0.3.0

0.3.0: UI updates

0.2.7

• Install Antigravity 1.1.11 from version-addressed GitHub release artifacts and verify repository-pinned SHA-512 checksums for both supported Linux architectures, instead of trusting the moving latest manifest.
• Follow the renamed futrx-com/remote.futrx repository throughout bootstrap and application setup so fresh public installations no longer prompt for GitHub credentials through the obsolete repository URL.
• Add explicit QA install and update commands, including immutable branch-candidate installs, while removing the obsolete automatic production deploy workflow and unnecessary local deployment preflights.
• Render workspace routing guidance without leaking an unresolved project-slug placeholder and document the concrete dev-host allowlist suffix.

0.2.6

• Docker sets the host's iptables FORWARD policy to DROP and accepts only its
  own bridges, so LXD containers lose IPv4 entirely. It never touches
  ip6tables, so containers still reach anything with an AAAA record: apt,
  NodeSource, npm and Google's CDN all succeed and the build dies four stages
  in on github.com, the first IPv4-only host it needs, as a bare connection
  timeout. Every host with Docker installed hits this, including every
  Hostinger VPS, whose management agent runs under Docker.
• infra/lib/container-forwarding.sh detects a restricted FORWARD chain and
  idempotently allows the LXD bridge through DOCKER-USER — the chain Docker
  documents as user-owned and evaluates first — falling back to FORWARD when
  Docker is absent. Docker's isolation of its own bridges is untouched.
• The same library is the ExecStart of futrx-lxd-forward.service, so the rules
  are defined once and re-applied on every boot: iptables state is not
  persistent and Docker reinstates its policy on each start. The unit is
  installed unconditionally and self-gates, so a host that later installs
  Docker is covered too.
• The base-image build now probes IPv4 egress from the builder before running
  any stage and fails immediately naming the cause and the fix, instead of
  spending nine minutes to report a misleading GitHub timeout.
• Hermetic coverage in infra/tests/container-forwarding-test.sh (wired into
  CI) and a builder test asserting the build stops before any install stage.

0.2.5

• The installer's DNS check resolved through the local name service, which
  consults /etc/hosts first — and Ubuntu maps the machine's own FQDN to
  127.0.1.1. Any install whose hostname is also the server's hostname (a
  provider's default name such as srvNNNN.hstgr.cloud, or a box named after
  its domain) was rejected with "resolves to 127.0.1.1" despite public DNS
  being correct, leaving --skip-dns-check as the only way through.
• The check now resolves over DNS-over-HTTPS (Cloudflare, then Google). That
  is the right question to ask — what Let's Encrypt's resolvers see, not what
  this machine believes — and it stays dependency-free, since curl is already
  required while dig and host are absent from a minimal Ubuntu. It falls back
  to the local stack only when no public resolver answers, discarding loopback
  addresses that could only have come from /etc/hosts.
• Resolution moves to infra/lib/dns-resolve.sh with hermetic coverage in
  infra/tests/dns-resolve-test.sh, now part of the CI suite.

0.2.4.1

• Version tags now get proper GitHub Releases automatically
  (.github/workflows/release-on-tag.yml): notes come from the tag
  commit's changelog-style body, so the Releases page leads with the
  product, not plumbing. Vendor asset tags are excluded by pattern.
• The vendored Playwright assets release is created as a pre-release
  going forward (and the existing one was flagged as such): it stays
  downloadable but no longer occupies the Latest release slot.
• PW_VENDOR_REPO pin follows the repo rename to futrx-com/remote.futrx;
  the old slug only kept working through GitHub's redirect.

0.2.4

• Playwright/Chrome-for-Testing archives are republished as sha256-pinned
  GitHub release assets (.github/workflows/vendor-playwright.yml); the
  agent browser install falls back to them automatically when Google's
  CfT CDN geo-blocks a server's IP (403 "not available in your location"
  on some Hetzner/Scaleway ranges), serving them to Playwright from a
  loopback HTTP server so its own installer logic runs unchanged. See
  vendors/README.md.
• Every version pin now lives in one manifest, embedded by the backend
  (backend/internal/agent/provisioning/versions.env) and symlinked at
  infra/versions.env: agent CLIs, Node, Go, code-server, Playwright/CfT
  and the vendor sha256 pins. agent-cli-versions.env is merged into it;
  the code-server version and NodeSource major are substituted from the
  manifest instead of being hardcoded in scripts.
• Command-transcript truncation keeps the tail instead of the head
  (output.TruncateTail at every call site): install errors sit at the
  end of the output and were being cut away, twice hiding a build's real
  failure.
• The Playwright install step no longer masks its exit status behind a
  tail pipe; both download paths failing now reports a clear, actionable
  error instead of a bare exit status 2.
• Removed .github/workflows/installer.yml (zero runs ever; its hardcoded
  PUBLIC_HOSTNAME could flip the live domain as a side effect) and
  corrected CONTRIBUTING.md + deploy.yml docs: infra changes reach boxes
  via infra/update.sh or the in-app updater, both of which preserve each
  box's hostname.

Vendored Playwright assets (playwright@1.60.0)

Unmodified Playwright/Chrome-for-Testing archives (CfT 148.0.7778.96, ffmpeg 1011), republished as the install-time fallback for servers geo-blocked by Google's CDN. sha256 pins live in versions.env; provenance is this repo's 'Vendor Playwright assets' workflow. See vendors/README.md.