v0.9.0

Highlights

• Design content type (#96). A flat with type: "design" is a canvas of plain-HTML artboards: screens, landing pages, posters, diagrams and click-through prototypes. People and agents edit it live. People can move artboards, change text and adjust declared tweaks in place, and changes reach the URL at once.
  • Every change is kept as a whole-canvas revision with content-addressed storage. Revisions can be listed, pinned and rolled back from the canvas or through MCP (list_revisions, get_revision, pin_revision, rollback_revision).
  • Agents write designs with save_design and read them with get_design. New guide topic topic.canvas.
• Saving a version and publishing it are separate approved steps (#95). Approving publish now creates a numbered version without putting it live. Publishing a saved version is its own approval: Publish vN in the console, deploy {version: N} through MCP, or flats deploy --flat <slug> --version N. The console calls version creation Save as vN.
• Security hardening (#76, #77, #81, #82, #85, #86, #87, #89, #90, #91, #92, #93, #98). Changes include bounded request bodies, upload lifetime, WebSocket connections and outbound memory, and tar.gz decompression. Server flats now get enforced SQLite disk and FILES object quotas. Other fixes: secret redaction before log truncation, a fix for symlink-swap disclosure in the directory packer, and inert docs bundle assets. Flat storage operations that were interrupted are recovered, and NetBird refuses cleartext management URLs.
• Product specs (#94). docs/spec/ now holds the product specs, including the content data models (Version and Revision).

Upgrade notes

• Back up the data directory before upgrading. The metadata database migrates to schema 11 (content revisions). An older Flats refuses a database written by this release, so a downgrade needs that backup.
• Approving a publish no longer makes content live. Scripts and agents that expected one approval to publish a website or page must now also request the deployment of the new version. This includes flats deploy <dir>, which now only requests a new version. A publish approval that was still pending at upgrade time also only creates a version when approved.
• A version that was never deployed does not make its flat Published, and retention never prunes it. Making a flat Public requires a live version.
• New host settings system.revision_quota (default 100) and system.pin_quota (default 20) apply to design revisions; 0 means unlimited. Documents do not have revisions yet.
• host.data_dir is now normalized to its clean absolute form when loaded. Existing absolute paths keep working.
• New request-body, WebSocket and storage limits can refuse workloads that used to exceed them. See topic.server.limits.
• The guide changed. Connected agents see refresh_required from check_client and should reread the guide.

What's Changed

• docs: polish README layout and onboarding by @oesni in #73
• security(netbird): reject cleartext management URLs during enrollment by @metaphorica in #76
• fix(bundle): bound tar.gz decompression and ignored entries by @metaphorica in #86
• fix: prevent directory packer symlink-swap file disclosure by @metaphorica in #87
• fix(runtime): prevent long secrets leaking through log truncation by @metaphorica in #81
• fix(runtime): bound WebSocket connections and outbound memory by @metaphorica in #85
• fix(runtime): enforce SQLite disk and FILES object quotas by @metaphorica in #90
• fix: quiesce path-bound workers before renaming flat storage by @metaphorica in #89
• docs: add the content data models spec and a spec index by @oesni in #94
• fix(runtime): bound request admission and body-read lifetime by @metaphorica in #91
• security: prevent docs bundle assets from executing on the docs origin by @metaphorica in #77
• feat(lifecycle): split version creation from deployment by @oesni in #95
• security: recover interrupted flat storage lifecycle operations by @metaphorica in #93
• fix(config): clean host.data_dir so paths under it are traversal-free by @oesni in #98
• feat: add the design content type, a canvas of HTML artboards with revisions by @oesni in #96
• fix(console): warn that a flat becomes public instead of saying it already is by @oesni in #97
• fix(portal): keep failed teardown tracked until confirmed by @metaphorica in #82
• fix(docs): rate-limit remote re-renders of the rendered document view by @metaphorica in #92
• docs: update README for designs and the split save/publish lifecycle by @oesni in #99

New Contributors

• @metaphorica made their first contribution in #76

Full Changelog: v0.8.0...v0.9.0