exist.io v0.5.0-beta

Changelog

All notable changes to exist.io will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.5.0-beta] - 2026-10-17

Added

• Embedded Web UI: Single binary distribution where existd serves the compiled React 19 / Vite UI on port 8080 via Go embed.FS with automatic SPA fallback.
• Model Context Protocol (MCP) Server: 16 core tools with /mcp full-access and /mcp/readonly sandbox for agent exploration.
• Agent Capability Leases: Ephemeral HMAC-SHA256 capability tokens (pkg/agentlease) with ref-prefix isolation (refs/heads/agent/*) enforced on Smart-HTTP and pre-receive hooks.
• Pre-Receive Security Hook: Automatic secret scanning, non-fast-forward push rejection, and default branch protection.
• AST Symbol Search Indexer: In-memory AST symbol search for Go, TypeScript, and Python (internal/symbolsearch).
• One-Command Bootstrap: existd bootstrap initializes admin user, namespace, repo, API key, and tailored agent MCP configuration snippets in < 5 seconds.
• One-Line Installer: scripts/install.sh for single-command installation across Linux, macOS, and Windows.
• Automated Conformance Harness: exist conformance validating REST endpoints and MCP JSON-RPC protocol compliance.
• Concurrent Multi-Agent Benchmarks: Rigorous benchmark suite measuring p50/p95 latency under 1, 5, and 20 concurrent autonomous agents.
• Threat Model & Security Hardening: Comprehensive threat model (THREAT_MODEL.md), pure-Go SSH modern ciphers (curve25519-sha256, chacha20-poly1305), 30s handshake deadline, HTTP timeouts, and pktline fuzz testing.
• Beta Tester Runbook & Feedback Form: Structured 5-minute intake runbook (docs/launch/BETA_TESTING.md) and GitHub Issue form.
• Claims Ledger & Audit Documentation: Comprehensive verification ledger (CLAIMS.md) and launch readiness audit (LAUNCH_READINESS.md).
• Product Hunt Launch Kit: Complete copy, taglines, first comment, and maker FAQs in docs/launch/PRODUCT_HUNT.md.
• Repository Governance: Added LICENSE (Apache-2.0), TRADEMARK.md, SECURITY.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md.

Changed

• Repositioning: Positioned as the vendor-neutral, self-hosted Git forge built for autonomous coding agents (Claude Code, Codex, Cline, Cursor).
• Version Standardization: Replaced legacy v0.4.7-enterprise labels with unified v0.5.0-beta.
• Site URL Unification: Standardized all documentation and homepage links to canonical URL https://ravaniroshan.github.io/exist.io/.
• Vitest Concurrency Stabilization: Configured explicit test timeouts and waitFor bounds to eliminate concurrency flakes under load.

Deprecated / Frozen

• Experimental Enterprise Modules: LFS locking, SAML/SCIM SSO, Terraform provider, Helm chart, and multi-service enterprise compose marked as experimental and frozen for launch.
• Claims Softening: Removed unverified "full wire compatibility with Cursor Origin" and unbuilt "automated merge queue" claims.

Full Changelog: v0.4.7-enterprise...v0.5.0-beta

Full Changelog: v0.4.7-enterprise...v0.5.0-beta

Full Changelog: v0.4.7-enterprise...v0.5.0-beta

v0.4.7-enterprise: Century Test Milestone (100 Tests Passed across 28 Suites) & Dynamic Forge Indicators

exist.io v0.4.7-enterprise Release Notes

💯 Century Unit Test Milestone: 100 Tests Passed Across 28 Suites

• Full Coverage for Application Header: Created Header.test.tsx (4 tests) covering repository breadcrumbs, star/fork counters, UnderlineNav tab switching, user profile dropdown actions, and clone modal transport switching.
• Full Coverage for AI Agent Console: Created AgentConsoleView.test.tsx (5 tests) verifying operational telemetry, real-time activity stream, interactive JSON-RPC tool caller, capability lease issuance, and MCP primitives catalog.
• Full Coverage for Authentication Modal: Created AuthModal.test.tsx (3 tests) validating Argon2id login authentication, enterprise registration, error alert handling, and session state dispatch.

