v1.8.3

Welcome to FengSui v1.8.3!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml. An existing connection stays what it is (Huawei), and nothing is detected or sent that was not before. To move FengSui to a router of another brand, open Settings → Router, enter its address and password, and leave the brand on "Detect automatically".

Highlights

Routers of other brands

FengSui now connects to ZTE (the goform web interface and the zWRT one of the G5, U60 and U50 series), Pinsu, Tozed / ZLT (also China Unicom's VN007), FiberHome and NRadio routers, and to OpenWrt routers with a Quectel or Fibocom module. Each brand has an implementation of its own, written from notes on the brand's management interface: the signal on all of them, nearby cells on most, and band lock, cell lock and reboot as experimental writes you turn on one at a time. None of them has been run on a real router yet: FengSui is still verified on the H168-383 only, and the other brands are read-only until you say otherwise.

FengSui tells the brand itself

Settings → Router has a brand field that starts on "Detect automatically". FengSui sends the router a few requests that need no login, sees which brand answers, and only then sends the password: no password goes to a router of the wrong brand, and no login attempt is used up. If it cannot tell, it says so and you choose the brand yourself.

What's changed

🚀 Features

• The router's brand, with the connection
• Brand detection without a login
• Drivers for seven brands
• The console on another brand
• The device report form asks for the brand

🌟 Enhancements

• One interface for every brand.
• Taking locks off is open wherever a lock may be put on.
• Consent to a driver's writes is kept across restarts
• Failure guidance names your router's address
• Plain words in the console.

🐛 Bug fixes

• A start-up identification asked for twice no longer opens a second session whose answer was dropped.
• A band lock that names 5G bands alone is refused when the router's current 4G bands cannot be read

📚 Documentation

• Supported devices
• A device reference
• The architecture report records the two-library audit of the drivers (§17)
• A friendlier not-found page on the documentation site
• Supported devices marks each feature per model

Full Changelog: v1.8.2...v1.8.3

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.8.3

v1.8.2

Welcome to FengSui v1.8.2!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml: the daemon works as in 1.8.1. This release adds the live demo's other-model mode and the Supported devices guide page.

Highlights

See FengSui on another Huawei model in the live demo

Choose "See how FengSui works on other Huawei models" in the demo's notice, or open the demo with ?router=other: it simulates an LTE-only Huawei router FengSui was not verified on, so you can try the read-only mode, turn experimental writes on one at a time, lock LTE bands, read the device report and start the one-click AI agent test, all inside the page.

A list of the routers FengSui may support

The new Supported devices page lists, by brand, the Huawei HiLink routers FengSui will most likely connect to, what may work on each, and a link to report how it does on yours.

What's changed

🚀 Features

• The live demo's other-model mode

🐛 Bug fixes

• The live demo notice's links look like links.

📚 Documentation

• Supported devices
• "Other Huawei models" and both READMEs point to the live demo's other-model mode.

Full Changelog: v1.8.1...v1.8.2

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.8.2

v1.8.1

Welcome to FengSui v1.8.1!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml, and nothing turns on by itself: the one-click test is offered only on a model FengSui was not verified on, and changes settings only when you start it.

Highlights

Start an AI agent's router test with one click

On a model FengSui was not verified on, "Copy prompt and start test" under Settings → Device lists everything the test needs and, once you confirm, turns it all on and copies the prompt: the agents' two switches, the experimental band lock, redial and reboot, SMS (ticked by default, so the agent can send one test SMS to a number you give it), and the permissions for the agent's token. Keep what passed, or choose "End test" to put back what the test turned on. While the test is on, FengSui reminds you 3 hours after the agent's last step and then daily, until the test's writes have all read back as a match, you have read a reminder, or you end the test.

What's changed

🚀 Features

• The AI agent test at one click
• SMS in the agent test
• A reminder while the test is on

🌟 Enhancements

• The agent test prompt follows the one-click start.

🐛 Bug fixes

• Every header button stays on screen.

📚 Documentation

• "Other Huawei models", "AI agents" and "Notifications" describe the one-click test, its SMS option, what to keep or end afterwards, and when the reminder comes.

