, Field, Maps, Integrations, Audit) and their areas (for example, Warehouse without
  Licenses, or Operations → Tickets). Ticking a whole section includes its future areas. The menu, Ctrl+K search,
  help, dashboard and record pages only show what is theirs; a page of another section shows No access to this
  section. Audit, Maps and Field show the names of everything, without links to the rest, and form pickers show the
  names of sites, companies, models, devices and endpoints of other sections without opening their pages.
• Locations and companies: locations at any level of the tree (each one includes everything below it, also what
  is created later) and/or companies. Before, this could only be set up with the SSO or MSP module.
• Departments (Administration → Departments): warehouse items and warehouses, software licenses, documentation
  shelves and books, endpoints, devices, racks, tickets, credentials and quotes can belong to one or more departments.
  A user limited to, for example, Sound only sees what belongs to Sound; what has no department is only seen by
  users without a limit. Stock levels, units, movements, pages, RMM, attachments, journal and history follow the
  object they depend on. Departments column, filter and bulk action in the lists.
• The three combine with each other and with the role. Administrators see everything.

Users limited by location or company: restrictions are always enforced, with any license. A limited user cannot
create anything above their location or move, delete or change the company of their site, and does not see the
regions above it. Every route of the application (reads, writes, notifications, exports, reports, labels, AI
assistant…) has been reviewed so they neither see nor touch anything of other locations; organization-wide features
that cannot be limited (Discovery, Connectors, Automation, Change management, Time machine, Quotes) are not
available to them and shared catalogs (risk and CVE, configuration rules, quote price list, RMM script library and
permissions) are read-only. The full JSON copy (Integrations → Export) is for administrators only.

Wake-on-LAN (rmm module): Power on (Wake-on-LAN) in the Power menu of the endpoint page (also without an
agent, if its MAC is known), on a device page and for several endpoints at once from Inventory → Endpoints.

• The packet is sent by an online agent of the same site (of the same subnet when there is one) and, if there is
  none, by the server itself with a directed broadcast to the subnet (ports 9 and 7, configurable in RMM →
  Settings). Before sending you can see which way it will go.
• If the endpoint has an agent, NetPilot waits for it to reconnect (10 minutes by default) and tells you: online at
  10:31 or that it has not come back.
• New rmm.wol permission (editors and administrators), a limit of endpoints powered on per minute, blocked by the
  emergency switch and recorded in the RMM activity. The sending endpoint needs agent 1.8.1. In Docker, sending from
  the server needs network_mode: host.

Pages with many tabs: tabs are grouped in drop-down menus when there are more than eight. On an endpoint with an
agent: Summary · Monitoring · Inventory ▾ · Tools ▾ · Terminal · Scripts · Remote desktop ▾ · More ▾. The active
tab shows on its group, they work with the keyboard and on mobile they become a single drop-down; ?tab= links keep
working.

Search: in search (Ctrl+K) help articles come last, after the results and actions.

Fixes: CSV export of Documentation shelves; the audit report PDF with many object types; the Administrator 2FA
compliance check counts the OIDC provider's verification and a policy that requires it; arrow keys on tabs;
untranslated texts in some RMM and Licenses errors; PUT /settings no longer changes settings that have their own
page (such as RMM security); in the Warehouse, creating an item without a SKU from the form no longer fails and an
empty tag in a receipt through the API is no longer stored as «None».

RMM agent 1.8.1: adds sending Wake-on-LAN (wol/1). 1.8.0 agents keep working, but cannot power on other
endpoints until they are updated.

Licenses: there are no new modules; mandatory verification and access by sections, locations and departments
are part of the core. Wake-on-LAN is part of the rmm module.

Help: new and updated articles in English and Spanish (two-step verification, user access, departments,
Wake-on-LAN, grouped tabs).

Database: migrations 0022 (mandatory two-step verification and recovery codes), 0023 (sections of each user)
and 0024 (departments); they are applied automatically when updating. The web update makes a backup first; if you
update by hand, make one before with netpilotctl backup.

