Skip to content

MIRA v0.345.1

Choose a tag to compare

View all tags
@tarekedOz tarekedOz released this 21 Aug 12:48
· 3 commits to main since this release
v0.345.1
fceada6

MIRA v0.345.1 — public beta. A new per-user My Preferences page (non-admins can finally pair a phone), plus a refresh-token fix so one device's hiccup no longer logs out the rest. No breaking changes; safe to upgrade in place — the auth-database migration is additive and runs automatically on first boot.

Self-hostable single binary, AGPL-3.0-or-later, signed with the vexillon.ai release key.

Install

# Linux / macOS
curl -fsSL https://get.vexillon.ai/install.sh | sh
# Windows (PowerShell)
irm https://get.vexillon.ai/install.ps1 | iex

New: a per-user "My Preferences" page

There's now a My Preferences page at /preferences, with a sidebar link for every user — not just admins.

This fixes a real access bug: mobile pairing and browser push notifications are per-user, but they lived on the admin-only Settings page — so a non-admin user simply couldn't pair their phone. My Preferences gathers the genuinely per-user surfaces in one place:

  • Notifications & devices — pair the mobile app (QR) and manage browser push.
  • Appearance — pick your web theme.
  • Voice replies — per-channel voice-reply policy and voice override (moved here from the Profile dialog).

The Profile dialog is now strictly account details (name, contact, password, avatar). Global/server configuration stays admin-only.

Fixed: one device's refresh no longer logs out the others

Refresh-token rotation previously used account-wide theft detection — so a harmless refresh race on a single mobile device (a lost response, or an OS-killed app replaying its token) could revoke every session and sign you out everywhere. Now:

  • Each login/pairing starts its own token family; a suspected reuse revokes only that one family (that one device), never the whole account.
  • A short grace window lets a just-rotated token be replayed once (the classic lost-response case) and re-issue cleanly instead of tripping theft detection.

Upgrade note: the fix relies on a small, automatic, backward-compatible auth-database migration (adds two columns) applied on first boot — no manual steps. Sessions that already exist are treated as legacy until their next refresh; to adopt the new per-device behavior immediately, users can simply log in once more on each device.

Verify (optional)

Every archive is signed with the vexillon.ai minisign key committed at verification/release-pubkey.minisign:

minisign -Vm mira-0.345.1-<target>.tar.gz -p verification/release-pubkey.minisign
Assets 14
Loading