v0.2.0

Changelog

• c470186 Failover that survives either copy dying, working sticky cookies on HTTP
• 23a6f90 agent: log why Traefik is recreated; send the owner's ACME email at once
• 70c7f87 auth: offer a recovery code at sign-in only when one is left
• bfa433a auth: the no-recovery-codes hint says what an owner can do
• d6ac059 brand: the layers mark replaces the placeholder S
• 4c178d0 logs: do not ask Docker for logs it cannot have
• 76c72ca reconcile, jobrun: keep the tag in digest-pinned image references
• ae4671f reconcile: no warning when the proxy is being recreated
• f9f56df tests: fail any Playwright test on a render loop or an uncaught page error
• ecdcaf7 tests: no network in the Docker deadline test, no sleep in the restart one
• bf5d009 tests: the Docker Hub spec reads the env editor's fallback too
• 10b4224 ui: a new toast no longer sends the others into a render loop
• 31db1d3 update: systemctl killed by the agent's own restart is not a failure
• 21b46d4 web: home-screen icon for the panel

v0.2.0-rc.2

Changelog

• 705ef6c Biome format and test types for the r3 web fixes
• adf3f56 CONTRACTS: a default install knows no trusted node address
• 3aa7452 CONTRACTS: compose.get hides the pasted file without env.view
• 26f036c CONTRACTS: node addresses for git, git_proxy_resolves, shared address table
• 6e98cc8 CONTRACTS: per-node LB certificates, peers and what revocation covers
• 50b0cdf CONTRACTS: the LB certificate gaps that remain
• 9fc09b3 CONTRACTS: trusted and reported node addresses, the seed's per-node recheck
• e136396 Format the earlier fixes with Biome
• 72351b6 Internal git hosts count GitHub and provider sources as users of a host
• fe2e683 Join commands install the panel's own release
• a245f86 Members with project access can pick a node in create forms
• 23af902 Panel runs as uid 61000, which no login user has
• f08c4d2 Viewers see a provider source read-only instead of "Connect GitLab first"
• 81ed20b Warn about accounts with the panel's uid on upgrades too
• 1c4bbf8 agent hub: cap the hello and every ServiceStatus a node sends
• c343ba6 agent: automatic UpdateAgent requests wait like the agent's own updates
• 2dc1a3c agent: refuse the node's own addresses for git, and unresolvable names behind the proxy
• 43c778f agent: report up to 64 interface addresses per family
• df2a2c7 agent: service folders on a node are root's only (0700)
• 70ea8db agent: seylo join --force keeps git_proxy_resolves
• c91798f agent: shared mode removes our own seylo-traefik
• 51a6bb9 backups: nodes no longer get the destination's keys
• 5d28e3a boxes: refuse a token in the repository URL, drop one saved before
• 4a19ed0 build: no buildx is a clear build failure, plus a node check for it
• e5a85a1 cli, web: name the keys settings page API keys and MCP
• e23f90a cli: rotate-key refuses a panel image older than 0.2.0-rc.2
• caabd43 cli: seylo panel rotate-key
• 3dd2749 compose: no "build sections are not built" warning for stacks the panel builds
• b822d71 cron: read day-of-week 7 as Sunday on the node
• 2c11e50 dbtools: database web UIs get a login only the edge holds
• 6f0a7f1 docs: master-key rotation through seylo panel rotate-key
• 09a26b8 e2e: RESULTS.md 38/38 on the v0.2.0-rc.2 candidate
• 49fafdb e2e: check 38 expects every migration in the journal, not a fixed 2
• 2bd0fd9 edge: serve maintenance and down pages with a strict CSP and nosniff
• 45d84e7 fs: the file manager creates service folders 0700 too
• 02dd094 handshake: the panel signs HelloRejected; unsigned rejections do not count
• 221a336 installer: never install an older release than the node runs
• 336cd79 lb-tls: node certificates live 30 days instead of 365
• b1fed38 lb-tls: per-node certificates with one-off issuers, peers and revocation
• f175b31 metrics: drop throttle state of removed services and nodes
• de728bb metrics: graphs refetch when a minute is written, not on every node sample
• 572e149 metrics: keep only the latest sample on the node