NetPilot 1.8.0

Instaladores de NetPilot 1.8.0 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

RMM agent: remote administration (rmm module): manage Windows and Linux endpoints from the browser. With agent
1.8.0, the endpoint page adds the Processes, Services, Files, Terminal, Scripts, Logs, Registry
(Windows), Remote desktop and Activity tabs, and a menu to reboot or shut down the computer.

• Processes and services: processes with their user, CPU, memory, path and command line; end them (also forced,
  or with their child processes) and start programs as SYSTEM/root or as the logged-in user. Critical system
  processes ask for an extra confirmation. Start, stop and restart Windows services and systemd units and change
  their start type.
• Logs and Windows Registry: the Windows event logs (Security only with its own permission) and the Linux journal
  and syslog files, filtered by date, level, source, event ID and text, and the agent's own log to view or download.
  On Windows, browse and change Registry keys and values of every usual type; sensitive keys are protected and
  administrators can protect more.
• Terminal: PowerShell, CMD or Bash in the browser, as SYSTEM/root or as the logged-in user. It survives a short
  connection drop, closes after 30 idle minutes (configurable) and, when closed, ends everything started from it.
• Files: browse drives and folders, create folders, rename and delete. Downloads and uploads of any size show
  progress and speed, resume by themselves after a dropped connection or a page reload and are checked with SHA-256.
  Administrators can limit the folders that can be used.
• Scripts (RMM → Scripts): a library of PowerShell, CMD, Bash and sh scripts with parameters (secret ones are
  never stored in clear) and versions that can be compared and restored. Only a signed version that has not expired
  can run (signing can set an expiry date), and the agent refuses a script changed after it was signed. Each run
  shows the output live and records the exact version and SHA-256 that ran.
• Bulk actions: in Inventory → Endpoints, select endpoints (or pick them by site, tag or filter) and run a
  script, reboot or shut them down, start, stop or restart a service, or collect the agent logs. The confirmation
  shows how many endpoints are affected and how many are online; the others get the job when they connect, until it
  expires (24 hours by default). RMM → Tasks shows the result on each endpoint, cancels what is pending and retries
  what failed.
• Remote desktop in the browser (RDP): Connect via Remote Desktop opens a window with the screen of a Windows
  endpoint: resolution, full screen, Ctrl+Alt+Del, shared clipboard and automatic reconnection. It goes through the
  agent to the computer's own Remote Desktop service, so no RDP port has to be opened on the network; if that service
  is off, Enable Remote Desktop turns it on. You sign in with a Windows account every time (nothing is stored) or
  with a credential from the vault; Microsoft accounts (an e-mail address) may fail, so use a local or domain
  account. Windows Home cannot receive connections; on Windows 10 and 11 the connection opens its own session instead
  of showing the user's screen; one monitor and no sound; the clipboard needs NetPilot over HTTPS.

RMM security:

• Permissions per action (RMM → Permissions): one permission per tool and action. By default read-only users
  only look; editors also use the terminal, files (without deleting), processes, services, scripts on one endpoint,
  reboot and remote desktop; administrators can do everything. Existing editors get these defaults when you upgrade,
  so review them. Each permission can be allowed or denied per role or per user, also only on some sites, and the
  server checks them on every action.
• Confirm your identity: terminals, scripts, bulk actions, changes on an endpoint, signing scripts, permissions,
  security settings, the emergency switch and (by default) remote desktop ask for your password or 2FA code again,
  valid for 10 minutes (RMM → Settings → Security). Users without a local password (single sign-on) need 2FA. API
  tokens cannot confirm an identity, so these actions cannot be done with an API token.
• Activity log (RMM → Activity and on each endpoint): every action, also the failed and denied ones, with user,
  address, target, result, exit code, duration, output and script version and hash; CSV export, kept for 365 days by
  default and also shown in the endpoint's change log history.
• Emergency switch (Disable remote actions on the RMM page): at once refuses new terminals, remote desktop
  sessions, uploads, scripts, bulk actions and changes, closes the open sessions and cancels pending and running
  jobs; viewing keeps working, and the agents enforce it even without a connection. A banner across the app shows who
  turned it on and why.
• Usage limits per user (script runs and destructive actions per minute, endpoints per bulk action, terminals,
  transfers and remote desktop sessions at once), changeable per role or user. Every order to an agent is signed,
  expires and is accepted only once.
• Update the agents: these tools need agent 1.8.0. Endpoints with an older agent show Update the agent:
  reinstall it from RMM → Deploy agent (it keeps its identity and its data). Keep NetPilot on a single process
  (NETPILOT_WORKERS=1, the default): the live tools reach an agent through the process it is connected to.

