v0.10.0

Upgrade notes

Back up first. This release migrates both config.json (schema → 4) and flats.db (user_version → 15). Flats copies flats.db to <data>/backups/ before migrating, but downgrading to v0.9.x afterwards is not supported. Stop the service, copy the whole data directory (including config.json and secret.key), then run the installer. See Upgrading a host.

Refresh agent clients. The client contract changes to bootstrap revision 2 and the plugin to 0.4.0 (#112). After upgrading the host, run flats update on client machines, refresh the plugin or standalone skill (MCP guide topic topic.client-update), check with flats client check, and reconnect the MCP bridge.

• save_version is replaced by save_draft + create_version; creating a version and deploying it are separate approvals (deploy).
• save_version_from_dir becomes save_draft_from_dir.
• Whole docs bundles go through save_document with replace_bundle: true.
• Pending publish approvals made before the upgrade are refused; request a new create_version approval.

Version quota. system.keep_versions: N becomes system.version_quota: N (default 20). N now counts all retained versions, including the live one, and versions are no longer pruned automatically. Over-quota flats keep their versions, but new version creation is refused until you delete old versions or raise the quota. A deployed flat with quota 1 must raise its quota before creating a replacement.

Keys and console domains (#102):

• Tailscale auth key, NetBird setup key and zrok token are now stored in flats.db (encrypted with secret.key) and managed in Settings → Keys or with flats key set|rm|ls.
• credentials.tailscale_authkey_file is deprecated: the first start imports the key and removes the path. An unreadable file stops the start with status 78.
• host.console_host becomes the list tailscale.console_hosts. network.private_backend tailscale alone no longer puts the console on the tailnet.
• flats config init --console-host is removed.
• Containers: mount the key and set FLATS_TAILSCALE_AUTHKEY_FILE, or run flats key set once on the volume.

NetBird (#104): each flat now runs its own NetBird peer at http://<slug>.<NetBird domain>/, replacing the shared peer. The old shared peer's local state is removed at first start, and the Keys card names it so you can delete it in the NetBird dashboard. The recommended setup key is reusable + ephemeral + "Allow extra DNS labels" + an auto group. netbird.device_name is removed.

Documents (#101, #108): documents keep revisions with a History panel (view, diff, pin, restore). Existing flats_docs_conflicts records migrate into recovered revisions, and the conflict API and get_document {conflict} are removed. A single-document save now keeps the flat's other files.

What's Changed

• feat(docs): document revisions with a history panel by @oesni in #101
• feat: manage operator keys and console domains from the console and CLI by @oesni in #102
• feat: NetBird peers per flat and NetBird console domains by @oesni in #104
• fix: activate newly allowed public providers on public flats by @oesni in #106
• fix: preserve other files when saving a document by @oesni in #108
• fix(console): align analytics and quota labels with content models by @oesni in #109
• feat: complete explicit version lifecycle and retention by @oesni in #112
• chore(docs): remove committed polish screenshots by @oesni in #113
• fix(console): refresh approval feedback and clarify first-run guidance by @oesni in #111
• fix(console): clarify share access and link readiness by @oesni in #110

Full Changelog: v0.9.1...v0.10.0