Skip to content

v1.7.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 13:36
· 141 commits to main since this release
v1.7.5
This tag was signed with the committer’s verified signature.
cky008 Kaiyu Chen
SSH Key Fingerprint: zM0FNeXrW5poM9TBRpLJ8IOs2AR16/fh7HAj5l8xgm8
Verified
Learn about vigilant mode.
ef09787
This commit was signed with the committer’s verified signature.
cky008 Kaiyu Chen
SSH Key Fingerprint: zM0FNeXrW5poM9TBRpLJ8IOs2AR16/fh7HAj5l8xgm8
Verified
Learn about vigilant mode.

Welcome to FengSui v1.7.5!

Important

Before you upgrade

  • Run docker exec cpe-dash node dist/cli.js doctor before upgrading. A file it reports as "stored without encryption" is moved aside at the first start of this version: encrypt it first, with the daemon stopped, by docker compose run --rm cpe-dash node dist/cli.js rekey --plaintext (the same command also brings it back afterwards).
  • Running FengSui on more than one host with PEER_DISCOVERY_ENABLED=true: each host's beacon key now comes from the router password saved in its console instead of CPE_PASSWORD in .env, so the hosts recognise each other once they have saved the same router password.
  • Nothing else to change in .env or docker-compose.yml, and no data format changed: you can go back to 1.7.4.

Highlights

Data files stored without encryption are no longer trusted

With an encryption key set, a data file in plain JSON is now moved aside and reported instead of read, so a file planted in the data directory cannot bring a console password of its own. Run doctor before you upgrade; the upgrade notes say what to do if it reports such a file.

Each SMS is sent once

Pressing Cmd/Ctrl+Enter again while the console was still sending a message sent it a second time.

Duplicate-daemon protection works with the recommended setup

With PEER_DISCOVERY_ENABLED=true, the daemon refused to start when the router password was kept in the console rather than in .env; the beacon now uses the password saved in the console.

What's changed

🐛 Bug fixes

  • Indian mobile numbers that begin with 91.
  • Duplicate-daemon protection works with the router password kept in the console.
  • The alert for an unsigned router key keeps its remedy.
  • An SMS goes out once, however often Cmd+Enter is pressed.
  • A malformed body on a code sign-in answers BAD_PAYLOAD.
  • An agent's SMS refused before the router keeps its hourly allowance.
  • An agent's incomplete access-control call is refused before the router.
  • Agents are told every tool that needs confirm: true.
  • Queued Telegram notifications are not lost at the edges.
  • A quoted .env value may have a comment after it.
  • Contacts match numbers exactly when it matters.
  • Access control recognises your device however its IPv6 address is written.
  • restore and rekey flush what they write.
  • A token or code just shown leaves the page when Settings closes.
  • The code chip works from the keyboard and keeps its label.
  • Console settings and the audit log are reported when they cannot be decrypted at startup.

🔒 Security

  • Data files stored without encryption are no longer read.
  • Wrong current passwords count across an IPv6 /64.

📚 Documentation

  • docs/PHASE2_ARCHITECTURE_REPORT.md §16 records the post-public review
  • Tests no longer use real-format phone numbers.
  • What a group in TELEGRAM_CHAT_IDS may do.
  • The fix for a file stored without encryption works as written.

🧰 Maintenance

  • The image states its licence.

Full Changelog: v1.7.4...v1.7.5

Details of every change: CHANGELOG.md · Documentation: fengsui.iocky.com · Container image: ghcr.io/cky008/cpe-dash:1.7.5

Assets 2
Loading