RustDesk (second remote-desktop option): technicians can also reach Windows and Linux endpoints with their own
RustDesk client. NetPilot bundles RustDesk 1.5.0, third-party software under the AGPL-3.0 shipped unmodified as a
separate program (NetPilot is not affiliated with its authors): every server package carries its official installers
for Windows x64 (MSI) and Linux x64/ARM64 (deb and rpm), its license and the source links, also shown on the license
page and in docs/THIRD-PARTY.md.

• Settings (RMM → Settings → RustDesk, administrators; off by default): RustDesk's public servers or your own
  ID and relay servers (hbbs/hbbr) with their public key, and whether the connection link includes your server and
  the password. Apply to N endpoints updates the endpoints that use other server settings.
• Install, update and uninstall from the new RustDesk tab of an endpoint, or on many at once from
  Inventory → Endpoints. The agent downloads the package from its own NetPilot server (never from the internet),
  checks its size and SHA-256, installs it silently, applies the server settings and sets a permanent password; on
  Windows, RustDesk keeps its Start-menu shortcut and its icon next to the clock, visible to the user, and on Linux
  apt or dnf install its dependencies from the distribution's repositories. Uninstalling also deletes RustDesk's ID
  and password on the computer by default. One RustDesk operation runs on an endpoint at a time, and cancelling or
  the emergency switch take effect between installer steps.
• Connect with RustDesk: a dialog with the RustDesk ID, a rustdesk:// link that opens the technician's client
  (with the password and, if chosen, your server), copy buttons and the RustDesk client to download from NetPilot
  itself. The endpoint does not need to be online.
• Permanent password: 24 characters generated by the server, stored encrypted, sent only inside the signed,
  encrypted job and never written to logs, job output, the activity log or the change log; NetPilot's process lists
  hide it. Rotate password sets a new one in one click.
• Permissions: new permission Remote desktop with RustDesk (rmm.rustdesk; editors and administrators by
  default). Installing, configuring, rotating the password, uninstalling and connecting ask you to confirm your
  identity, are blocked by the emergency switch and are recorded in the activity log and in the change log. It needs
  agent 1.8.0.
• Limitations: RustDesk only accepts the permanent password on its command line, so process auditing or security
  software may record it (on Linux, other local accounts may see it while it is being set unless /proc is mounted
  with hidepid=2); turn off Include the password in the link to copy it instead. The emergency switch does not
  close open RustDesk sessions, and uninstalling the NetPilot agent leaves RustDesk installed. Not supported: Windows
  on ARM64, Linux without a graphical session (on Wayland the user has to accept sharing the screen), SUSE, macOS and
  a RustDesk server inside NetPilot.

Warehouse (new stock module, in the Operations, MSP and Enterprise licenses; Inventory → Warehouse): stock of
cables, equipment and spare parts in several warehouses, each serving one or more sites and with bins (shelves).

• Items with SKU, barcode, category, unit (also meters with decimals), cost, supplier, photo and minimum stock,
  tracked by quantity or by serial number (each unit with its asset tag, status, assignee and the endpoint or device
  where it is installed).
• Movements (receipt, issue, transfer, adjustment, return, check-out and check-in) in a ledger that is never edited:
  a mistake is corrected with a compensating movement, stock never goes below zero, not even with two scans at the
  same time (unless an administrator turns on Allow negative stock), and a retried request is never applied twice.
• QR labels on A4 sheets or Brother and thermal rolls (the field module is not needed) and a Scan page for
  the phone camera or USB/Bluetooth scanners: +1/−1 in one tap, continuous mode and undo.
• Stock counts (also blind and from several phones at once), low-stock notifications, CSV import with a dry run and
  export, and per-site permissions.

