Skip to content

Webox v0.1.0-rc1 — release candidate

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dilitS dilitS released this 25 May 03:10
· 57 commits to main since this release
v0.1.0-rc1
56db86a

Webox v0.1.0-rc1 — Release notes

Tag: v0.1.0-rc1 · published 2026-05-25 as a GitHub pre-release.
Type: Release candidate — operator-only manual checklist still pending before GA.

Promote this commit to v0.1.0 (GA) by re-tagging the same SHA after the manual checklist in .cursor/skills/release-check/SKILL.md is fully ticked. No code changes expected between RC1 and GA.

Highlights

Webox v0.1 is the first publicly distributed cut of a terminal operator cockpit for developers running projects on shared hosting. After 14 sprints of docs-first design, hardening, and adapter-pattern work, plus a launch-readiness Sprint 15, the codebase is ready for community review.

  • One verified hosting provider — small.pl / Devil — implemented end-to-end behind the providers.HostingProvider interface. Adapters for cPanel, DirectAdmin, and CyberPanel are scaffolded by webox provider new <name> --preset=<…> and slated for v0.2 / v0.3.
  • Bento Ultra cockpit (120×35) with live tiles: project list + detail, CI/CD pipeline modal, server topology, live log stream, header server metrics. Standard Cockpit (100×30) auto-fallback for smaller terminals.
  • Transactional project wizard — subdomain → database → SSL → GitHub repo + workflow → first deploy, with LIFO rollback on any failure (no orphaned resources).
  • Secrets done right — system keyring (Keychain / Secret Service / Credential Manager) with AES-256-GCM + Argon2id fallback for headless boxes. Zero plaintext secrets in config.json. Ever. AES-GCM nonce sourced strictly from crypto/rand.Read(12 bytes) — no time.Now(), no counters.
  • Strict SSH posture — TOFU on first connect, strict block on host-key mismatch with an explicit out-of-band confirmation modal, never auto-accept.
  • Zero telemetry / phone-home. --debug-trace writes JSONL strictly to ~/.cache/webox/trace.jsonl (mode 0600, redactor-filtered). The file never leaves the operator's machine.
  • webox provider new <name> [--preset=PRESET] — adapter scaffolding generator with 4 presets (blank, cpanel-uapi, directadmin, cyberpanel). Generates a working go build-clean skeleton + TDD test stubs + fixture README in 30 seconds, and patches the production blank-import block idempotently.

Quality bars met

Gate Status Threshold
Tests passing (make test -race) ✅ green All packages
Coverage (make cover-check) ✅ 80.4 % ≥ 70 % global
Lint (golangci-lint v2) ✅ 0 issues 0 issues
Vulnerability scan (govulncheck) ✅ clean 0 known CVEs
Bento render perf (make bench-check) ✅ 195 666 ns/op (worst) ≤ 5 000 000 ns/op
CI bundle (make ci) ✅ green Full pipeline
Coverage of TUI surfaces ✅ 100 % (per package)
Generated package builds ✅ verified end-to-end (go build ./providers/<gen>/...) n/a
Generated package tests pass ✅ verified n/a

Documentation

  • README.md — 136-line conversion-optimised launch landing.
  • CONTRIBUTING.md — 143-line EN on-ramp (5-min setup → branching → PR checklist → 3 contribution paths → guardrails → maintainer SLA).
  • docs/contributing/PROVIDER.md — 4-hour walkthrough for adding a hosting-panel adapter.
  • docs/SECURITY.md — full threat model, secret-handling policy.
  • docs/DESIGN.md — architecture, contracts, state machine, caching, rollback.
  • docs/ROADMAP.md — v0.1 → v0.2 → v0.3 → v1.0 plan.

Known limitations

  • One verified provider only. Adapters for cPanel, DirectAdmin, CyberPanel are scaffolded (webox provider new …) but not implemented. v0.2 ships cPanel; v0.3 ships DirectAdmin. See .github/issue-drafts/ for community on-ramps.
  • Asciinema demo + static dashboard.png not yet recorded. Scripts are in scripts/record-demo.sh and scripts/capture-screenshot.sh. Operator records the canonical artefacts before flipping to GA.
  • EN landing body still in PL. Head/meta layer is translated; body needs a native-speaker review pass. Landing is gitignored (decoupled deploy via Cloudflare Pages / Vercel), so this does not block the binary release.
  • --preset=PRESET requires the equals form. Space-separated --preset PRESET is not supported in v0.1 (parser consistency with --debug-trace=PATH). Help text + error messages reflect this; space-form support is a v0.2 candidate.
  • No Homebrew tap / go install published yet. v0.1.0-rc1 ships as a tagged source release only. Homebrew formula + GoReleaser binary publishing land with the GA promotion.

Upgrade notes

This is the first public release — there is nothing to upgrade from.

If you are migrating from a hand-written shell script:

  1. git clone https://github.com/dilitS/webox.git && cd webox && make build
  2. ./bin/webox --mock to explore the cockpit with synthetic data.
  3. ./bin/webox (without --mock) launches the init wizard for your first profile.
  4. ./bin/webox doctor validates your local setup any time.

Security

  • License: Apache License 2.0 (changed from MIT on 2026-05-25 — explicit patent grant for commercial-panel adapters).
  • Disclosure: see SECURITY.md — coordinated disclosure via private GitHub Security Advisories. Never open a public issue for a security finding.
  • Threat model: docs/SECURITY.md (STRIDE-light, 6 attacker profiles, 9 mitigations).

Credits

  • Charmbracelet — Bubble Tea, Lipgloss, Bubbles, the entire Charm ecosystem.
  • The small.pl / Devil team — for shipping a hosting platform with a real CLI in 2026 and for being a generous launch partner.
  • Go SSH and keyring maintainers — golang.org/x/crypto/ssh, zalando/go-keyring, and the long tail of well-licensed Go libraries.
  • Pre-implementation reviewers of the 619-line PRD monolith for catching design drift before a single line of production code shipped.

Next: v0.1.0 GA promotion

When the manual checklist is ticked (see .cursor/skills/release-check/SKILL.md):

git tag v0.1.0 v0.1.0-rc1            # promote the same commit
git push origin v0.1.0               # triggers release.yml workflow

Or use the helper:

make release-promote FROM=v0.1.0-rc1 TO=v0.1.0   # (future Sprint 16 target)

The GA promotion adds: cosign signature, SLSA provenance, GoReleaser-built multi-arch binaries (darwin/arm64, darwin/amd64, linux/amd64, linux/arm64), Homebrew tap PR, and the v0.1.0 retrospective.

Assets 2
Loading