v0.3.0

Desktop app

• gosint-desktop [EXPERIMENTAL] for macOS, Linux and Windows: a node on the loopback
  shown in the system web view, everything in one data directory
  ($HOME/Library/Application Support/gosint, $XDG_DATA_HOME/gosint, %LOCALAPPDATA%\gosint).
  The port is remembered across launches, a lock keeps one instance per
  data directory.

Release check

• GET /api/admin/release asks GitHub's latest stable release at most
  twice a day and the console shows "Update X" beside the account menu
  for administrators. console.update_check: true by default, false
  sends nothing. One request is out at a time and the lock is never
  held across it.

Transform file scripts (Linux)

• A script run by a transform file is confined with Landlock: it reads
  the system trees, its own directory and a per-run scratch directory
  that is also its HOME and TMPDIR, and writes only there. Writable
  places are not executable.
• The server's own files (the yaml, the sqlite database, the unseal key
  file, the TLS pair and cache) are never granted: a grant reaching one
  is refused on save, and boot warns when the default policy covers one.
• Tools > Scripts in the console: the sandbox switch, extra read and
  write paths. A path missing on the node is reported in the scan log.
  Boot warns where scripts cannot be confined (macOS, Windows), and a
  script refuses to run there with the sandbox on.
• The release image's Python venv moved from /opt to
  /usr/local/lib/gosint/python, a place a confined script may read.

Console

Fixed:

• A transform launched with a changed number parameter failed: the
  value went out as a JSON number into a string map.
• Notes and analyses lost an edit typed while a save was in flight.
  Autosave keeps a revision, one save at a time, and asks before
  leaving with unsaved text.
• Escape in the entity rename saved the new name instead of dropping it.
• Dialogs now take the focus, keep Tab inside and give the focus back.
  Under a confirm, Backspace, undo and the sketch's Escape stayed live.
• Cmd/Ctrl+J opened the palette behind a dialog, and its Escape also
  cleared the sketch's selection.
• The dark theme flashed light on every load. The theme is set before
  the first paint, and scrollbars and select popups follow the theme
  instead of the OS.
• A viewer could drag nodes. Alt and S stayed armed after Alt+Tab.
• A file viewer sat under the top bar, and Escape closed the whole panel.
• One network error killed the type catalog until a reload, and a
  failed profile refresh signed the person out.
• Negative numbers in a CSV export carried a stray quote.
• The table's "select all" untick cleared the whole selection, a failed
  link left a duplicate entity on retry, a wrong passphrase blocked
  picking the same file again, two questions in a chat shared a key,
  applied proposals showed Apply again after a reload.
• Invitations said "expires just now", a closed share dialog kept the
  previous link, refused role and flag changes stayed on screen,
  the page spinner never ended when a load failed.
• A table import's refusal named the entity by an empty label.

Faster:

• The sketch page no longer loads the notes editor (TipTap), the chat,
  the import dialog or the map until opened,.
• The canvas reads plain sets in its frame loop, caches text widths
  across zoom levels and reads the palette once per theme change. The
  minimap is drawn at the device's density.
• The command palette caches its lists for a minute, the flow editor
  applies positions at drag end, graph searches and the hierarchy
  layout are linear.

Accessible:

• List rows open from the keyboard and in a new tab, toasts are
  announced, close buttons have names, every input has a label, menus
  and the palette carry their roles, editors show a focus ring, and the
  sketch page fits a narrow screen. Animations respect
  prefers-reduced-motion.

Configuration

• console.update_check (new, true).
• The tools setting gained scripts.sandbox, scripts.read_paths,
  scripts.write_paths.

v0.3.0-rc2

Changelog

• 1d7896c feat: keep the server's own files out of a script's reach
• 416af14 feat: report sandbox paths missing on the node in the scan log
• 4fd591d feat: warn at boot when scripts cannot be confined
• 236c7e4 feat: writable places of a confined script are not executable
• 8a6db72 fix: open external links without blocking the desktop window
• ad11200 fix: print the error when gosint-desktop exits
• e2412d0 fix: release check never holds its lock across the request

v0.3.0-rc1

• Native application for Linux/macOS/Windows (based on WebView)
• Sandbox for running Transformers (Linux and docker only)
• Documentation site on GitHub Pages

v0.2.2

-fix: censys api - migrate to the v3

v0.2.1

• Added ip_to_shodan transformer (requires a Shodan API key)

v0.2.0

• Icon display for sketch items is enabled.
• "Clone" button has been added for entities: it creates a copy of an entity with all custom fields, but without data.
• A small fixes

v0.1.0

Changelog

• ffab02b public