Full Changelog: v1.8.0...v1.8.1

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.8.1

v1.8.0

Welcome to FengSui v1.8.0!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml: every setting the console can now change follows .env until you change it there.
• Existing tokens keep what they could do: a full-access token gets all four permissions, a read-only one reads SMS as before. Agents no longer see tools their token may not use, and calling one answers TOKEN_NOT_PERMITTED.
• You can go back to 1.7.7: it keeps the new settings in settings.json but ignores them, so .env applies again, and a token with some but not all permissions works as a read-only token there, which on 1.7.x also reads SMS. Coming back to 1.8.0 finds them as you left them. Recently deleted does not survive the trip: 1.7.7 drops it from sms.json the next time it saves, and removes messages restored from it at its next full sync.
• From 1.7.4 or earlier: run docker exec cpe-dash node dist/cli.js doctor first. A file it reports as "stored without encryption" is moved aside at the first start of 1.7.5 or later: encrypt it first, with the daemon stopped, by docker compose run --rm cpe-dash node dist/cli.js rekey --plaintext.

Highlights

Choose what each token may do

Every token can read the router's data; what else it may do is up to you: read SMS and codes, change the router, manage devices' internet access, send SMS and edit contacts. You tick it when you create the token and can change it later. The REST API, the MCP tools and the live events follow it, and an agent sees only the tools its token may use. Existing tokens keep exactly what they could do.

Agent, self-healing, alert and SMS settings in the console

The AI agents' switches, the self-healing windows, the alerts and the SMS behaviour can now be set under Settings, and apply at once. Until you change one there, it follows .env as before.

Deleted SMS can be restored

A deleted message still leaves the router at once, but FengSui now keeps it in the SMS centre's new Recently deleted for 30 days (you choose how long, or turn it off), where you can restore it or delete it for good. Deletes from Telegram, tokens and AI agents land there too, and only the signed-in console can empty it.

AI agents can help test your router

With "Let AI agents test this router" on (Settings → Device), an agent connected to FengSui can look, read-only and through FengSui's own session, for router endpoints FengSui does not use yet. On a model FengSui was not verified on, it can also test the experimental writes and draft a compatibility report from a ready-made prompt. If an agent's band lock leaves the WAN down for 3 minutes, FengSui writes back the band setting from before the lock.

What's changed

🚀 Features

• Per-token permissions for the REST API, MCP and live events.
• Behaviour settings in the console
• AI agents can test the router
• Recently deleted for SMS.
• A safety net for an agent's band lock.
• A prompt for testing with an AI agent.

🌟 Enhancements

• Tokens get permission checkboxes.
• Self-healing and the alerts are always running
• An agent that may not test is told which switch to ask for.
• The self-healing hints point to Settings.

🐛 Bug fixes

• A one-message conversation says "1 message".

📚 Documentation

• The AI agents page describes the console switches, token permissions and agent testing

Full Changelog: v1.7.7...v1.8.0

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.8.0

v1.7.7

Welcome to FengSui v1.7.7!

Important

Before you upgrade

• Agents and scripts that call lock_band, lock_cell, unlock_rf_locks, set_security_switches, set_wifi_and_antenna, mark_sms_read or upsert_contact over MCP must now pass confirm: true. Agents that read the tool list see the new parameter on their own.
• From 1.7.4 or earlier: run docker exec cpe-dash node dist/cli.js doctor first. A file it reports as "stored without encryption" is moved aside at the first start of 1.7.5 or later: encrypt it first, with the daemon stopped, by docker compose run --rm cpe-dash node dist/cli.js rekey --plaintext.
• Nothing to change in .env or docker-compose.yml, and no data format changed: you can go back to 1.7.6.

Highlights

Every change an AI agent makes asks for confirmation

Over MCP, every tool that changes the router, an SMS or a contact now requires confirm: true, as the AI agents page already said; band and cell locks, unlocking, the router switches, Wi-Fi and antenna, marking SMS as read and saving a contact did not ask before. The .env switches that turn these tools on are unchanged.

What's changed

🔒 Security

• Every agent write needs confirm: true.

Full Changelog: v1.7.6...v1.7.7

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.7

v1.7.6

Welcome to FengSui v1.7.6!

