Crow 0.8.2

Crow 0.8.2: Crow in your language, and the fixes from testing every workflow against real servers.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open). Language packs: es.ftl (Spanish) and ja.ftl (Japanese), attached below.

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.8.2

Languages

• Settings → Personalisation → Language. Crow is in English, and can be in any language someone writes a pack for. Drop a pack (es.ftl, ja.ftl) into ~/.config/crow/languages/, click RELOAD, pick it. Crow switches at once.
• Spanish and Japanese packs are complete. Japanese uses your system's CJK font, or one the pack names.
• Make your own: EXPORT ENGLISH TEMPLATE writes every message to translate; crow --check-language xx.ftl --missing shows what's left. Anything a pack lacks shows in English. How to write a pack.
• A pack can't change what Crow does. Every message must keep English's placeholders and may not carry direction-override characters, or it shows in English. Danger prompts also show the English under a translation. Commands, config files and typed keywords (ROTATE, CONFIRM) stay as they are, and exported reports are written in English.

Fixes

• Bastions: moving a server between direct and through-a-bastion takes effect at once; it used to keep the old route for up to 10 minutes. A bastion that servers still go through can't be archived.
• Rollouts: creating a file in a folder that doesn't exist creates the folder, and rolling back removes it again.
• Hardening: a disabled ufw (or any input chain that filters nothing) no longer counts as a firewall. "Fix everywhere · no-firewall" leaves out servers with no firewall tool to turn on, instead of stopping at them.
• Keys: rotating the same key twice in a day works.

Crow 0.8.1

Crow 0.8.1: polish. A clearer sshd_config editor, a Files screen you can actually read files in, Settings that fit a small window, and a new About box.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.8.1

sshd_config

• Security posture at the top: only the risky directives, worst first, each with what its value means and a one-click fix. Password login goes through the guarded flow. Root login goes to prohibit-password when Crow logs in as root, never no, so Crow can't lock itself out.
• Rows read like a settings page: name, risk and line; what the directive does; the control; what the chosen value means. No fixed columns, so it works in a narrow pane.

Files

• View a file: click it to open it beside the listing, read-only, highlighted, with line numbers.
• Permissions: coloured like ls in a modern terminal. Click them to change read/write/execute and the special bits; Crow runs chmod (as root when needed) and records it in the audit log.
• Edit in terminal: opens the file in nano (or vim, or vi) in a new terminal tab, through sudoedit when your login can't write it.
• Paths no longer show as //etc/....

Settings

• Rows, cards and headers fit a narrow window: General, Connection & SSH, Servers & Archives, Clankers and Keys & Rotation.
• Start maximized (Personalisation).

Elsewhere

• About box: wider and shorter, with the app icon, the build, and links to the website, the source and the community forum.
• Menu: Enroll New Server is second and no longer animated. The audit log moved to a Fleet Setup tab.
• Acknowledgements: every project Crow builds on, by kind, in ACKNOWLEDGEMENTS.md. JetBrains Mono's license now ships with the font.

Crow 0.8.0

Crow 0.8.0: security fixes you can apply, people and certificates across the fleet, checks, incidents, disaster recovery, and team roles. Every new page is a tab in Fleet Setup.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.8.0

Hardening

Fleet Setup → HARDENING.

• Each finding comes with a fix: root login over SSH, password login, no firewall.
• Fixes are guarded: Crow checks that a fresh login still works, validates the config with sshd -t, and keeps an undo.
• Accept a risk on purpose. It stops counting against the server, and stays listed as accepted.
• EXPORT writes a posture report (Markdown).

Certificates

Fleet Setup → CERTIFICATES.

• Every certbot certificate on the fleet, with its expiry date.
• Broken auto-renewal is flagged: no timer, or a failed last run. It raises an alert.
• RENEW runs a dry run first, then renews, then checks and reloads nginx or Apache.

People

Fleet Setup → PEOPLE.

• Who has access where: accounts and SSH keys, one matrix for the whole fleet.
• Offboarding: revokes the person's keys first, then locks or deletes their accounts, on every server at once.
• Onboarding: an account and a key on a group's servers.
• Crow's own user and key, and root, are never touched.

Log search

Fleet Setup → LOG SEARCH.

• Search the journal of every server in a group at once, merged into one timeline.
• Saved searches can alert when they match.

Checks

Fleet Setup → CHECKS.

• HTTP, TCP and DNS checks, run from Crow, so from outside the server.
• Uptime per check.
• After 2 failures in a row, a check raises a critical alert. Email mails it.

Incidents

Fleet Setup → INCIDENTS: one timeline for a time window. It shows alerts, changes made by Crow, and journal errors from the servers involved. Export it as Markdown.