🎯 Dynamic Forge Indicators & Real Production Parity

• Dynamic Header Indicators: Header dynamically queries live cluster APIs (getIssues, getPullRequests, getReleases) to render authentic numeric badges for open issues, open PRs, and release archives with zero mock flash.
• Dynamic Repository Releases Sidebar: RepoOverview loads real release records for the repository on mount, showing live latest tag indicators and total release counts.

v0.4.6-enterprise: Enterprise Admin Test Coverage, Live Commit Heatmap, and Zero-Mock Production Feed

exist.io v0.4.6-enterprise Release Notes

🌟 Enterprise Administration & Verification

• Full Vitest Test Coverage for Admin Views: Added 12 rigorous unit tests covering ClusterHealth, EnterpriseUsers, SsoConfig, and AuditLogs admin views, bringing test coverage to 88 tests passing across 25 suites.
• Real SQLite WAL File Size Calculation: Dynamic sqliteWalSizeBytes computation querying physical on-disk size of meta.db and meta.db-wal.
• Backend Dual-Path Git & Storage APIs: Added REST endpoints GET /api/v1/repos/{owner}/{name}, GET /api/v1/repos/{owner}/{name}/commits, and GET /api/v1/repos/{owner}/{name}/contents with direct tree/blob base64 inspection.

🚀 Zero-Mock Production Feed & Heatmap

• Authentic Commit Heatmap: UserProfileView aggregates real commits across the user's repositories from the live cluster, rendering live annual contribution tallies and active calendar cell intensities.
• Enterprise Activity Feed: GlobalHomeView dynamically interleaves agent activities, releases, pull requests, and commit pushes in production with no mock flash.
• Auto-Discovery on Mount: App.tsx auto-resolves live cluster repositories on mount, gracefully falling back to empty states or sandbox demo mode when configured.

v0.4.5-enterprise: Releases, Git Tags, Branch Rulesets, and SQLite WAL Webhooks

Highlights of v0.4.5-enterprise

• Releases & Git Tags Engine: Real SQLite WAL storage migration 0010 for releases, automatic discovery and union with Git tags, asset management, and source tarball downloads.
• Branch Rulesets & Merge Gates: Real branch protection management with signed commit requirements and PR review gates backed by pure-Go SQLite WAL.
• Webhooks Delivery Engine: In-app webhook event delivery log inspector with payload viewing, test ping trigger, and batch redeliver.
• Enterprise Network Security: Inbound IP CIDR allowlists and SSH Certificate Authorities management.
• Expanded Test Coverage: 21 test suites passing in Vitest (76 tests), and end-to-end integration test in internal/app/releases_rules_webhooks_test.go.

exist.io v0.4.4-enterprise: Repository Settings, Collaborators & Access Control, and Guarded Danger Zone

🚀 exist.io v0.4.4-enterprise Release Notes

⚙️ Granular Repository Settings Engine

• General Configuration: Live modification of default branch reference, pull request merge strategies (squash merge vs merge commits), and automated head branch deletion upon PR merge.
• SQLite WAL Direct Persistence: All repository settings are atomically updated via PATCH /api/v1/repos/{owner}/{name} directly into the WAL engine.

👥 Collaborators & Access Control

• User Grant Management: Dedicated interface for granting team members explicit access permissions (read, write, admin) backed by GET/POST/DELETE /api/v1/repos/{owner}/{name}/collaborators.
• Identity & Role Badges: Real-time user resolution, dynamic avatar badges, and owner permission protection.

⚠️ Guarded Danger Zone

• Visibility Toggle: Seamless switching between public and private repository states.
• Permanent Repository Deletion: Type-to-confirm modal with strict safety safeguards, deleting bare Git files on disk and SQLite WAL records.

🧪 Verification & Test Suite

• 19 Test Suites Passing (70 Total Tests): 100% green unit test coverage across Vitest and Go integration tests.
• Production Bundle: Zero compile errors, strict TypeScript conformance.

v0.4.3-enterprise: Complete Live PR Creation, Branching, AI Agent Code Review & 3-Way Merge Engine

Exist.io v0.4.3-enterprise: Pull Request & Branch Lifecycle Engine

🚀 What's New in this Release:

• Interactive Pull Request Creation Modal (CreatePullRequestModal.tsx):
  • Canonical GitHub Primer branch comparison UI (base vs compare) with live branch detection.
  • Title and Markdown body with dual Write/Preview tabs.
  • Automatic mergeability checking and draft pull request toggle.
• Dynamic Branch Creation & Management:
  • REST endpoints: GET /api/v1/repos/{owner}/{name}/branches and POST /api/v1/repos/{owner}/{name}/branches.
  • Seamless branch creation directly pointing to any source branch commit SHA.
• Native Pull Request REST Engine (internal/app/app.go):
  • GET /api/v1/repos/{owner}/{name}/pulls: Cursor pagination, diff hunks calculation via Git object store, comments and check runs.
  • POST /api/v1/repos/{owner}/{name}/pulls: Atomic PR number allocation, git ref resolution, diff calculation, and persistence in SQLite WAL.
  • POST /api/v1/repos/{owner}/{name}/pulls/{number}/merge: Squash & 3-way git merges, recording merge commit SHA, and advancing target branch.
  • POST /api/v1/repos/{owner}/{name}/pulls/{number}/comments: Persistent conversation threads with foreign key integrity.
  • POST /api/v1/repos/{owner}/{name}/pulls/{number}/reviews/agent: Native automated AI code review gate powered by internal/agentreviewer scanning for security tokens, SQL injection, and code quality.
• Comprehensive Test Coverage:
  • 66 Vitest unit tests passing across 18 suites (100% green).
  • Full end-to-end Go integration test suite (pulls_test.go) passing.