• fcdfe56 move, cleanup: never sweep a volume a move is copying into the node
• 291df81 move: nothing starts or re-places a service while its volumes copy
• 2aeca51 nodecheck: disk space hint names Settings > Docker cleanup
• d528e9f nodecheck: the Wings fork's proxy holding 80 and 443 passes
• 28a8778 panel.files checks the panel's node only
• 8ef18b5 panel: a Docker update without a result fails after an hour
• 2fc6477 panel: a broken database makes /api/health answer 503, not 200
• 39b8bd6 panel: a deploy trigger URL call joins only a queued trigger URL deploy
• 64d09ff panel: a git host on the nodes' own addresses is internal
• 7080926 panel: a joining node cannot make itself a build node; SECURITY.md states what a builder sees
• 6655bf4 panel: a rotation that never committed no longer stops the panel
• 558bc8c panel: accept only a run's own backup object key, document node bucket access
• 5e288cc panel: agent-reported node addresses only count where an admin records the host
• 2abb837 panel: brake second-factor code guessing per account
• 003c22e panel: build each project's env graph once per desired compile
• c1ca7c3 panel: check Mongo databases over TCP instead of starting mongosh every 10 s
• 12a7217 panel: check WebSocket text frames before Elysia parses them
• d001d41 panel: classify addresses with netguard's ranges
• c6ae831 panel: compress the web app, op results and MCP replies
• 9e90eb9 panel: creating a service no longer hands out env.edit, files.write or services.deploy
• 8a95daf panel: cron.run reads output with logs.view; compose.get hides the pasted file without env.view
• 60aaf75 panel: delete finished jobs once an hour, not only at start
• 5796559 panel: deleting a clone or its source ends the data copy
• 8b9fca5 panel: index deployments and builds in flight for the node scopes
• bbd22f8 panel: internal git hosts with underscores list and can be taken off
• b901a11 panel: join command comments name the install host and --version
• 1600d6b panel: join command pipes the verified install host, pins the release with --version
• 32955e7 panel: keep report totals per node so the hourly prune reads only nodes over a cap
• 8f43244 panel: match alert keys on the event_key index and age out unresolved alerts
• 12d1833 panel: metrics minute close in one transaction with running rollup sums
• 110406f panel: prune finished jobs every hour, not only at start
• ebd7466 panel: rotation output without a dangling "0 sealed values sealed again:"
• 5c66b99 panel: rotation replaces the agents' TLS key and prints exact re-join commands
• 250bf3b panel: services.moveProject carries or checks the service's internal git host
• 3e098aa panel: services.moveProject checks the git host with the caller's address scope
• f4db427 panel: take the certificate retry minute before the DNS and agent awaits
• 7193058 panel: test that ApplyService passes build one env graph per project
• b31c223 panel: the agent version floor uses the running release's minAgent
• 5a34c6c panel: the live socket's session checks no longer slide the session
• 9ab92a1 playwright: demo answers nodes.choices; env-save waits for the editor state
• 5656dad playwright: demo data for a project's internal git hosts
• a8cb3b5 proto: LB certificates name their node, and lb_tls lists the peers
• 9eb489a proxy: each node's LB entry point takes only current nodes' certificates
• dba0439 reconcile: VM test that mounts work under private service folders
• 06a58b0 reconcile: an agent stop or crash mid health check rolls the deploy back
• 30ffb5c reconcile: file mounts per spec hash, so a failed deploy keeps the old files
• bba38f4 release: build in a read-only job, draft and push with no npm code
• 7d9c033 seylo join --force keeps the node's own config.yml settings
• 259dd8b test: a node joined from another panel keeps that panel's service data
• 116de3c test: the LB identity test waits for each node's certificate confirmation
• a3e5ebc tests: an unre...