Disaster recovery

Fleet Setup → DR PLANS.

• A plan holds: what matters on a server, where its backups go, the RTO and RPO, and a runbook.
• CHECK AGAINST THE SERVERS:
  • backups are newer than the RPO;
  • their timer runs;
  • the paths exist;
  • the config files have baselines;
  • snapshots are available.
• Drills: run one and Crow times it against the RTO.
• EXPORT the plan, to keep a copy you can read while Crow is down.

Team

Fleet Setup → TEAM. This is local team mode: members live in this machine's vault. Syncing them between machines comes with Crow accounts.

• Members, roles and scopes:
  • Roles: Viewer, Operator, Admin, or a custom set of permissions.
  • A scope limits a member to some groups or environments.
• Signing in: with a team, Crow asks who's at the keyboard when it starts. Each member signs in with their own passphrase.
• Roles are enforced on every action that changes a server, and on keys and settings. Fleet runs skip servers outside the member's scope.
• Signed changes: each change record carries the member's name, shown in the audit log.
• Optional: fleet runs need a second member's passphrase.

Crow 0.7.0

Crow 0.7.0: patching, rollouts and drift you can act on. All three are in Fleet Setup, and all three run on the fleet runner: you see the plan, type a word to start it, it reaches one server (or one batch) at a time, the first failure stops it, and each server gets a change record.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.7.0

Patching

Fleet Setup → PATCHING.

• Who's behind: each server's pending security updates, all pending updates, a pending kernel, and whether it needs a reboot. Crow re-reads this every 6 hours while it runs, or on REFRESH.
• Apply updates:
  • Security or all updates, to every server or one group.
  • The plan lists the exact packages per server, and only those are upgraded (apt, dnf, apk).
  • Optionally, reboot the servers that need it afterwards.
• Maintenance windows per group: for example Sun 02-05 or Mon-Fri 22-06. A run leaves out servers outside their window, unreachable ones, and the machine Crow runs on, and says why.
• Orderly reboots, here and in the Danger Zone's rolling reboot:
  • Servers behind a bastion reboot before the bastion.
  • After each reboot, Crow waits for systemd to settle, and stops if a service fails that wasn't failing before.
• A server's Updates card gets APPLY SECURITY and APPLY ALL buttons.
• Alpine: if the package index was never downloaded, Crow says "pending updates unknown" instead of showing 0.

Rollouts

Fleet Setup → ROLLOUTS: one command, or one config file, across a group.

• What a config file can start from: what you type, a server's own copy, or a pinned baseline.
• Before anything runs, each server's copy gets its own diff. Servers that are already identical are left out.
• A canary goes first, alone. The run then pauses: CONTINUE WITH THE REST, or STOP HERE.
• The rest run in batches of 1, 2, 5 or 10, side by side. The first failure stops the run and shows that server's output.
• Config files are checked on each server by the format's own validator (sshd -t, nginx -t, visudo, fstab) and kept in config history.
• ROLL BACK on the finished run puts every file back exactly as it was, and removes files the rollout created.

Drift and config search

Fleet Setup → DRIFT & SEARCH.

• Drift is checked: every 15 minutes, Crow re-reads every server's baselined files.
  • A drifted file raises an alert, which Email mails like any other.
  • The alert clears once the file matches the baseline again.
• For each drifted file: see the diff, then BRING BACK one server or BRING ALL BACK, or ACCEPT THIS VERSION as the new baseline.
• Search every server's configs for a file name or a setting, without connecting to any server. A hit opens that file on its server. The palette (Ctrl/⌘K) finds other servers' config files too.

Crow 0.6.0

Crow 0.6.0: bastions you designate, and an Add Server that's three steps instead of five.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.6.0

Bastions

You can now reach a server that's only reachable through another one.

1. Open the bastion's server page and switch on bastion in its header.
2. In Add Server, pick via for the servers behind it.

From then on, everything Crow does on those servers goes through the bastion: commands, files, the terminal, metrics, the first password login.

• Each hop logs in with its own identity: the bastion's user, port, key and pinned host key. Before, ssh's -J dropped Crow's options on the jump connection and fell back to whatever ~/.ssh/config said.
• Bastions can sit behind bastions. A loop, a bastion that's been removed, or a bastion that logs in with a password is refused, and the error names it.
• Errors say which hop failed:
  • "bastion edge refused Crow's key"
  • "bastion edge can't reach 10.0.0.5: No route to host"
  • or the server's own host-key or login problem
• Bastion rules:
  • A bastion can't be switched off while servers still go through it.
  • Servers already set up with a jump host count as bastions automatically.
  • The Fleet table shows "via ".