v0.4.2-enterprise: In-Browser File Commits, Canonical GitHub Setup, Live SQLite Issues & Dynamic Navigation

Exist.io v0.4.2-enterprise: Production Viability & Dynamic Repository Lifecycle

🚀 What's New in this Release:

• Canonical GitHub Quick Setup Screen:
  • Empty repositories (0 commits) render GitHub Quick Setup with HTTPS and SSH toggle, copyable clone URLs, commands for creating or pushing existing repos, and autonomous agent CLI setups.
  • Zero mock README or fake commit previews when a repo has no commits.
• In-Browser File Creation & Commit Engine:
  • Create, edit, and commit files directly from the web UI ().
  • Backed by POST /api/v1/repos/{owner}/{name}/files and atomic git.WriteFiles authoring.
• Native SQLite WAL Issues & Thread Comments Engine:
  • Full relational issues database schema (0009_issues.sql) backed by WAL journaling.
  • Full REST endpoints: GET/POST /api/v1/repos/{owner}/{name}/issues, PATCH /issues/{number}, and POST /issues/{number}/comments.
  • Filter by open/closed status, inspect threaded conversation trees, and toggle issue state with live updates.
• Repository Deletion & Global Navigation:
  • Ability to delete repositories (DELETE /api/v1/repos/{owner}/{name}) with disk cleanup.
  • Dynamic currentRepo switching across repository Header, Code, Issues, PRs, Commits, Releases, and Rulesets.
• Anonymous Read-Only Bypass for Public Repositories:
  • Anonymous users can browse public repository trees, file contents, commits, and refs without requiring auth tokens.
• Verification & Test Coverage:
  • 63 Vitest tests passing across 17 test suites (100% green).
  • All 24 Go packages passing (go test ./...).

v0.4.1-enterprise: Zero-Mock Production Mode, Interactive Onboarding Tour & In-App User Manual

exist.io Enterprise v0.4.1

Highlights

• Zero-Mock Production Mode: Quarantined all sample fixtures strictly to offline demo mode (isDemoModeActive() === true). Live production mode is strictly backed by live backend SQLite WAL data, real bare git storage, and clean canonical GitHub Primer empty states with quick setup commands.
• Interactive First-Time Onboarding Tour: 5-step guided interactive modal walking users through Sovereign Cluster Architecture (:8080, :2222, WAL engine), Git Remote Transport, Autonomous AI Agent MCP bridge, Rulesets & Cryptographic Enforcement, and Enterprise SSO/SCIM.
• In-App User Manual & System Guide: Comprehensive multi-tab architecture manual embedded in the header for instant reference on topology, ports, MCP agent integration, rulesets, and CLI usage.
• Direct Repository Creation: Added canonical GitHub Primer CreateRepoModal, wired to POST /api/v1/repos and git.Init bare repository engine.
• 57 Vitest Tests Passing: Comprehensive frontend test suite covering all views, modals, filters, and end-to-end user navigation.

v0.3.0 - Autonomous PR Review Engine, AST Symbol Search, Capability Leases & Space UI

What's Changed in exist.io v0.3.0

🤖 Autonomous Agent Protocols & Engine (Milestone D)

• Automated PR Reviewer Engine (internal/agentreviewer): Automated diff analysis, AST inspection, credential and secret leak detection (AWS keys, GitHub tokens, Slack tokens, private keys, high-entropy tokens), test coverage threshold verification, automated quality scoring (0-100), check run & check suite integration, and telemetry streaming.
• Pure-Go AST Semantic Symbol Search (internal/symbolsearch): Go parser standard library AST extraction, TypeScript/JavaScript regex-based parser, and Python AST scanner. Exposes GET /v1/origin/repos/{ownerSlug}/{repoName}/symbols and new MCP tool search_symbols.
• Ephemeral Capability Leases (pkg/agentlease): HMAC-SHA256 cryptographically signed capability tokens with scoped branch prefix isolation (refs/heads/agent/*) and automatic TTL expiration. Mounted on POST /api/v1/agent/leases.
• Bounded Agent Activity Ring Buffer (internal/agentactivity): Thread-safe in-memory ring buffer streaming live agent tool executions and automated reviews to GET /api/v1/agent/activities.
• Expanded MCP Server (35 Tools): Added search_symbols to internal/mcp/tools.go with complete schema and handler.