v0.2.0-rc.1

Changelog

• ba6e505 CONTRACTS.md: stream buffers, report lanes, panel rollback records
• 6b2233e CONTRACTS: git seed V2, provider allowance, node's own addresses, proxy names
• 09effd8 CONTRACTS: git seed rules, git.allowInternalHost, git through the agent's proxy
• 738d9f4 CONTRACTS: node git guard limits and node addresses as internal git hosts
• 544a5ee CONTRACTS: node's own addresses and proxy-only names are 0.2.1 work
• f6aea5e Revert "agent: refuse the node's own addresses, and unresolvable names behind the proxy"
• 2c22475 agent test: scheduled cleanup and host shells against the real panel
• f979a85 agent: FetchGitFile stops at a refused commit fetch too
• da65786 agent: RetryCertificate makes Traefik ask the CA again for one route
• 32799e4 agent: VM-test the new engines' database shells through the Shell RPC
• 67bc9ef agent: VM-test the older majors the panel offers
• 79730c5 agent: a crash during a reconcile pass is reported and waits its delay
• 075f087 agent: clone with the user name the panel sends
• c16e69d agent: dbengine facts and capabilities without an RPC
• 89d2c05 agent: dial every git connection through an address-checking proxy
• 40949df agent: finish an interrupted project move on the next pass
• 6b679ae agent: forget a host shell refused while it was starting
• fddaecf agent: git goes through the agent's HTTP proxy again, with the address check
• a6432e9 agent: git-dial takes the command's streams; stop at a refused commit fetch
• 0128f2b agent: helper and job containers leave no anonymous volumes behind
• 9317454 agent: host shells drop the agent's OOM protection
• 1f60c38 agent: move running containers to another project's network without a restart
• 835d106 agent: refuse the node's own addresses, and unresolvable names behind the proxy
• 5d47e09 agent: remember the panel's identity and refuse other panels
• 0c2f799 agent: root shell on the host (HostShell)
• 7d99f6f agent: scheduled and disk-triggered Docker cleanup
• 739fb51 agent: shells, web UIs, TLS exposure and backups for the new engines
• c548deb alerts: a rolled-back update says that automatic runs hold the release
• f748b0a brand: the GitHub OAuth app's client id (Seylo-dev/Seylo, device flow)
• 591ec90 build: plain http:// git only when an admin allowed it
• 86d3759 ci: security workflow with govulncheck, osv-scanner and zizmor
• 65885d7 ci: zizmor 1.31.1, the newest version zizmor-action v0.7.1 has a lock for
• 803e41e cleanup: refuse cron the agent cannot read, report unreadable schedules
• 4d8d3e2 cron: Sunday as 7 is stored as 0, and the agent reports a schedule it cannot read
• b4d7f47 deps: override dompurify to 3.4.17
• 1399a9e docs: CONTRACTS make targets for the release scripts and the key check
• a30a59f docs: CONTRACTS on the frozen init migration and the e2e coverage of 0.2
• 59224a6 docs: Docker Hub ops, hosts, caches, rate limits and limits in CONTRACTS
• 0bbeab3 docs: Docker Hub page cap, config caps, refused hosts and token limit
• 0098726 docs: SECURITY.md threat model, secrets, release signing and verification
• 16aea95 docs: certificate retries in CONTRACTS
• 822b871 docs: clone and move review fixes in CONTRACTS.md
• e5e7129 docs: clones and project moves in CONTRACTS.md
• 60efe71 docs: cron parity, unreadable schedules and host shell closes in CONTRACTS.md
• 19aa538 docs: database engines in CONTRACTS and CONTRIBUTING
• 982d416 docs: e2e results of 79730c5 (38 of 38) and the live sites
• f858c05 docs: git providers, watch paths and the Gitea test in CONTRACTS
• 12b0887 docs: point the docs links at apps/docs in the Website repo
• 4258906 docs: scheduled cleanup and host shells in CONTRACTS.md
• 353e20d e2e: RESULTS.md 38/38 on the merged security fixes
• 913d20f e2e: RESULTS.md 38/38 on the round-2 security fixes
• 6661028 e2e: checks 32-38 for the 0.2 features and an upgrade from 0.1.1
• 8c6e91c e2e: results of a fresh run on the merged tree (8a3a7a5), 38 of 38
• 82af922 e2e: retry infra pulls, wait for Gitea's first branch, unique shell markers
• 64fc5bf edge: recheck tool sessions with the panel
• 382aa6e edge: refuse redirect targets with control bytes or backslashes
• 6c1d394 engines: fixes from the review
• f146c84 env-analyzer: hostMentions, the literal host name finder on its own
• 552249e fs: drop setuid/setgid and never make root-owned entries
• 30bcd75 github: hide the App and its installations from accounts with no source rights
• f075671 gitproviders: review fixes for provider webhooks, polling and watch paths
• 2bddb0a interop: send the session key from the node-ops driver
• a673dc8 it-gitea: remove the Gitea container's anonymous volume too
• 0e1eff4 merge feat/clone-move
• 4c733bc merge feat/dockerhub
• 8fa4300 merge feat/engines
• 8418e9f merge feat/git-providers
• 32994d0 merge feat/node-ops
• d76fd01 merge main: the auto-publish release job and the installer terminal fix
• 3df749c merge main: the motion and skeleton pass into the 0.2 features
• 169db41 merge sec/agent into sec/panel-hub
• 67fa069 ops: git.branches says which hosts it reads
• 8864f68 ops: watch-path matcher shared by the panel and the web app
• 0e051ce panel hub: cron and backup results get their own report budget
• 845e8b6 panel hub: test that a restarted panel seeds each report lane on its own
• f3ac19e panel hub: tiny DATA frames no longer cost an object each
• 6decbc0 panel test: setup tests set the GitHub client id they are about
• 7ef9426 panel: Docker Hub review fixes
• 490e30f panel: Docker Hub search puts the image named like the query first
• f0d48c1 panel: Docker Hub search, tags, image configs and one-click create
• 0711206 panel: FetchGitFile only on the stack's own node; no plain-http git (agentio-2)
• 9e3f880 panel: GitLab, Gitea/Forgejo and Bitbucket connections; watch paths
• e39bf11 panel: MCP consent preselects read only and names the app by its redirect host
• ba6447c panel: Postgres 18, pgvector, Valkey, KeyDB, Dragonfly and ClickHouse
• b9410e0 panel: a browser session needs its key as well as the cookie
• 00ae9f5 panel: a git URL with a token in it is refused, and never shown
• 444c534 panel: a node's own private address is an internal git host
• 2ac9248 panel: a push found while a deploy runs deploys after it, newest head wins
• 2c64522 panel: a script-restricting Content-Security-Policy on the web app
• 075834c panel: a shared credential is shared for one repository, URL or image
• 33bee4b panel: alert when a node cannot get its LB certificate (runtime-2)
• 375ebd5 panel: answer CheckEdgeAccess and mint tool tickets for sessions only (runtime-1)
• 17ef905 panel: bound watch path matching per push (dos-1, dos-5)
• 0ef7973 panel: cap durable report fields and budget them per node (protocol-3, dos-3)
• 2db0aba panel: cleanup schedule ops, run history and alerts
• 7d05632 panel: cliLo...