Add Server, rebuilt

The wizard had five steps (two of them nearly empty), a side panel full of empty warnings, and demo values filled in. It also showed a made-up SSH banner. It's now three steps, and it only shows what it has actually read:

1. Connect:
   • Address, port and user on one row.
   • How to reach the server: directly, or through a bastion. A chain shows as a → b.
   • How to log in: a key in Crow, a password once (Crow installs its own key and forgets the password), or your SSH agent.
2. Verify:
   • The probe, through the bastion if there is one.
   • The host key to compare and trust.
   • A login, and what it read: distro, kernel, memory, disk, firewall, open ports, config tools.
3. Name: the name (defaults to the address), environment, group, tags, and the Bastion switch.

Crow 0.5.0

Crow 0.5.0: plugins you switch on, email alerts, and the containers on your servers.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.5.0

Plugins

Settings → Plugins lists every integration Crow has. Each one does nothing until you switch it on.

• What a plugin adds when it's on: its buttons, pages and actions. Multipass adds LAUNCH VM, lab containers add the lab, a cloud provider adds import, power and snapshots.
• What it costs when it's off: nothing. It isn't probed or shown.
• Status: each card says whether the plugin works on this machine. If it doesn't, it gives the command that fixes it. Example: Docker installed, but you're not in the docker group.
• Upgrading keeps on whatever you were already using.

Email alerts

Settings → Plugins → Email. Alerts reach you through your own SMTP server.

• When mail goes out:
  • A critical alert is mailed at once.
  • Warnings go into one digest, hourly by default.
  • A resolved alert sends nothing.
  • Each level can be at once, digest or never.
  • Quiet hours hold digests but never critical mail.
• The connection: TLS, STARTTLS, or none for a relay on your own network. The password is stored encrypted in the vault.
• SEND TEST checks the setup. Errors say what's wrong: the wrong TLS mode, a refused connection, an untrusted certificate.
• No mail is lost: a failed send is retried every 5 minutes. Alerts already open when you switch it on aren't mailed.
• Crow has no agent: mail only goes out while Crow is running.

Containers on your servers

Settings → Plugins → Containers on servers. Each server gets a Containers page.

• What it reads: Docker and Podman, over SSH. That covers Docker through the docker group or passwordless sudo, rootless Podman, and root Podman.
  • Per container: state, health, restarts and published ports. A port open to every network is flagged.
  • Compose stacks, from their labels.
• Stacks: UP, RESTART and DOWN.
• Containers: START, STOP and RESTART.
• Every action asks first, then leaves a change record.
• Logs follow live. Inspect hides environment values, since that's where passwords live.
• The wand explains a container in plain words and rates how risky stopping it is. Only its image, compose service, state and ports are sent.
• The fleet map shows each server's containers. These count as risks: ports published to every network, failing health checks, error exits and restart loops.
• When Docker can't be used, Crow says why and gives the fix: the login user can't reach it, or its daemon is down.

Also

• Distro logos in the server header, and a new OS column in the Fleet table.
• The Sockets page:
  • Its log drawer can be resized.
  • Column names stay in place as you scroll.
  • PIDs fit on one line.
  • Firewall tags are quieter.

Crow 0.4.0

Crow 0.4.0: local VMs with Multipass, a map of your fleet and what puts it at risk, a command palette that really searches, and AI help with a backup provider.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.4.0

Local VMs with Multipass

Fleet → LOCAL LAB & VMS → Multipass:

• Launch a VM (CPU, memory, disk, Ubuntu release). The window closes and the status bar follows it live: the image download, booting, then Crow's own steps. When it's ready, Crow opens it as a server.
• Each VM gets Crow's key through cloud-init. Its host keys are read through Multipass and pinned, not trusted on first use.
• Import VMs you made yourself: Crow adds its key and enrolls them.
• Start, stop, suspend and restart from the lab or the server's header. Deleting a VM takes a second click, and its fleet entry is archived.
• Crow checks the setup and gives the exact fix to copy: installing the snap, and on Fedora Atomic / Bazzite the nobody user the snap can't see and firewalld blocking the VMs' network.

The fleet map

Fleet Setup & Policies → FLEET MAP: Crow, your keys, the servers it reaches directly and through jump hosts, Multipass VMs and lab containers.

• Risks come only from what Crow has actually read:
  • open alerts, unpinned host keys, password logins;
  • jump hosts several servers depend on;
  • keys past 90 days, DSA keys, RSA under 3072 bits;
  • a read-only posture check: root SSH login, password login, the active firewall, ports open to every network.
• Without root, a posture field reads as unknown, never as safe.
• Drag to pan, scroll to zoom, filter by env or AT RISK ONLY. Click a node for its risks (and where each comes from), its facts and its links.

