v0.2.4

Mirror hides blobs maintenance removed (60-day B2 lifecycle); recovery kit flags fixed

Changelog

• 87cd41f Merge pull request #20 from hodyhq/fix/kit-secret-flag
• c3fd585 fix(kit): secret flags use --flag=value so a leading dash isn't a flag
• aadcd75 Merge pull request #19 from hodyhq/feat/mirror-hide-removed
• f60fe39 fix(fleet): atomic hide reservation; fail on unreadable guard settings
• c47fab9 feat(fleet): mirror hide guard limits are settings
• 8fb3908 test(fleet): skip the unreadable-dir mirror test on Windows
• ef7bb2f chore(fleet): lint fixes for mirror hides
• 1f7f19b fix(fleet): reserve hides in the 7-day window before deleting
• f93a77d fix(fleet): hide only on a versioned bucket; 7-day cumulative guard
• 7f22d3f feat(fleet): mirror hides blobs maintenance removed; 60-day B2 lifecycle

v0.2.3

WarpHold v0.2.3: the agent waits for the Fleet at startup, retired devices are hidden, install prints a PATH hint.

Changelog

• f8268bc Merge pull request #18 from hodyhq/fix/ops-findings-2026-10
• c37d6fd fix(install): make the PATH hint test portable to Windows
• cfaa179 fix(fleet): satisfy CI lint on the new code
• 01102da fix(agent): fail fast on a malformed repository config
• c9ebcbb Merge pull request #16 from hodyhq/fix/windows-flaky-tests
• 7feab3c fix(install): print the PATH hint from the install commands
• 059a378 Merge remote-tracking branch 'origin/master' into fix/windows-flaky-tests
• d011b70 Merge pull request #17 from hodyhq/chore/npm-audit-2026-10
• fb75151 fix(fleet): keep retired devices out of the list and out of group guards
• 8d49aac fix(agent): wait for the Fleet instead of exiting at startup
• 474ff67 fix(fleet): name the public-URL probe timeouts
• 35ce0b5 build(deps): npm audit fix (js-yaml, fast-uri)

v0.2.2

Changelog

• 86c6f0e Merge pull request #14 from hodyhq/chore/ui-v0.3.0
• a19fa29 Merge pull request #15 from hodyhq/chore/funding
• 9614c38 chore: sponsor button (GitHub Sponsors: hodyhq)
• 2933776 build: warphold-ui v0.3.0 (wizard, jobs/SMTP settings, kit banner, screenshots)
• acb18a1 Merge pull request #13 from hodyhq/fix/htmlui-e2e
• 0656d8f Gate HTMLUI E2E job: harness targets pre-Fleet UI

v0.2.1

Changelog

• f5d5782 Merge pull request #12 from hodyhq/plan3-ci
• cf6361d ci: address CodeRabbit PR review (hostedDir everywhere, exact empty, least-privilege token)
• 9353e19 Merge pull request #11 from hodyhq/fix/enroll-stops-app-engine
• 0894c9a ci: pin the Chrome version too, not just the setup-chrome action
• de7edc6 ci: fix Windows test failures in fleet/agent/cli packages
• 51f3db9 ci: fix wsl_v5 and other new golangci-lint findings in warphold packages
• c8c7250 ci: pin Chrome in the HTMLUI e2e workflow
• 3cd31b7 ci: skip upstream KopiaUI Electron e2e (not shipped by this fork)
• 1f36149 ci: bump golangci-lint to 2.13.2, fix exhaustruct config drift, scope CI lint to new-from-merge-base
• ff15a54 fix(install): enrolling replaces the standalone app service
• cd9575a Merge pull request #10 from hodyhq/plan3-readme

