v0.2.0

Changelog

• 171ac28 Merge pull request #9 from hodyhq/plan3-prb
• 3535461 fix(build): pin a patched Go toolchain, fix rebrand-stale electron build glob
• 855c1d3 ci: green the pipeline (title scope, npm audit, x/crypto, racy fleet jobs test, rebrand title)
• 2e3e700 fix(jobs): an all-skipped sweep is skipped, not failed
• bf8cf3d fix(test): assert the activated field, not the whole status document
• a547579 fix(install): app.sh verifies the release signature like fleet.sh
• 207c3de fix(fleet): PR #9 review findings (round 2)
• d290ea0 fix(fleet): PR #9 review findings
• 92a98a5 fix(fleet): whole-branch CodeRabbit findings
• 7665069 fix(fleet): lock the state dir before any DB work; guard the last seal
• 1438fa0 fix(fleet): survive a passphrase rotation; enforce the locks the code claims
• d329ef1 merge: origin/master into plan3-prb
• bd9be62 fix(fleet): job cadences are writable, and a non-hosted kit cannot be "regenerated"
• 3679e4a merge: plan3-hosted into plan3-prb
• 2092653 Merge pull request #8 from hodyhq/plan3-hosted
• 7932662 merge: plan3-t31 into plan3-prb
• 7f270e7 build: warphold-ui v0.2.0 (offsite health, screenshot pipeline)
• 988e12a merge: plan3-crfix (whole-branch CodeRabbit findings) into plan3-hosted
• e439ed6 merge: plan3-t29 into plan3-prb
• aec2731 fix(fleet): read every X-Forwarded-For header line, fix test false-confidence
• 23bb02d fix(fleet): make DeleteAgent atomic, SetAgentBundle report ErrNotFound
• 4d27be3 merge: plan3-t15fix (B2 mirrors without conditional writes; PUT /targets/{id}/mirror) into plan3-hosted
• 111f82e fix(fleet): 501 needs the NotImplemented code; target lookup errors are not 404
• a736475 merge: plan3-t27 into plan3-prb
• 4ac875a merge: plan3-t26 into plan3-prb
• 9d4536d merge: plan3-t24 into plan3-prb
• 7001274 feat(fleet): attach or replace a mirror on an existing target
• 34f0c6d merge: plan3-t20 into plan3-prb
• edf2265 merge: plan3-groups (update/delete groups) into plan3-hosted
• 14e8eba merge: plan3-t9 follow-up (cloud-direct rollback tests) into plan3-hosted
• 1a6badd feat(fleet): let a mirror-only target sit on a provider without conditional writes
• e9a2217 fix(gateway): tell a 501 conditional-write refusal apart from a bucket that lies
• 590f9fc merge: plan3-installers into plan3-prb
• 142caaf fleet/jobs: repository stats and the weekly digest email
• 61e58f3 fix(fleet): group repoint check is atomic
• 6485a41 feat(fleet): update and delete groups
• a6fd85b fix(api): dedupe origin check duplicated by the plan3-t30 merge
• 359cea3 test(enroll): cloud-direct provisioning failure rolls back the device key
• fd111cf merge: fold plan3-t9 (stock-Kopia e2e matrix, cloud-direct enrollment) into plan3-hosted
• 55d36b4 merge: plan3-t30 (SMTP settings + test send) into plan3-t31
• 3a86bbb feat(enroll): provision a device onto a cloud-direct target
• 08edaa8 test(gateway): drive the append-only rules through the stock S3 client
• 5ecd1d8 test(jobs): pin the documented cadences and the seconds convention
• 2064eaf feat(jobs): register the runners, the jobs API and fleet jobs run
• 65ec36d merge: fold plan3-t14 (offsite health API) into plan3-hosted
• 2070c1b feat(jobs): reap revoked devices past their retention window
• 158c442 fix(seal): fail fast, not hang, when the pending-key refusal regresses
• 44d89c8 feat(jobs): fleet-side maintenance job
• f2002c1 feat(jobs): fleet-side test-restore job
• ed48ef9 feat(jobs): fleet-side verify job
• fafe325 agent: verify handle comment matches verify.go
• 955b80c merge: fold plan3-t12-fold (cloud-direct targets served through the gateway) into plan3-hosted