Command palette (Ctrl/⌘K)

The palette was a mock-up. It now searches as you type, fuzzy and ranked, with the matched letters picked out:

• What it finds: servers (by name, address, env, group, tags, status, provider), every page, the open server's config files, services and processes, actions and keys.
• Tab narrows the search to one server; Backspace backs out. ↑/↓, Enter, Esc. Recently used entries come first.

AI help (Clankers)

• Primary and backup providers: if the primary fails, the backup answers and says why.
• TEST KEY lists your models: it costs nothing and checks the model you picked is offered. LOAD MODELS lets you pick from that list.
• Usage is counted per day, so the 30-day figures are real.
• The wand in a server's Services drawer explains a service in plain words, rated LOW to CRITICAL for stopping or restarting it. Only the unit's name, description and state, and the distro are sent.

Fixes

• The provider cards' buttons (Edit Key and others) only worked on the last card.
• The sockets table's endpoint columns now fit long addresses.
• Cron is a table, and its side panel shows the crontab (it showed another file).
• The config filter fits its bar.
• The header buttons line up.
• The security badge says what's missing (2FA).
• Provider import moved to Settings → Providers.

Crow 0.3.0

Crow 0.3.0: a security release, plus more of the config files ops people edit, and verifiable downloads.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier (SLSA Build Level 3 provenance), or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.3.0

Security

A full audit of everything Crow does on a server as root. Update if you manage servers where other people have accounts.

• authorized_keys are edited as their owner, never as root, so a user's own ~/.ssh can't redirect Crow's writes elsewhere.
• Config saves as root refuse a folder another account can change (for example a pg_hba.conf inside postgres's data directory), and say why. Linked files, such as nginx's sites-enabled, are saved through to the file they point at instead of being replaced.
• Host key rotation always puts the old keys back when the new ones fail sshd -t or the reload, and reloads sshd on systemd, OpenRC and SysV alike.
• Lock-out guards: Crow won't delete the account it logs in as, or revoke its own key; the firewall's lock-out check covers a rule with no port; nginx saves keep the old file when nginx -t was already failing and the change makes it worse.
• A user can no longer hide everyone's keys from the Users page, or the running-packages list from the Updates view.
• SSH connection sockets live in a private folder per user. New private keys are created readable only by you. Key file names can't leave the keys folder. Local temp files have random names.

Config editors

• Add keys from a section's heading: a + on each systemd section ([Service]), INI section ([mysqld]), fail2ban jail and nginx block (server, location) adds a line at the end of that section, with the keys that section usually takes, what each does, and a starting value.
• fail2ban (jail.local, jail.d/*): values on several lines (logpath, ignoreip) are kept as written; checked with fail2ban-client -t before saving.
• chrony (chrony.conf, checked with chronyd -p) and ntp (ntp.conf).
• resolv.conf, with a warning when systemd-resolved, NetworkManager or resolvconf rewrites the file.

Interface

• One small icon button for row and close actions everywhere: delete appears on hover, in red.

Releases

• Every release carries its binaries, SHA256SUMS and SLSA provenance, attached by the release workflow itself.

Crow 0.2.0

Crow 0.2.0: from one real server to a real fleet. A terminal per server, fleet-wide actions that are all real, firewalls beyond ufw, and structured, validated editors for the config files ops people touch most.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open). The SLSA provenance file didn't generate for this release; that's being fixed.

Everything in 0.2.0-beta.1 (config history, baselines and drift, the fleet runner, metrics history and alerts, the audit log) is here too. New since the beta:

Terminal

• A real terminal for every server, built on alacritty_terminal and running over the server's own connection (Crow's SSH options, key and jump host; exec into lab containers). The audit log records each session opening and closing, never what was typed.
• Tabs and split panes, kept while you move around the app. Rename tabs, follow the program's title, see the bell.
• Select and copy (drag, double-click a word, triple-click a line; Ctrl+Shift+C / ⌘C), paste with bracketed paste, Shift+PgUp/PgDn through the history, and mouse support for programs that ask for it (htop, vim, tmux, mc).
• Font size, a blinking cursor, clickable links. The Fleet's row button opens a server's terminal.