Software licenses (Inventory → Warehouse → Licenses, with stock or with finance): the company's software
license...

NetPilot 1.7.1

Instaladores de NetPilot 1.7.1 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

RMM agent

• Uninstall from NetPilot: editors can uninstall an agent from the agents list of the RMM page or from the
  Remote management card of its endpoint. The agent removes its service and its files from the computer, and
  NetPilot marks it as revoked, which frees its place in the license. If the computer is off, the request waits until
  the agent connects (Uninstall pending) and can be cancelled until then. It needs agent 1.7.1 or later: reinstall
  older agents with the current installer first, or uninstall them on the computer.
• Uninstalling on the computer updates NetPilot: uninstalling from Apps & Features, with
  netpilot-agent uninstall or by removing the Linux package now tells the server, which marks the agent as revoked
  and frees its place in the license, so there is no need to revoke it by hand. If the server cannot be reached, the
  uninstall still finishes and the agent stays offline in NetPilot until you revoke it. Revoked agents show why:
  uninstalled from the console, uninstalled locally, removed with the package manager or revoked.
• .deb and .rpm packages for Linux (x64 and ARM64): the agent appears in the package manager and is removed
  with sudo apt remove netpilot-agent or sudo dnf remove netpilot-agent. The one-line Linux command picks the
  right package by itself (or the plain program on systems without dpkg or rpm) and checks it with SHA-256.
  Deploy agent also offers the packages for download, with their SHA-256 and the commands to install them by hand.
  Upgrading the package keeps the computer enrolled.
• Live values without constant traffic: the Monitoring tab of an endpoint now refreshes its current usage every
  minute by default (new Current usage setting in RMM → Settings → Intervals, from 5 to 600 seconds). The Live
  button shows it every 2 seconds, with a Stop button, and turns itself off after 5 minutes, when the page is hidden
  or when you leave it.
• The Windows agent program carries the NetPilot icon.

Releases: the agent's Linux packages are built for every version and included in every server package (Windows
installer, Linux packages and Docker image), next to the agent programs.

Database: migration 0013 (uninstalling RMM agents from the console); it is applied automatically when upgrading.

NetPilot 1.7.0

Instaladores de NetPilot 1.7.0 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

RMM agent (rmm module, included in the Operations, MSP and Enterprise licenses): a NetPilot agent for Windows
and Linux computers that keeps their record in Inventory → Endpoints up to date by itself. It runs as a visible
service (NetPilot Agent) and keeps a single outgoing connection to the server over the local network, encrypted end
to end: it opens no ports on the computer and only trusts the NetPilot server it was installed for.