• bacb310 fix(fleet): fail loudly on unreadable offsite state instead of rendering green
• 4564006 merge: fold plan3-t13 (jobs scheduler + mirror, round 1) into plan3-hosted
• 0198149 feat(fleet): serve cloud-direct targets through the gateway
• 54a0f88 fix(agent): pin the index during verify; pin health behaviour in tests
• dc59123 fix(seal): never delete a pending key without proof it is dead
• a5d10fb fix(seal): refuse an offline rotation while the state dir is locked
• 1bd6d22 fix(jobs): requeue stale claims every tick, record cancellation, bound Stop, prefix mirror-open errors
• 93b33c8 merge: fold plan3-t12 (Object Lock verification, B2 lock read) into plan3-hosted
• a0d8da6 fix(kit): drop unreachable --disable-tls hosted command, print a TLS note instead
• 5cb03f8 merge: plan3-hosted (t11 + t5 round 2) into plan3-t8
• 9f37e29 ci: restore a hosted-target snapshot with a pinned upstream kopia binary
• 3e94a03 feat(fleet): offsite mirror state in targets, device detail and overview
• 27eb117 merge: fold plan3-t5 (S3 handler, round 2) into plan3-hosted
• 4011538 agent: execute the verify command and report it
• 95a0e1c fix(gateway): trusted-proxy client IP, exposed limiter config, allowlist and log residue
• b77814d fix(fleet): distinguish 'cannot verify' from 'unlocked' for B2; complete fold patch; tests
• 3d3bfd8 fleet: sealing-passphrase rotation with a dry run
• 6fc5d92 feat(fleet): mirror job (disk → S3-compatible bucket, never deletes)
• 0f78a4d fleet/kit: Referrer-Policy, SameSite assertion, revoked-device note
• ff14b88 fix(fleet): reap scheduling, enroll cleanup, age-gated temp sweep
• 7717c2b fix(fleet): recover panics in activation callbacks; print the enrollment token on its own line
• 2816c6b feat(fleet): jobs table accessors and scheduler skeleton
• 0806bb5 Merge pull request #7 from hodyhq/plan3-docs
• fcfecd5 fleet/kit: printable recovery kit with a read-only key, and its acknowledgement
• 75e645e fleet: verify Object Lock and conditional writes on mirror and cloud-direct buckets; real cloud arm
• f9c1f77 fix(scripts): non-interactive activation actually runs (no env on a shell function); test the branch
• 869f616 fix(app): scope-gated config tolerance, refuse --system for the app, honor persist policy
• ce4d102 scripts: TLS-only release fetches; fish PATH hint
• 09ace69 scripts: app.sh installs the standalone engine
• 1108457 feat(app): standalone app engine service (warphold app run/install/status/uninstall)
• 99ce1a1 fix(cli): CodeRabbit round — command_fleet_repo.go, per-row setup defaults, hosted-root check
• 4a5aa99 docs(spec): record the seventh upstream touch (server Options.DisableMaintenance)
• 56fddf5 fix(fleet/mail): settings never unseal the SMTP password on read; redaction tests
• 7d46beb feat(cli): SetupDefaults — first hosted target, template and group at activation
• 9a623fd fix(cli): absolute --data-dir, reload serves the host repo, reload in requireHost
• 0a6c1cb feat(fleet): revocation disables gateway keys and invalidates the cache
• 5014181 fix(gateway): validate credential prefix, 409 on existing key, MD5 assertion, host check, pre-auth limit
• 576501c feat(fleet): hosted provisioning — per-device repo, gateway keys, sealed bundle
• 6691164 feat(cli): fleet activate --public-url; setup creates the host's own repository
• dfb4428 Merge branch 'plan3-hosted' into plan3-t5
• 943a5ca fix(gateway): cloud-direct — require region, refuse plaintext, probe under the fleet root, Close
• 05e28d0 fleet/mail: SMTP settings with SMTP2GO defaults and a test send
• 3fc261b Merge branch 'plan3-hosted' into plan3-t8