v0.2.0

Changelog

• 171ac28 Merge pull request #9 from hodyhq/plan3-prb
• 3535461 fix(build): pin a patched Go toolchain, fix rebrand-stale electron build glob
• 855c1d3 ci: green the pipeline (title scope, npm audit, x/crypto, racy fleet jobs test, rebrand title)
• 2e3e700 fix(jobs): an all-skipped sweep is skipped, not failed
• bf8cf3d fix(test): assert the activated field, not the whole status document
• a547579 fix(install): app.sh verifies the release signature like fleet.sh
• 207c3de fix(fleet): PR #9 review findings (round 2)
• d290ea0 fix(fleet): PR #9 review findings
• 92a98a5 fix(fleet): whole-branch CodeRabbit findings
• 7665069 fix(fleet): lock the state dir before any DB work; guard the last seal
• 1438fa0 fix(fleet): survive a passphrase rotation; enforce the locks the code claims
• d329ef1 merge: origin/master into plan3-prb
• bd9be62 fix(fleet): job cadences are writable, and a non-hosted kit cannot be "regenerated"
• 3679e4a merge: plan3-hosted into plan3-prb
• 2092653 Merge pull request #8 from hodyhq/plan3-hosted
• 7932662 merge: plan3-t31 into plan3-prb
• 7f270e7 build: warphold-ui v0.2.0 (offsite health, screenshot pipeline)
• 988e12a merge: plan3-crfix (whole-branch CodeRabbit findings) into plan3-hosted
• e439ed6 merge: plan3-t29 into plan3-prb
• aec2731 fix(fleet): read every X-Forwarded-For header line, fix test false-confidence
• 23bb02d fix(fleet): make DeleteAgent atomic, SetAgentBundle report ErrNotFound
• 4d27be3 merge: plan3-t15fix (B2 mirrors without conditional writes; PUT /targets/{id}/mirror) into plan3-hosted
• 111f82e fix(fleet): 501 needs the NotImplemented code; target lookup errors are not 404
• a736475 merge: plan3-t27 into plan3-prb
• 4ac875a merge: plan3-t26 into plan3-prb
• 9d4536d merge: plan3-t24 into plan3-prb
• 7001274 feat(fleet): attach or replace a mirror on an existing target
• 34f0c6d merge: plan3-t20 into plan3-prb
• edf2265 merge: plan3-groups (update/delete groups) into plan3-hosted
• 14e8eba merge: plan3-t9 follow-up (cloud-direct rollback tests) into plan3-hosted
• 1a6badd feat(fleet): let a mirror-only target sit on a provider without conditional writes
• e9a2217 fix(gateway): tell a 501 conditional-write refusal apart from a bucket that lies
• 590f9fc merge: plan3-installers into plan3-prb
• 142caaf fleet/jobs: repository stats and the weekly digest email
• 61e58f3 fix(fleet): group repoint check is atomic
• 6485a41 feat(fleet): update and delete groups
• a6fd85b fix(api): dedupe origin check duplicated by the plan3-t30 merge
• 359cea3 test(enroll): cloud-direct provisioning failure rolls back the device key
• fd111cf merge: fold plan3-t9 (stock-Kopia e2e matrix, cloud-direct enrollment) into plan3-hosted
• 55d36b4 merge: plan3-t30 (SMTP settings + test send) into plan3-t31
• 3a86bbb feat(enroll): provision a device onto a cloud-direct target
• 08edaa8 test(gateway): drive the append-only rules through the stock S3 client
• 5ecd1d8 test(jobs): pin the documented cadences and the seconds convention
• 2064eaf feat(jobs): register the runners, the jobs API and fleet jobs run
• 65ec36d merge: fold plan3-t14 (offsite health API) into plan3-hosted
• 2070c1b feat(jobs): reap revoked devices past their retention window
• 158c442 fix(seal): fail fast, not hang, when the pending-key refusal regresses
• 44d89c8 feat(jobs): fleet-side maintenance job
• f2002c1 feat(jobs): fleet-side test-restore job
• ed48ef9 feat(jobs): fleet-side verify job
• fafe325 agent: verify handle comment matches verify.go
• 955b80c merge: fold plan3-t12-fold (cloud-direct targets served through the gateway) into plan3-hosted
• bacb310 fix(fleet): fail loudly on unreadable offsite state instead of rendering green
• 4564006 merge: fold plan3-t13 (jobs scheduler + mirror, round 1) into plan3-hosted
• 0198149 feat(fleet): serve cloud-direct targets through the gateway
• 54a0f88 fix(agent): pin the index during verify; pin health behaviour in tests
• dc59123 fix(seal): never delete a pending key without proof it is dead
• a5d10fb fix(seal): refuse an offline rotation while the state dir is locked
• 1bd6d22 fix(jobs): requeue stale claims every tick, record cancellation, bound Stop, prefix mirror-open errors
• 93b33c8 merge: fold plan3-t12 (Object Lock verification, B2 lock read) into plan3-hosted
• a0d8da6 fix(kit): drop unreachable --disable-tls hosted command, print a TLS note instead
• 5cb03f8 merge: plan3-hosted (t11 + t5 round 2) into plan3-t8
• 9f37e29 ci: restore a hosted-target snapshot with a pinned upstream kopia binary
• 3e94a03 feat(fleet): offsite mirror state in targets, device detail and overview
• 27eb117 merge: fold plan3-t5 (S3 handler, round 2) into plan3-hosted
• 4011538 agent: execute the verify command and report it
• 95a0e1c fix(gateway): trusted-proxy client IP, exposed limiter config, allowlist and log residue
• b77814d fix(fleet): distinguish 'cannot verify' from 'unlocked' for B2; complete fold patch; tests