Important

Before you upgrade

• From 1.7.5: nothing to change.
• From 1.7.4 or earlier: run docker exec cpe-dash node dist/cli.js doctor first. A file it reports as "stored without encryption" is moved aside at the first start of 1.7.5 or later: encrypt it first, with the daemon stopped, by docker compose run --rm cpe-dash node dist/cli.js rekey --plaintext. With PEER_DISCOVERY_ENABLED=true on more than one host, each host's beacon key now comes from the router password saved in its console.
• No data format changed: you can go back to 1.7.5.

Highlights

Same FengSui as 1.7.5

This release changes one test that GitHub's code scanning flagged; the console, the daemon and the image are the same as in 1.7.5 apart from the version number. Coming from 1.7.4 or earlier, follow the upgrade notes: they repeat what 1.7.5 asks you to do.

What's changed

🧰 Maintenance

• The licence-label check compares text.

Full Changelog: v1.7.5...v1.7.6

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.6

v1.7.5

Welcome to FengSui v1.7.5!

Important

Before you upgrade

• Run docker exec cpe-dash node dist/cli.js doctor before upgrading. A file it reports as "stored without encryption" is moved aside at the first start of this version: encrypt it first, with the daemon stopped, by docker compose run --rm cpe-dash node dist/cli.js rekey --plaintext (the same command also brings it back afterwards).
• Running FengSui on more than one host with PEER_DISCOVERY_ENABLED=true: each host's beacon key now comes from the router password saved in its console instead of CPE_PASSWORD in .env, so the hosts recognise each other once they have saved the same router password.
• Nothing else to change in .env or docker-compose.yml, and no data format changed: you can go back to 1.7.4.

Highlights

Data files stored without encryption are no longer trusted

With an encryption key set, a data file in plain JSON is now moved aside and reported instead of read, so a file planted in the data directory cannot bring a console password of its own. Run doctor before you upgrade; the upgrade notes say what to do if it reports such a file.

Each SMS is sent once

Pressing Cmd/Ctrl+Enter again while the console was still sending a message sent it a second time.

Duplicate-daemon protection works with the recommended setup

With PEER_DISCOVERY_ENABLED=true, the daemon refused to start when the router password was kept in the console rather than in .env; the beacon now uses the password saved in the console.

What's changed

🐛 Bug fixes

• Indian mobile numbers that begin with 91.
• Duplicate-daemon protection works with the router password kept in the console.
• The alert for an unsigned router key keeps its remedy.
• An SMS goes out once, however often Cmd+Enter is pressed.
• A malformed body on a code sign-in answers BAD_PAYLOAD.
• An agent's SMS refused before the router keeps its hourly allowance.
• An agent's incomplete access-control call is refused before the router.
• Agents are told every tool that needs confirm: true.
• Queued Telegram notifications are not lost at the edges.
• A quoted .env value may have a comment after it.
• Contacts match numbers exactly when it matters.
• Access control recognises your device however its IPv6 address is written.
• restore and rekey flush what they write.
• A token or code just shown leaves the page when Settings closes.
• The code chip works from the keyboard and keeps its label.
• Console settings and the audit log are reported when they cannot be decrypted at startup.

🔒 Security

• Data files stored without encryption are no longer read.
• Wrong current passwords count across an IPv6 /64.

📚 Documentation

• docs/PHASE2_ARCHITECTURE_REPORT.md §16 records the post-public review
• Tests no longer use real-format phone numbers.
• What a group in TELEGRAM_CHAT_IDS may do.
• The fix for a file stored without encryption works as written.

🧰 Maintenance

• The image states its licence.

Full Changelog: v1.7.4...v1.7.5

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.5

v1.7.4

Welcome to FengSui v1.7.4!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml, and no data format changed: you can go back to 1.7.3.
• If you keep the router password in .env (it is imported on the first start only) and it begins or ends with a space or contains #, put it in single quotes.

Highlights

Safer answers to the unexpected

When a request runs into a bug, the API no longer sends the error's internal message back, and one-time setup, reset and binding codes draw every character evenly. GitHub's code scanning found both once the repository went public.

An image you can verify

This is the first release built while the repository is public, so its image carries a signed build-provenance attestation: gh attestation verify oci://ghcr.io/cky008/cpe-dash:1.7.4 -R cky008/cpe-dash.