• 7395e19 fix(release): import the signing key, scope permissions, packaging decisions
• 66e4a7d fix(fleet): logout checks origin before the CSRF token (no token oracle)
• cd2e244 fix(fleet): public_url — default-port normalization, probe logging, origin-first CSRF, login hardening
• 62aa50c feat(fleet): public_url setting and consumers; CSRF origin check
• a4cf27f feat(fleet): mount the device S3 gateway on the Fleet server
• 07c9970 feat(gateway): append-only S3 subset for devices
• 7303a33 docs(spec): packages never provision the server; bindir rule; no packaging-family detection
• 324c4fe fix(gateway): cloud-direct — conditional put (If-None-Match: *), capability probe, disk spool
• 8fe9584 Merge branch 'plan3-hosted' into plan3-t5
• 29d6dd2 fix(gateway): local backend hardening (symlinks, UTF-8, bounded list, size cap, ctx, ETag)
• 65aa992 feat(gateway): object store interface and local backend
• d847736 docs(spec): cloud-direct = S3-compatible endpoints with conditional put + probe (Task 11 review)
• 3d0e53c release: WarpHold deb/rpm packaging metadata and signed checksums
• a513b5d Merge branch 'plan3-hosted' into plan3-t5
• b5c09e2 fix(gateway): SigV4 — no region wildcard, real GetBucketLocation shape, reject unsigned x-amz-* headers
• d76a454 feat(gateway): SigV4 verification
• 17e7f6d fleet/gateway: cloud-direct write-through backend
• f711884 feat(fleet): public_url setting and consumers; CSRF origin check
• ea9ab75 docs(spec): gateway mounts at the bucket path /warphold/ (minio-go rejects path endpoints); MD5, unsigned x-amz headers, replay decisions
• 82cd7cd scripts: one-command app install
• e2d0744 scripts: one-command Fleet server install, with a container test and shellcheck
• 26fcf88 feat(fleet): hosted target kind (local storage; cloud-direct stubbed)
• d548206 Merge branch 'plan3-t3' into plan3-t5
• b21e949 Merge branch 'plan3-t2' into plan3-t5
• 93d0d31 feat(gateway): SigV4 verification
• 4f090ab feat(store): device keys, jobs table, additive migration
• 3eb16d0 feat(gateway): object store interface and local backend
• 0d30620 test(fleet): fixed mid-day clock in the overview test (midnight UTC flake)
• ac81d4e feat(store): device keys, jobs table, additive migration
• 38730f5 docs(spec): fold in the Task 1 spike result (allowlist, maintenance owner, S3 profile, no versioning)
• 4bf16b5 spike: record which blobs Kopia deletes or overwrites against an S3 store
• 1c93195 Merge pull request #6 from hodyhq/ui-v0.1.1
• c705fdd chore(ui): bump warphold-ui to v0.1.1 (responsive layout)
• 7c8cb2d Merge pull request #5 from hodyhq/fix-spa-public
• d552171 fix(ui-serve): cache header only on existing assets; assert the CSRF match in the test
• 83e5c45 test(cli): --no-ui also disables the public SPA bundle
• 57be3c1 fix(ui-serve): serve the SPA bundle without Kopia UI auth
• 2a81d17 Merge pull request #3 from hodyhq/plan2-ui-server
• 4625892 Merge pull request #4 from hodyhq/plan2-tray
• 8129848 test(fleet): ReportsBetween excludes future-dated reports; pinned clock
• 6257237 fix(agent): Desktop Entry escaping, refuse hostile binary paths in unit/autostart, fixed notification text
• 31d2ca4 test(fleet): future-dated report gets its own skewed-clock agent
• 291ec62 fix(fleet): bound the overview window above (skewed agent clocks); pin the test clock
• 3515f80 fix(agent): tray notifies on an initially failing agent; bounded D-Bus notify call
• 7d62a7e feat(agent): GET /local/info on the engine
• a0e6080 fix(agent): tray render diffing, initial menu, last-good accuracy
• efd6264 feat(cli): agent tray command