v0.1.1

Changelog

• 009326d installer: only ask on a terminal that really opens
• 8a6aff3 release: publish the checked draft by id; sign openapi.json and install.sh
• 4789e57 release: publish the draft automatically once independent checks pass

v0.1.0

Changelog

• 392a0f6 Seylo: initial public source
• f5bef34 agent test: a dropped connection never outlives its accept
• ff88f49 agent test: update refusals no longer depend on brand.json's key
• 94c71ea brand: the release signing public key (minisign 229CC74213B1BEF0)
• 5d6dcb5 ci: dry run checks the release files by their upload names
• bcaa87d ci: release fixes from review: pre-releases, the pushed tag, both secrets
• 0e428dd ci: release from GitHub Actions
• 61271c6 ci: render the release install.sh outside dist/
• 9ad37b7 docs: releases from GitHub Actions
• 9a18e88 panel test: answer the connect sync instead of racing it
• 856ddb3 panel test: the memory-bomb test proves the memory limit, fast
• 3414f5d playwright: the 2FA sign-in test confirms first and never waits on a gone alert
• 87abaf1 proxy test: pin the clock in TestRouteStatusCertificates
• 9c8ac3d reconcile test: read the fake router under its lock
• 10a8395 ui: Button hover through a one-class-specificity hover-enabled variant
• 8facf7f ui: DataTable placeholder rows take the columns' usual widths and lines
• 0e3c456 ui: checkbox and radio marks no longer zoom in
• 83521ec ui: transitions on the kit's controls, overlays open and close smoothly
• 5361e69 web: Playwright checks for the sliding selection and steady font weight
• b6ad885 web: motion foundation, 200ms ease-out transitions and pointer cursors
• 2685212 web: placeholders that keep the screen still when the data arrives
• 984299c web: skeletons shaped like the content on every screen that loads data
• 2d5b357 web: sliding selection backgrounds and page enter transitions