Config editors

Structured editors for more files, each lossless (comments and formatting survive) and checked on the server before it's written:

• sysctl (sysctl.conf, sysctl.d): shows where the running kernel differs from the file; well-known keys explain themselves, with switches and pickers.
• sudoers (/etc/sudoers, sudoers.d): read as root; saved through visudo and a guard that puts the old file back if your login would lose sudo.
• fstab: refuses dropping /, /boot or /var, and changes that add findmnt --verify errors; flags mounts that can stop a boot.
• logrotate, systemd units, drop-ins and settings files (systemd-analyze verify), nginx (installed, tested with nginx -t, rolled back if it fails), MySQL/MariaDB *.cnf and Samba smb.conf (testparm).
• sshd follows Include, shows the value sshd really uses, and edits Match blocks.

Fleet

• Server groups: create them, move servers between them, filter and group the Fleet by them.
• Rotate SSH host keys across the fleet and re-pin them; revoke all sessions while keeping Crow's own; a host key rotation policy that warns when a key is overdue.
• Certificates about to expire: Let's Encrypt and the files nginx/Apache point at, read every 6 hours; WARN at 14 days, CRIT at 3.
• GeoIP regions for servers without cloud metadata (looked up on your machine, opt-in).

Firewall

• Edit firewalld (runtime and permanent together), with a lock-out guard for ufw and firewalld: a change that would cut off Crow's SSH port asks you to type CONFIRM.
• Read bare nftables and iptables rulesets.
• The Firewall page is rebuilt in the app's table style, with a working search and add-rule form.

Access and connections

• Connection recovery: when a server can't be reached, Crow says why and offers the fix (trust a changed host key after you type its name, install Crow's key, retry).
• Switch servers to a key and rotate keys from the Keys screen; the jump host shows in the server header.
• Approving SSH agents (1Password, Secretive) are kept out of key-file logins, so they no longer prompt or stall Crow.
• Update notice: Crow checks for a newer release once a day and says so in the status bar; installing it is opt-in and verified.

Interface

• Each server tab remembers which page it was on.
• The Danger Zone is its own page (last in the sidebar; a tab on the Fleet), and a status bar shows open alerts, notices and the version.
• A calmer server header: the facts as one line, the distro and kernel read when they weren't known yet, and SNAPSHOT / RECONNECT buttons that work.
• Reverse DNS names for remote peers on the Sockets connection map.

Crow 0.2.0-beta.1

Pre-release of Crow 0.2.0: from one real server to a watched fleet. The 0.2.0 milestone still has open work (more config plugins, onboarding flows, firewalld editing).

Binaries: Linux x86_64 and macOS (Apple Silicon), with SLSA Level 3 provenance (*.intoto.jsonl). Verify with slsa-verifier.

New

• Config history that survives restarts. Every version of a file Crow wrote or found on a server, encrypted with the vault's key (config files can hold credentials). Changes made outside Crow are noticed and recorded. Preview what restoring a version changes before you do it.
• Baselines and drift. Pin a known-good file for a server group or the whole fleet. Drift is by meaning where Crow has a plugin (a reworded comment isn't drift, a changed value is). The fleet shows how many files drifted, on how many servers.
• Fleet runner. Fleet-wide actions run one server at a time, stop at the first failure, and can be stopped after the current host. They start only after you type a keyword.
  • Push baseline to all: re-reads each file live, checks it with the host's validator, writes it atomically, records it.
  • Rolling reboot: via the provider, the lab engine, or SSH; waits for each server to come back from a fresh boot before the next.
• Metrics history and alerts. Every server sampled once a minute while Crow is open, kept for a week. Alerts for unreachable servers, full disks (90% / 95%) and failed services; they resolve on their own and can be acknowledged. A History view charts CPU, memory, disk and load over 24 hours or 7 days, with gaps where Crow wasn't running.
• Audit log. Every change on every server, filterable by server and kind.
• firewalld, read-only. Zones, services (with their ports), ports and rich rules on RHEL, Fedora and Rocky hosts; warns when the running config differs from the saved one.
• Real host key age, read from each server's key files.

Fixed

• Fleet health comes from the live connection: unreachable servers no longer show a green OK with made-up zero readings, and vCPUs aren't counted twice.
• Disk use matches df (used ÷ used + available); a full ext4 disk used to read ~95%. Read-only roots (Fedora Atomic, Bazzite, CoreOS) are measured at /var.
• Fleet screens no longer claim things Crow doesn't do (fake "queued" fleet actions, made-up drift and key ages).
• Socket ↔ firewall matching: firewalld hosts aren't reported as "firewall off"; ufw multiport rules match.
• Restoring a config version no longer leaves it showing as an unsaved edit; revisions carry your user@host, not a fixed name.

Heads-up

• On first launch Crow creates its encryption key in the OS keyring (to encrypt config history) without asking for a security stance; storing provider tokens and AI keys still asks. See docs/security.md.