• Deploy: administrators create deployment codes for a site (and company), with an expiry, a maximum number of
  installs and automatic or manual approval. Deploy agent (on the new RMM page, in Endpoints and on the
  endpoint and location pages) offers the Windows EXE, which already carries the server address and the code
  (double-click it and accept the administrator prompt), a PowerShell command and a one-line Linux command (x64 and
  ARM64), all checked with SHA-256, plus a download link, a QR code and an e-mail with the instructions. If the
  server address the agents would use is localhost, the window warns that other computers cannot reach it. An MSI
  for GPO/Intune and .deb/.rpm packages are not available yet.
• Linked to its endpoint: a new agent is matched with an existing endpoint of the code's site by serial number,
  MAC address or name; if there is none, a new endpoint is created. With manual approval, an editor approves the
  agent and can choose its endpoint.
• Status and usage at a glance: Endpoints shows whether each computer is online (with a LAN badge) and a
  Usage column with CPU, RAM and disk bars. The endpoint page adds the Remote management card and the
  Monitoring (live values with the busiest processes, and history charts), Inventory (system, hardware, disks,
  network and security: antivirus, firewall and BitLocker on Windows; ufw/firewalld, SELinux/AppArmor and encrypted
  volumes on Linux) and Software tabs.
• History: metrics every minute for 48 hours, every 5 minutes for 30 days and every hour for a year
  (configurable). An agent that loses the connection keeps up to 24 hours of metrics and sends them when it is back.
• Settings (RMM → Settings, administrators): the server addresses for the agents, the intervals, the time after
  which an agent is shown offline, retention and the server key fingerprint. Changes reach connected agents at once.
• If the same agent identity runs on two computers (a cloned disk image), the agent's page shows a warning.
• Uninstall: from Apps & Features on Windows or with sudo /usr/lib/netpilot-agent/netpilot-agent uninstall on
  Linux; then revoke and delete the agent in NetPilot to free its place in the license.
• Help for the three tabs of the RMM page. The public demo includes sample agents with their inventory and history,
  and refuses real agents and installer downloads.

Licenses: a license can limit the number of RMM agents. The license page and netpilotctl license status show
the agents used and allowed. Revoked agents do not count, and agents never count against the device limit.

Change log: what an agent changes by itself (its version, the operating system or the hardware data of its
endpoint) is recorded with the new source Agent and the computer's name, also in the dashboard chart and in the
reports. Changes to the RMM settings and inventory requests are recorded too.

Backups: netpilotctl backup and the backups made from the web include the RMM server key (rmm-server.key),
which is always restored together with the database. Keep your backups: if that key is lost, every agent has to be
installed again.

Releases: every server package (Windows installer, Linux packages and Docker image) includes the agent of the same
version. The files of each version are uploaded straight to the release and SHA256SUMS.txt is built from the final
set; no intermediate copies are kept on GitHub.

Database: migration 0012 (RMM agent); it is applied automatically when upgrading.

NetPilot 1.6.2

Instaladores de NetPilot 1.6.2 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

• Help is no longer listed in the side menu: open it with the "?" icon in the top bar (or F1).

NetPilot 1.6.1

Instaladores de NetPilot 1.6.1 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

Updates from the web, with progress: while an update is installing, everyone with NetPilot open sees the progress
(download, backup, installation step by step and start of the new version) and the page reloads by itself when the
new version answers. While the service is stopped, the installer serves that progress on the same address and port,
so anyone who opens NetPilot during the update sees "NetPilot is being updated" instead of a connection error. If the
update fails, you are told and NetPilot keeps running the previous version.

What's new after updating: after an update, each user sees the release notes of the installed version once.

Cleaner change log:

• Changes to "last seen" and to the MAC address are no longer recorded: they change by themselves on every scan or
  sync (phones and laptops use random MAC addresses). Updating also removes them from the entries already recorded.
  When an object is created or deleted they are still recorded with the rest of its data.
• Administrators can delete entries: the selected ones, every entry matching the filters or the whole log. The
  deletion itself is recorded (who and how many).

Fixes:

• Windows: updating from the web failed with "Python 3.11 or newer was not found" when Python had been installed
  "just for me" (the default option of the python.org installer). The update runs as SYSTEM, which does not see that
  Python. The installer now uses the same Python the installed NetPilot already runs on.
• Windows: if the update failed before starting (for example, because of the previous point), the NetPilot service
  was left stopped. It is now started again with the previous version.
• When updating, the installation kept being recorded with the original version (for example, 1.2.1 on a server
  already running 1.4). The installed version is now recorded.
• With PostgreSQL, unattended updates no longer ask for the database superuser password.
• If an update fails and the previous version starts again, the web shows it straight away. A download or backup
  interrupted by a restart no longer stays "in progress" forever.
• Only the documentation a customer needs is installed (version history, installation and operation guides and the
  module reference). Internal documents (proposals, design notes, public demo, marketing material) are no longer
  installed, and those left by earlier versions are removed when updating. On Windows, files of previous versions
  are no longer left in the installation package folder.

