v0.5.1

jumpgate v0.5.1 is a security and cleanup release. To upgrade, replace the binary and the agent.

Security fixes

• Job records no longer store the intent payload. The job.created entry in a job's log used to carry the payload of the intent that created it. It now records no payload.
• The process check records only pid and name. node.migrate-names no longer writes a process's full command line into the job record.
• Both records were readable only by root on the box.

Other changes

• Removed duplicate checks, so each rule is checked in one place. The agent now verifies its own job log on load, by the digest chain.
• The server keeps a mark per job log instead of the verified entries.
• More tests cover the log checks' refusals and the agent's lease path.
• Docs now say that secrets never travel in job inputs.

Upgrading from v0.5.0

Replace the binary and the agent.

v0.5.0

jumpgate v0.5.0 adds a terminal UI, a signed controller/agent model for the boxes you manage, and desktop builds for macOS, Windows and Linux.
Long operations now run on the box as durable jobs; the first one, node.migrate-names, moves legacy nodes to the jumpgate-node account. Read Upgrading before you upgrade.

Highlights

• Terminal UI. Run jumpgate with no arguments in a terminal, or open the terminal launcher for your OS. It has six screens: Fleet, Hosts, Signers, Gateways, Jobs and Settings. They cover every box at once, plus each box's status, disk, endpoints, firewall, live logs and services, pairing, and the signing key. 1–6 switch screens, : takes a command (:logs box-a, :restart beacon box-a) and ? lists every key. Stopping or restarting a service asks you to type its name. The TUI needs an 80x24 terminal. It draws in plain ASCII on the classic Windows console and the Linux virtual console, or with JUMPGATE_ASCII=1, and NO_COLOR=1 turns colour off. The TUI holds no keys and does no work itself: it talks to the local server, and quitting leaves the server running. jumpgate home shows the plain line-based screen instead.
• Controller and agent. jumpgate keys init creates a controller signing key in the macOS Keychain, Windows Credential Manager, Secret Service, 1Password or an owner-only file. jumpgate hosts add pairs a box: you confirm its host key by fingerprint, and jumpgate installs a small agent (jumpgate-agent.service) and a restricted jumpgate tunnel user. Every command to a paired box is then a signed intent, which the agent checks against its policy and answers with a signed receipt. Each release carries both Linux agents (amd64 and arm64), so a controller on any OS can pair a box with nothing else to download.
• A command line. jumpgate help lists the commands: status, logs, service, hosts, keys, jobs, ssh, open, serve and stop. Exit codes are documented in the README. A security failure, such as an unconfirmed or changed host key or a reply the paired agent didn't sign, always exits 4.
• macOS, Windows and Linux. macOS ships Jumpgate.app (a window and a menubar icon) and Jumpgate Terminal.app. Windows ships jumpgate.exe and jumpgate-tray.exe (a window and a notification icon). Linux ships a desktop bundle with "Jumpgate" and "Jumpgate (window)" menu entries, on amd64 and arm64. One background server per user is shared by the app, the TUI and the CLI. Downloads come with SHA-256 checksums and build-provenance attestations.
• Durable jobs. A durable job is a multi-step operation that the box runs itself, so it outlives the TUI, the controller and an agent restart. Every step and answer goes into a signed, hash-chained log that the controller verifies. When a step can't choose safely, the job stops and asks you. One controller drives a job at a time; the others watch, and can adopt a job whose controller has been silent for 90 seconds. Press 5 in the TUI to open the jobs inbox, or run jumpgate jobs.
• node.migrate-names. jumpgate migrate-names HOST --yes renames a legacy node's valve-node-app account, group, units and data root to jumpgate-node. It checks the box before it renames anything, leaves a mounted data root at its path once you agree, and asks before it stops leftover processes. New setups use jumpgate-node from the start.
• Also new:
  • jumpgate relay runs keyed, metered RPC as its own process, away from the controller key. API keys are issued, listed and revoked from the RPC screen.
  • A Public gateway tier serves your own domain with a Let's Encrypt certificate.
  • Log lines sent for an AI explanation have addresses, peer ids and secrets redacted first.