• 3d3bfd8 fleet: sealing-passphrase rotation with a dry run
• 6fc5d92 feat(fleet): mirror job (disk → S3-compatible bucket, never deletes)
• 0f78a4d fleet/kit: Referrer-Policy, SameSite assertion, revoked-device note
• ff14b88 fix(fleet): reap scheduling, enroll cleanup, age-gated temp sweep
• 7717c2b fix(fleet): recover panics in activation callbacks; print the enrollment token on its own line
• 2816c6b feat(fleet): jobs table accessors and scheduler skeleton
• 0806bb5 Merge pull request #7 from hodyhq/plan3-docs
• fcfecd5 fleet/kit: printable recovery kit with a read-only key, and its acknowledgement
• 75e645e fleet: verify Object Lock and conditional writes on mirror and cloud-direct buckets; real cloud arm
• f9c1f77 fix(scripts): non-interactive activation actually runs (no env on a shell function); test the branch
• 869f616 fix(app): scope-gated config tolerance, refuse --system for the app, honor persist policy
• ce4d102 scripts: TLS-only release fetches; fish PATH hint
• 09ace69 scripts: app.sh installs the standalone engine
• 1108457 feat(app): standalone app engine service (warphold app run/install/status/uninstall)
• 99ce1a1 fix(cli): CodeRabbit round — command_fleet_repo.go, per-row setup defaults, hosted-root check
• 4a5aa99 docs(spec): record the seventh upstream touch (server Options.DisableMaintenance)
• 56fddf5 fix(fleet/mail): settings never unseal the SMTP password on read; redaction tests
• 7d46beb feat(cli): SetupDefaults — first hosted target, template and group at activation
• 9a623fd fix(cli): absolute --data-dir, reload serves the host repo, reload in requireHost
• 0a6c1cb feat(fleet): revocation disables gateway keys and invalidates the cache
• 5014181 fix(gateway): validate credential prefix, 409 on existing key, MD5 assertion, host check, pre-auth limit
• 576501c feat(fleet): hosted provisioning — per-device repo, gateway keys, sealed bundle
• 6691164 feat(cli): fleet activate --public-url; setup creates the host's own repository
• dfb4428 Merge branch 'plan3-hosted' into plan3-t5
• 943a5ca fix(gateway): cloud-direct — require region, refuse plaintext, probe under the fleet root, Close
• 05e28d0 fleet/mail: SMTP settings with SMTP2GO defaults and a test send
• 3fc261b Merge branch 'plan3-hosted' into plan3-t8
• 7395e19 fix(release): import the signing key, scope permissions, packaging decisions
• 66e4a7d fix(fleet): logout checks origin before the CSRF token (no token oracle)
• cd2e244 fix(fleet): public_url — default-port normalization, probe logging, origin-first CSRF, login hardening
• 62aa50c feat(fleet): public_url setting and consumers; CSRF origin check
• a4cf27f feat(fleet): mount the device S3 gateway on the Fleet server
• 07c9970 feat(gateway): append-only S3 subset for devices
• 7303a33 docs(spec): packages never provision the server; bindir rule; no packaging-family detection
• 324c4fe fix(gateway): cloud-direct — conditional put (If-None-Match: *), capability probe, disk spool
• 8fe9584 Merge branch 'plan3-hosted' into plan3-t5
• 29d6dd2 fix(gateway): local backend hardening (symlinks, UTF-8, bounded list, size cap, ctx, ETag)
• 65aa992 feat(gateway): object store interface and local backend
• d847736 docs(spec): cloud-direct = S3-compatible endpoints with conditional put + probe (Task 11 review)
• 3d0e53c release: WarpHold deb/rpm packaging metadata and signed checksums
• a513b5d Merge branch 'plan3-hosted' into plan3-t5
• b5c09e2 fix(gateway): SigV4 — no region wildcard, real GetBucketLocation shape, reject unsigned x-amz-* headers
• d76a454 feat(gateway): SigV4 verification
• 17e7f6d fleet/gateway: cloud-direct write-through backend
• f711884 feat(fleet): public_url setting and consumers; CSRF origin check
• ea9ab75 docs(spec): gateway mounts at the bucket path /warphold/ (minio-go rejects path endpoints); MD5, unsigned x-amz headers, replay decisions
• 82cd7cd scripts: one-command app install
• e2d0744 scripts: one-command Fleet server install, with a container test and shellcheck
• 26fcf88 feat(fleet): hosted target kind (local storage; cloud-direct stubbed)
• d548206 Merge branch 'plan3-t3' into plan3-t5
• b21e949 Merge branch 'plan3-t2' into plan3-t5
• 93d0d31 feat(gateway): SigV4 verification
• 4f090ab feat(store): device keys, jobs table, additive migration
• 3eb16d0 feat(gateway): object store interface and local backend
• 0d30620 test(fleet): fixed mid-day clock in the overview test (midnight UTC flake)
• ac81d4e feat(store): device keys, jobs table, additive migration
• 38730f5 docs(spec): fold in the Task 1 spike result (allowlist, maintenance owner, S3 profile, no versioning)
• 4bf16b5 spike: record which blobs Kopia deletes or overwrites against an S3 store
• 1c93195 Merge pull request #6 from hodyhq/ui-v0.1.1
• c705fdd chore(ui): bump warphold-ui to v0.1.1 (responsive layout)
• 7c8cb2d Merge pull request #5 from hodyhq/fix-spa-public
• d552171 fix(ui-serve): cache header only on...