NetPilot 1.6.0

Instaladores de NetPilot 1.6.0 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

Endpoints (Inventory → Endpoints): a new section to document what connects to the network but is not network
gear: PCs, laptops, servers, virtual machines, printers, POS terminals, phones, mobiles, tablets, TVs, cameras, NAS
and IoT. Each endpoint has a location, company, manufacturer and model, serial number, asset tag, MAC, IP (linked to
IPAM), operating system, CPU, RAM and disk, assigned user, purchase date and warranty. Endpoints show up in the global
search, on each location's page and on the dashboard, and they do not count toward the license device limit.

Bulk edit: in the lists you can select several items (or every item that matches the filters) and move them to
another location, change their common fields or add and remove tags in one go.

Discovery (discovery module):

• Automatic classification of discovered hosts into 19 types (PC, printer, POS, phone, camera, access point, switch,
  firewall…) based on the manufacturer, open ports, name, SNMP, VLAN or prefix and LLDP/CDP capabilities, with a
  confidence level and "Why this type?" listing the evidence. The type can be corrected by hand.
• Adoption wizard: documents several discovered hosts at once as an endpoint, a device or just an IP, with a name
  template ({hostname}, {ip_last}, {site_code}…) and a live preview of the resulting names and conflicts.
• Adoption rules (/descubrimiento/reglas): conditions (manufacturer, ports, name, network, VLAN…) and actions (set
  the type, adopt, ignore), with ready-made templates, preview and automatic application after each scan.
• LLDP/CDP link details: capabilities, platform and version, native VLAN, duplex and the state of the documented
  cable, with a shortcut to the finding or to create the cable.
• The finding for an undocumented host now suggests creating an endpoint (or a device, if it is network gear).

Help on every screen: the "?" button in the top bar and in each page header (or the F1 key) opens the guide for
that screen in a side panel, and Help & tutorials (/ayuda) gathers more than 80 articles by category, with
search. The search (Ctrl+K) also finds help articles.

Backups from the web (Administration → System & updates → Backups): on-demand backup with progress; daily or
weekly schedule; retention (last N, last N days and GFS); destinations in a local or network folder, NAS/SMB, SFTP,
WebDAV and S3-compatible storage; password-based AES-256-GCM encryption for remote backups; backup upload;
explore a backup and see how it differs from the current data, object by object, before restoring; and a
staged restore: you pick the parts, an automatic backup is taken first, it is applied on restart and, if anything
fails, the previous data is put back. With PostgreSQL, netpilotctl backup and the backups made from the web include
the database (logical dump) and are restored the same way. backup_failed and backup_ok notifications. Details in
docs/OPERACION.md §14.

Logs and files: two new tabs in System & updates to read the application, service, update, installer and backup
logs (level and text filter, live follow, copy and download) and the configuration files with secrets masked. If an
update from the web fails, "View log" opens the log of that installation.

NetPilot in English: the whole application is translated: interface, API messages, e-mails, notifications,
PDF/Excel/HTML reports, netpilotctl (--lang), the installation wizard, the help and the documentation. English is
the default language; each user picks theirs in the user menu or in their profile, and the administrator sets the
organization's default language in Settings (used for e-mails, reports and background jobs). Adding a language only
takes translating the language files. The main documentation is now in English; the Spanish version is in the
*.es.md files.

Interface: accordion sidebar (one group open at a time: the one for the current page). Maps no longer overlap
dialogs, the sidebar or the search.

Security: deleting a company or a location included in the permissions of a restricted user made that user see
everything. Deletion is now blocked until that permission is removed.

Demo: regenerating the sample data (the nightly reset and python -m app.demo --reset) drops every table,
including the modules' tables; previously some of them survived and the new seeding clashed with their data.

Database: migrations 0007 (endpoints), 0008 (discovery classification, adoption rules and LLDP/CDP details)
and 0009 (per-user language); they are applied automatically when upgrading.

