v1.8.0

v1.8.0: safe self-update (rollback watchdog + staged rollout)

v1.7.5

build: pin IOTMP f649357 and harden updater --version probe

Picks up the IOTMP change that closes inherited descriptors for the
streaming exec session and the terminal as well as cmd::exec. Also
switches updater::verify_binary from popen to the shared cmd::exec, so
the --version probe of a freshly downloaded binary runs with a timeout
and without inheriting the daemon's descriptors.

v1.7.4

build: pin IOTMP bf230bf for 1.7.4

Picks up the cmd::exec fix that closes inherited descriptors in the
child before exec, so detached workers do not keep the exec pipe open
on kernels without close_range (Ubuntu 18.04 / kernel 4.15).

v1.7.3

Move the device tunnel to thinger-http 0.9: the TLS connection handshake is
now bounded by a timeout, so a stalled reconnect can no longer leave the agent
hung indefinitely. Command resource stdout and stderr are drained to EOF before
returning, fixing truncation of script output under load.

v1.7.2

updater: shut down cleanly on self-update instead of std::exit

After swapping the binary the updater called std::exit(0) from an IOTMP
worker thread while the io_context threads were still live, so static
destructors ran underneath them and the process aborted (SIGABRT, exit -6);
KeepAlive restarted it but the update path never exited cleanly. Raise
SIGTERM instead to drive the normal shutdown (workers stop, client
disconnect, teardown), then the init system restarts the new binary.

v1.7.1

installer(macos): fix system-wide LaunchDaemon for root installs

A root install wrote UserName/GroupName=root, but macOS has no "root"
group (root's primary group is wheel), so launchd rejected the job with
EX_CONFIG and never started it. Omit both keys for root (a LaunchDaemon
without UserName already runs as root) and, for any other user, set
GroupName to their real primary group instead of the user name.

v1.7.0

build: pin thinger-iotmp and thinger-http to the tested commits

Pin thinger_iotmp to bed5417 and thinger_http to 4354dc3 instead of floating
on main, so every agent tag builds the same transport stack. These are the
reviewed commits that verify the TLS server certificate (and host name) on the
device tunnel.

v1.6.9

- launchd: stop pinning the daemon's working directory, so "/" over the
  filesystem resource means the filesystem root on macOS as it already did
  on Linux

v1.6.8

- installer: honour -v when pinning a version, which previously fell back
  to the channel head on the default channel

v1.6.7

- installer: install as a system service by default, elevating with sudo
  (asks on a terminal, passwordless sudo when unattended, --user to opt out)
- scripts: thread-safe reload plus $scripts/info and $scripts/reload
  resources, so the scripts directory can be rescanned without a restart
- android: run under the app's foreground service (no-op service installer,
  self-updater disabled, monitoring fallbacks where /proc is blocked)