• 1e5e500 feat(agent): systray + D-Bus notifications
• f8e27ec feat(agent): tray menu model, icons, autostart
• 0420c32 test(fleet): generic device name in the overview fixture
• 4879ee6 fix(ui-serve): SPA deep links for /fleet and /agent
• 69b028e fix(fleet): atomic multi-key settings write; cap agent-supplied report stderr at 8 KiB
• b388012 feat: serve the WarpHold UI (import swap); agent engine serves the agent page
• b5682be fix(fleet): enroll.sh EXIT trap + prompt tests
• a26e32c feat(fleet): enroll.sh prompts for the token when none is supplied
• 3fed46c feat(fleet): settings endpoint (fleet_name, poll_interval)
• b0d5c5c perf(fleet): index reports(finished_at) for the overview window query
• 83088cd feat(fleet): GET /api/v1/fleet/overview
• a4fb922 feat(fleet): snake_case JSON tags on store.Report
• 11f2e41 Merge pull request #2 from hodyhq/plan2-basics
• 42eef5a fix: enrollment token via environment variable
• af5936f fix: address CodeRabbit round 1 on PR #2
• f61e3df fix: same-origin guard for local cookie auth; admin email normalization, self-delete guard, expiry test; README proxy note
• 16b87cb feat(agent): engine info file, local session handoff, snapshot ids in reports, agent status
• 72d6581 feat(fleet): server-side sessions, CSRF double-submit, admin management
• 12ed578 feat(fleet): serve the agent binary at /dl/
• ebd0704 Merge pull request #1 from hodyhq/plan1-m0-m3
• c0b263c fix: never cache an empty dummy password hash
• a27aab8 fix: final CodeRabbit CLI round — generic admin errors, constant-time login, batch health lookup, token error mapping
• a8c0e12 fix: address CodeRabbit round 2 on PR #1
• 3d92a44 fix: quote ExecStart binary path in the agent unit
• 11518c5 fix: CodeRabbit CLI round 4 — warphold symlink targets; document public enroll.sh
• 1b2437b fix: CodeRabbit CLI round 3; static enroll.sh takes --token only
• 2b592c7 brand: add WarpHold logo mark assets (ember speed-lines + chevron from the approved mockup)
• c491947 fix: CodeRabbit CLI round 2 (branch review)
• 9ba3144 fix: CodeRabbit CLI round 1; warphold release binary name
• 9f65076 fix: address CodeRabbit review of PR #1
• 62d1bf9 fix: final review — restart-safe report ids, refuse key overwrite, snapshot-only health, atomic token consume, token-only activation, seam test, docs
• 6b1a236 fix(agent): parse real snapshot task descriptions; stop engine before revoke exit
• d90c09d feat(agent): systemd install with linger and no-restart on revoke
• 2415133 feat(agent): run loop with policy apply, command execution, task reporting
• d4b2e71 fix(agent): release repo on headless start failure; drop redundant policy write
• be5ebb5 fix(fleet): scope command acknowledgement to the reporting agent
• 77cae09 feat(agent): headless Kopia engine and local API driver
• cfe459d feat(fleet): agent poll/report endpoints, ETag policy docs, health computation
• a8e4247 feat(agent): poll/report client
• 367b245 feat(agent): enroll command and on-disk state
• 1c9b41e fix(fleet): validate enroll.sh inputs; log skipped key cleanup on revoke
• ffd2cc4 fix(fleet): revoke both B2 keys when provisioning fails after key creation
• ba47c60 feat(fleet): enrollment endpoint, agent admin endpoints, enroll.sh
• c136f32 feat(fleet): provision per-agent repos with scoped B2 keys, Fleet as maintenance owner
• ad0788a fix(fleet): activation lock, setup-token gate, error mapping, once-only hook registration
• af0b7f7 feat(fleet): enrollment tokens (1h default, 30d max, multi-use)
• 807b113 feat(fleet): B2 native API client for key provisioning and Object Lock check
• c14df6b feat(fleet): admin CRUD for targets, templates, groups