NetPilot 1.5.0

Instaladores de NetPilot 1.5.0 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

Portal público de pruebas: la demostración se puede poner en internet para convertir visitas en contactos. Con
NETPILOT_DEMO_SIGNUP=true la pantalla de inicio es un registro (nombre, correo, empresa, teléfono e interés, con
consentimiento): con SMTP el visitante recibe un enlace de acceso por correo y, sin él, entra al momento. El equipo
comercial recibe un aviso por correo y por webhook (Slack o Teams) en cada registro, en el primer acceso y cuando
alguien vuelve. Los contactos se guardan aparte, sobreviven al borrado nocturno y se descargan en CSV con una
clave. Las credenciales de la demo dejan de publicarse.

Demostración: cada noche (por defecto a las 04:00) se borran y se regeneran los datos de ejemplo y los ficheros
subidos. La franja superior indica la hora y puede llevar un botón «Hablar con ventas».

NetPilot 1.4.0

Instaladores de NetPilot 1.4.0 (Windows, Linux y Docker) con sus sumas en SHA256SUMS.txt.

Actualizaciones desde la web: NetPilot sabe cuándo hay una versión nueva y se puede actualizar sin
descargar nada a mano. En Administración → Sistema y actualizaciones se ve la versión instalada, la última
publicada y sus novedades, con el botón «Actualizar ahora».

• Las versiones se publican también en el repositorio público NetPilot-Releases, con un manifiesto firmado por
  canal (estable y beta). NetPilot lo consulta una vez al día sin enviar ningún dato de la instalación, y avisa a
  los administradores con una franja en la web y por los canales de Avisos.
• Antes de instalar se comprueban la firma del manifiesto y la suma SHA-256 del paquete, y se hace una copia de
  seguridad. En Windows lo lanza una tarea programada como SYSTEM; en Linux, un servicio con privilegios que
  vuelve a verificarlo todo; en Docker se muestran los comandos para actualizar la imagen.
• Si la versión nueva no arranca, el instalador vuelve a la anterior. El resultado queda en el registro de
  cambios y se avisa.
• Con licencia, se puede instalar sola en una ventana de mantenimiento o a una hora fija. Admite proxy y un
  espejo interno para redes sin salida a internet.

Siempre se ven las novedades de la versión instalada, haya o no una versión nueva, y el aviso de
«NetPilot actualizado» las incluye.

Cobertura WiFi real (módulo floorplans): en cada plano, «Cobertura real» importa un recorrido de NetSpot o
de cualquier herramienta en CSV, o un proyecto de Ekahau (.esx, en pruebas), o deja medir con la propia app
haciendo clic donde se está (señal del dispositivo y prueba de velocidad hasta NetPilot). Lo compara con la
cobertura estimada del plano, marca las zonas donde la realidad es peor que lo previsto (con su superficie y los dB
que faltan), las puede añadir al plano como zonas y propone el exponente de pérdida que ajusta la estimación.

Fotos de racks que rellenan el inventario (módulo ai): la IA propone también el nombre y el número de serie
leídos en las etiquetas, el número de puertos y las etiquetas de puertos y cables. «Crear y colocar» da de alta todo
de una vez, crea los modelos que falten en el catálogo con sus puertos y puede guardar la foto en el rack. Se entra
también desde el alzado del rack («Rellenar con una foto»).

IA con otros proveedores: además de Anthropic, OpenAI, Google Gemini, Mistral, OpenRouter, Ollama y LM Studio
en local, y cualquier servidor compatible con la API de OpenAI (vLLM, llama.cpp, LocalAI). Una clave cifrada por
proveedor; con los modelos locales los datos no salen de la red.

Base de datos: migración 0006 (mediciones de cobertura real; se aplica sola al actualizar).

Instalador: la actualización desatendida (--upgrade --silent --yes, o NetPilotSetup /VERYSILENT sobre una
instalación existente) usa la configuración instalada y ya no falla por encontrar ocupado el puerto del propio
NetPilot. En Linux se registra el lanzador de actualizaciones (netpilot-update.path).