🎨 Craft-First Space UI Elevating Enterprise Self-Hosting (Milestone E)

• PullRequestsView: Live PR fetching, authentic empty state with copyable Git branch/PR commands, live 'Run AI Agent Review' button with real-time analysis banner, and live 'Slide to Merge' execution.
• RepoOverview: Live tree fetching via getFiles(...), blob viewer with live contents, authentic empty state with copyable clone commands, and interactive Semantic Symbol Search input with debounced AST lookups and kind badges.
• AgentConsoleView: Live telemetry streaming from /api/v1/agent/activities, live JSON-RPC MCP tester, and interactive 'Capability Leases' generator drawer with 1-click token copying.
• API Client Upgrades: Enhanced web/src/lib/api.ts with agent activity streaming, lease minting, and AST symbol lookups.

📚 Documentation & Diátaxis Upgrades

• Added comprehensive MCP 35 tools catalog reference at site/docs/reference/mcp-tools.mdx.
• Updated Diátaxis docs site and built verified static assets with zero broken links.
• Updated ROADMAP.md and README.md reflecting completion of Phase 4 autonomous agent execution.

v0.2.0 - Enterprise Git Forge & Autonomous Agent Runtime

exist.io v0.2.0 — Enterprise Git Forge & Autonomous Agent Runtime

v0.2.0 is the inaugural enterprise release of exist.io, transforming the standalone pure-Go forge into an enterprise-ready, self-hosted Git platform with dual transports, Git LFS, cryptographic signature verification, SSO/SCIM federation, and official Infrastructure as Code (IaC).

---

What's New in v0.2.0

1. Embedded Pure-Go SSH Server (:2222)

• Dedicated, zero-cgo SSH daemon embedded into the single binary on port 2222 (git clone ssh://git@<host>:2222/<owner>/<repo>.git).
• Eliminates dependencies on host OpenSSH daemons or system user accounts.
• Authenticates Git clients using enrolled user public keys and organization-wide SSH Certificate Authorities.
• Enforces pre-receive secret scanning push protection hooks before accepting commits.

2. Git Large File Storage (LFS) v1 Engine & CAS

• Full RFC-compliant Git LFS v1 Batch HTTP protocol (/info/lfs/objects/batch).
• Streaming chunked upload and download with SHA-256 Content-Addressable Storage (CAS) on disk.
• Binary file locking protocol (/info/lfs/locks) preventing unmergeable asset collisions.

3. Cryptographic Commit Signature Verification

• Real-time parsing of OpenSSH SIGSPEC binary signatures and GPG (OpenPGP RFC 4880) ASCII armor.
• Interactive verification audit popover in the Web UI displaying signature format, committer identity, and public key fingerprint matching.
• Branch ruleset policy gate requiring signed commits prior to merge.

4. Enterprise Identity Federation & SCIM 2.0 User Sync

• Automated employee provisioning and offboarding revocation via RFC 7643 / RFC 7644 SCIM 2.0 (/scim/v2/Users).
• Single Sign-On (SSO) support for OpenID Connect (OIDC) and SAML 2.0 identity providers (Microsoft Entra ID, Okta, Keycloak).
• Domain enforcement blocking local password authentication for corporate email domains.

5. Official Infrastructure as Code (Terraform & Helm)

• Dedicated Terraform / OpenTofu Provider (deploy/terraform-provider-exist) managing namespaces, repositories, branch rulesets, CIDR allowlists, and SSH CAs.
• Production Kubernetes Helm Chart (deploy/helm/exist-enterprise) with dual-port Service (HTTP 8080, SSH 2222), PersistentVolumeClaim, Prometheus Operator ServiceMonitor, and non-root security contexts.

6. Craft-First Space UI Dashboard

• Strict separation between Production Mode (live backend APIs with authentic empty states) and Sandbox Demo Mode (isolated fixtures in mockData.ts).
• Operator telemetry dashboard answering key questions: system health, Pure-Go SSH active streams, Git LFS store, SQLite WAL sync, and MCP tools status.
• Dispatched webhook delivery audit logs with HMAC-SHA256 signature payloads and test ping triggers.

7. Model Context Protocol (MCP) First-Class Integration

• First-class MCP server exposing 34 tools over JSON-RPC 2.0 at POST /mcp for Claude Code, Cursor, and Cline.
• Capability-restricted read-only sandbox at POST /mcp/readonly.

---

Verification & Quality Assurance

• Backend Test Suite: 100% pass across all 20 Go packages (go test -count=1 ./...).
• Web Frontend Build: Passing Vite + TypeScript typecheck (npm --prefix web run build).
• Documentation Site: Passing Blume link validation and static build (blume validate + blume build, 18 pages).