A code of conduct and a plain licence statement

Contributions follow the Contributor Covenant 2.1, and the README says plainly that FengSui is free for personal and non-commercial use only.

What's changed

🐛 Bug fixes

• The Chinese README's release badge shows again.
• The documentation home page draws its whole title.

🔒 Security

• Unexpected errors answer with a generic message.
• One-time codes draw every character evenly.
• Request input is read without backtracking patterns.

📚 Documentation

• A code of conduct.
• The licence, stated plainly.
• Router passwords with spaces in .env.
• What the router's own login page checks.

🧰 Maintenance

• Development tools without known vulnerabilities.

Full Changelog: v1.7.3...v1.7.4

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.4

v1.7.3

Welcome to FengSui v1.7.3!

Important

Before you upgrade

• Nothing to change in .env or docker-compose.yml.
• New setting CPE_REQUIRE_ECC_SIGNATURE (default true): once your router has signed its encryption key at a login, a login without that signature is ended instead of trusted. Routers that never sign are not affected; set it to false only if a firmware update made your router stop signing.
• Run docker exec cpe-dash node dist/cli.js doctor once after upgrading. If it reports a file as "stored without encryption", encrypt it as the backup page of the guide shows; a later release will refuse such files.
• state.json gains one field (eccSigned); an older version ignores it, so you can still go back.

Highlights

Local numbers in your country's format

A number typed without + is completed the way your country writes it: Italian mobiles that begin with 39 and Polish numbers that begin with 48 keep their digits, and the trunk prefix 8 (Russia, Kazakhstan) or 06 (Hungary) is dropped. A Kazakh SIM now sets the default country, and Telegram's send wizard shows your country on its buttons.

Tighter security

The router's encryption key must stay signed once it has been, a stream opened with an expiring token ends when the token does, a one-time setup code survives a few typos, wrong current passwords count against the sign-in limit, and stopping FengSui in the middle of a router connection test logs out of the router.

Find old unencrypted files

cpe-dash doctor reports a data file written before encryption was required, and cpe-dash rekey encrypts it in place.

What's changed

🐛 Bug fixes

• Local numbers in Italy, Poland, Russia, Kazakhstan and Hungary.
• Telegram's send wizard follows the SIM's country too.
• The wizard's country buttons show yours.
• A Kazakh SIM sets the default country.
• Two daemons started at the same moment cannot both run.
• restore and rekey never leave a store missing.
• Stopping during a connection test logs out of the router.
• One failing listener no longer hides an event from the rest.
• A one-time code survives the sign-in limit.
• A term's help lets go.
• Building the documentation never empties the repository.

🔒 Security

• The router's encryption key must stay signed.
• An expiring token's event stream ends when the token does.
• Wrong current passwords count against the sign-in limit.
• Agents see more of the rules.
• No router request after logout begins, and no retry while yielding.
• The router's login signature is compared in constant time.
• doctor finds stores written without encryption, and rekey encrypts them.
• No dialable phone numbers in the guide.

📚 Documentation

• docs/PHASE2_ARCHITECTURE_REPORT.md §15 records the second final review
• Contributing rules that match the repository.

🧰 Maintenance

• Images you can verify.
• Release notes link the commits since the release before.

Full Changelog: v1.7.2...v1.7.3

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.3

v1.7.2

Welcome to FengSui v1.7.2!

Important

Before you upgrade

• Nothing to change: no setting or data format changed, and docker-compose.yml changed only in its comments, so an existing compose file keeps working.

Highlights

Every line of docker-compose.yml, explained

A new guide page shows the example compose file in full and says what each entry does, which ones to leave alone, how .env feeds both Compose and FengSui, and how to make the common changes.

The themes on the home page

Scroll through the documentation site's home page and the dashboard wipes from one theme to the next, light and dark in turn.

Help links that always open

The console's "?" marks link straight to the guide on fengsui.iocky.com, and steps with code blocks render properly on the site.

What's changed

🐛 Bug fixes

• The console's "?" marks open the guide on its own domain.
• Steps with a code block render as steps.

📚 Documentation

• A page for docker-compose.yml.
• Applying .env changes.
• The home page shows the themes.
• Support FengSui from the documentation site.
• "Devices and internet access" in Chinese too.

Full Changelog: v1.7.1...v1.7.2

---

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.2