• 4acf564 feat(fleet): activation, admin login, server mount hook, fleet activate command
• 7d4da0c fix(fleet): seal edge-case tests and key dir mode
• 7c598a8 feat(fleet): admin password hashing, sessions, login limiter
• f9ce0a6 feat(fleet): argon2id + secretbox sealing
• a73796e feat(fleet): SQLite state store
• 9a61a59 build: warphold app name
• 74b1589 build: produce the warphold binary
• 41e2bc4 feat(ui): upgraded htmlui to the latest version (#5599)
• d1836fd build(deps-dev): bump browserslist (#5601)
• 3668d0e build(deps): bump github/codeql-action/upload-sarif (#5597)
• 554605a build(deps): bump docker/setup-buildx-action in the docker group (#5598)
• f837e01 build(deps): bump the telemetry-dependencies group across 1 directory with 4 updates (#5593)
• 92fc5f4 build(deps): bump google.golang.org/grpc (#5592)
• a460265 build(deps): bump github.com/klauspost/reedsolomon from 1.14.1 to 1.14.2 (#5578)
• cb58a19 build(deps): bump the common-golang-dependencies group with 3 updates (#5577)
• d9d21fe fix(repository): increment attempt to correctly log index write retries (#5575)
• 4ebb2be build(deps): upgrade Go to 1.25.14 (#5576)
• 5f9fe81 build(deps): bump github/codeql-action/upload-sarif (#5570)
• f215988 build(deps-dev): bump the kopia-ui-npm-dependencies group (#5567)
• 80a31c5 build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#5569)
• 318aac1 build(deps): bump the common-golang-dependencies group with 7 updates (#5568)
• e73a5a0 fix(infra): use a string value in dependabot.yml entry (#5566)
• b0138a6 fix(server): limit allowed body size in server requests (#5561)
• b6bd722 chore(deps): move Go mod updates to Mondays (#5562)
• b0b839f build(desp): upgrade Go to 1.25.13 (#5559)
• a058e94 build(deps): bump the telemetry-dependencies group with 4 updates (#5555)
• 534f560 build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#5556)
• 37fce72 build(deps): bump google.golang.org/api (#5554)
• d241345 build(deps-dev): upgrade checklocks to release-20260105.0 (#5557)
• dfe3fde build(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /app (#5553)
• b361d0f chore(ci): cleanup copilot instructions - 2 (#5548)
• 2067b71 chore(general): cleanup copilot instructions (#5547)
• 71a8608 build(deps): bump the common-golang-dependencies group with 2 updates (#5545)
• 0888691 build(deps-dev): bump undici from 7.28.0 to 7.29.0 in /app (#5542)
• c7b56aa build(deps-dev): bump brace-expansion from 1.1.13 to 1.1.18 in /app (#5539)
• a0c0e5e feat(ui): upgraded htmlui to the latest version (#5541)
• 4039b3d build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /app (#5543)
• be5c2dc build(deps-dev): bump the kopia-ui-npm-dependencies group (#5533)
• 9ed1412 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5536)
• a2835b9 build(deps): bump the docker group with 2 updates (#5535)
• 8614394 build(deps): bump the github-actions group with 4 updates (#5534)
• 133fc64 build(deps-dev): bump postcss (#5531)
• 444d41a Log number of processed snapshots (#5530)
• 89c7ba0 fix(repository): release resources on error (#5528)
• 67934f1 feat(server): make GetCapacity available over gRPC (#5315)
• fbbaf02 build(deps): bump github.com/hanwen/go-fuse/v2 from 2.10.1 to 2.11.0 (#5524)
• 1a2eb55 refactor(testing): mapStorage.limit uint64 (#5526)
• 02af5d2 build(deps-dev): bump tar from 7.5.19 to 7.5.22 in /app (#5519)
• 3a6895a build(deps): bump the telemetry-dependencies group with 2 updates (#5523)
• a00303e build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#5525)
• 35a460c build(deps): bump the common-golang-dependencies group with 2 updates (#5522)
• d7ba213 refactor(general): use structured logging for faults (#5504)
• 40f45b0 refactor(general): use structured logging in API client (#5506)
• c21ae5c build(deps): bump the common-golang-dependencies group across 1 directory with 3 updates (#5511)
• 56602b4 build(deps): bump github.com/pkg/sftp from 1.13.10 to 1.13.11 (#5513)
• 95b84f5 feat(ui): upgraded htmlui to the latest version (#5514)
• b8fd290 chore(ci): pin fast-uri and js-yaml to resolve npm audit failures (#5515)
• 0c15687 refactor(general): use structured logging in diff (#5505)
• 674a5ab refactor(general): use structured logging in list cache (#5501)
• 8127245 refactor(general): use structured logging in cachefs (#5495)
• d32f0b4 build(deps): bump github.com/prometheus/common (#5497)
• 6c78785 build(deps): bump github.com/studio-b12/gowebdav from 0.12.0 to 0.13.0 (#5494)
• 3e1a378 build(deps): bump the common-golang-dependencies group with 8 updates (#5493)
• 7d70c3f refactor(testing): use tb in subtest (#5489)
• 4a6e9c3 refactor(repository): harden single-epoch compaction selection (#5488)
• 3877e37 refactor(cli): cleanup auto-maintenance run*Action helpers (#5482)
• 6c65de1 fix(cli): only run automatic maintenance after data-modifying operations (#5473)
• 82be73e build(deps): upgrade Go to 1.25.12 (#5479)
• c1e63ce build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#5478)
• 772b59b build(deps): bump the common-golang-dependencies group with 3 updates (#5477)
• 116ec24 chore(general): remove unused deprecated field (#5476)
• 62c72d1 chore(general): address nits (#5475)
• a896f1d build(deps): fix dependabot config (#5472)
• fe5a334 feat(ui): upgraded htmlui to the latest version (#5471)
• 1042778 build(deps): bump the kopia-ui-npm-dependencies group (#5467)
• c0d0244 build(deps): bump github/codeql-action/upload-sarif (#5469)
• 25e1756 build(deps): bump the github-actions group with 2 updates (#5468)
• aaad1f3 build(deps): bump the common-golang-dependencies group with 3 updates (#5458)
• b048b22 refactor(general): cleanup iomem hints (#5439)
• ab6de12 chore(ci): add per platform make lint-- targets (#5452)
• d886957 feat(snapshots): reduce kernel page-cache pressure during snapshots (#5437)
• ecb9d8e fix(repository): filter logs with log during log cleanup (#5449)
• 753c8b8 build(deps): bump the common-golang-dependencies group with 3 updates (#5444)
• 95cc2db build(deps): bump github.com/prometheus/common (#5445)
• f9f6e49 feat(repository) support AWS web identity inline and file tokens (#5440)
• 93b5d82 refactor(testing): reduce spurious failures in TestPickWeighted (#5446)
• ecaeb43 build(deps-dev): upgrade undici to ^7.28.0 (#5442)
• 39781aa feat(ui): upgraded htmlui to the latest version (#5441)
• bf3e5a9 chore(ci): more secure npm install flags (#5434)
• 542fa2c refactor(testing): fix waiting for background routine in test (#5435)
• 1e55e2d refactor(testing): wait for routine to exit before test cleanup (#5432)
• 2c1d847 refactor(testing): minor cleanups in epoch manager tests (#5431)
• 18ae818 refactor(testing): wait for background work in test (#5430)
• a76587d build(deps): bump github.com/tg123/go-htpasswd from 1.2.4 to 1.2.5 (#5429)
• 7541302 build(deps): bump the common-golang-dependencies group with 6 updates (#5427)
• 4beb489 build(deps): bump github.com/klauspost/reedsolomon from 1.14.0 to 1.14.1 (#5428)
• acaf649 feat(ui): upgraded htmlui to the latest version (#5425)
• 7d50727 build(deps): bump the kopia-ui-npm-dependencies group across 1 directory with 5 updates (#5426)
• 9392595 build(deps-dev): bump form-data from 4.0.5 to 4.0.6 in /app (#5421)