Upgrading from v0.4.4

• Quit v0.4.4 before you start v0.5.0. Both listen on 127.0.0.1:8799.
• Your settings move automatically. On first run, ~/.valve-node-app moves to ~/.jumpgate, and a MOVED note is left in the old place. It's a rename, not a copy, so secrets never exist twice on disk. If both directories hold a config.json, jumpgate stops and asks you to keep one and remove the other. It doesn't merge two configs.
• Secrets are tightened at startup. The server makes existing secret files private to you. It refuses to start if a signing key can't be made private.
• Bare jumpgate in a terminal now opens the TUI. You get the web app with jumpgate open, with a flag such as --bind, or with no terminal (a pipe or the app bundle).
• Browser sign-in uses a one-time login link. jumpgate open signs your browser in with a link that works once, within 60 seconds, from this computer only. The session token is never put in a URL or on a command line. For a browser that can't read ~/.jumpgate, use jumpgate open --print.
• Host keys are checked strictly. A box that is paired, confirmed or listed in your ~/.ssh/known_hosts must present the same key. A changed key is refused, not learned again. Only a box with no such record is still trusted on first use.
• Pairing is optional for existing boxes, but jobs need it. Boxes you already manage keep working over SSH. Durable jobs and signed intents need a paired box: run jumpgate keys init once, then jumpgate hosts add NAME --ssh root@HOST. Once pairing succeeds, disable root SSH login on the box (PermitRootLogin no).
• Upgrade every controller before you migrate a box's names. A controller from before this release doesn't know about the migration. Running setup from it afterwards would set the box up under the legacy names again. A current controller refuses to set up a migrated box under the legacy names.
• While a job runs, the node belongs to the job. The box refuses service start, stop and restart, and the controller refuses setup and service clear on it (409 job_active).
• Platform minimums:
  • macOS 10.15.
  • Windows 10 1803 or Windows Server 2019.
  • The Linux window needs WebKitGTK 4.1 (Ubuntu 22.04+, Debian 12+, Fedora 38+).

Security fixes

• Built with Go 1.26, which carries the current fixes to net/http, HTTP/2 and crypto/tls.
• Updated golang.org/x/crypto for two SSH denial-of-service fixes.
• A cookie-authorised write to the local API must now come from the app's own origin. Before this fix, a page on another local port could drive the API with your cookie.
• The Gemini API key is sent in a header, not in the URL, so it no longer appears in error messages.
• The browser is signed in with a one-time login code instead of the session token.
• Host keys that were paired, confirmed or listed in known_hosts are checked strictly: a changed key is refused.
• Every secret jumpgate writes is created private to you: owner-only files on Linux and macOS, DACLs on Windows. Existing ones are tightened at startup.

Known limitations

• Durable jobs need a Linux box with systemd. A box without systemd refuses to start one (jobs_unsupported). Controllers on any OS can list, watch, decide and adopt jobs.
• There is no approval-tier signer yet. jumpgate refuses an approval-tier question with 409 approval_unavailable.
• Validators are not supported.
• The agent runs on Linux only. To run a node on macOS or Windows, use a WSL2 or Lima VM as an ordinary Linux box.
• jumpgate ssh refuses a box that is reached through a jump host.
• Pairing this machine with --local works on Linux only.
• Downloads are not code-signed yet. Windows SmartScreen may warn you, and macOS may ask you to allow the app in System Settings > Privacy & Security.

v0.4.4

Changelog

• dfb7749 fix(gateway): widen the per-install hostname tag to 64 bits

v0.4.3

Changelog

• 6aa9f84 fix(gateway): stable TLS hostname so a shared URL never rotates

v0.4.2

Changelog

• 6634094 fix(panel): finish the UX sweep — R7–R12

v0.4.1

Changelog

• 834fc76 feat(tray): bottom tab bar so the whole app is reachable from the desktop app
• 099895e fix(panel): don't probe/verify a stopped gateway with raw errors
• f747597 fix(panel): light-mode power button, ring spinner, and detail-screen feedback

v0.4.0

Changelog

• 7752023 ci: gate the Rust billing crate
• c14e059 docs(design): add billing admin build plan
• 1a8fa8e docs(design): add escrow contract and billing/validator design notes
• 35d1af5 docs(design): port beacon routing + eRPC brief, reconcile tunneling plan with shipped VPN
• b03aeec docs(design): rename issued key prefix vk_ to jg_
• d45219f feat(billing): add the API-key manager
• 418d39c feat(billing): add the operator admin HTTP API
• 7ec1cab feat(billing): add the pricing runtime
• 0006445 feat(billing): scaffold store with schema and default pricing
• 8f298f4 feat(update): notify on a newer release, with disable and skip controls
• a432ef0 fix(executor): find docker when launched from Finder (extend local PATH)
• a31448d fix(panel): Docker readiness gate + auto-start, brand as Jumpgate, loading state
• d2eff1a refactor(update): replace "skip a version" with quiet-mode + on-demand check
• 5190ae5 test(billing): raise coverage across the crate

v0.3.5

Changelog

• d888c88 fix(release): checksum the desktop apps, not just the headless binaries

v0.3.4

Changelog

• 33ff5f1 fix(ci): build the Intel desktop app on macos-15-intel, not retired macos-13

v0.3.3

Changelog

• cce7ea9 build(web): rebuild embedded dist with the Private access screen
• 80348a0 feat(vpn): Private access screen (the easy button, wired)
• a8131c5 feat(vpn): act on the overlay autostart flag at startup
• 363ffb5 feat(vpn): device enrollment engine
• b3911e8 feat(vpn): disconnect vs wipe for provisioned servers
• 70e7f85 feat(vpn): disconnect/reconnect and wipe controls in Private access UI
• ae12768 feat(vpn): frontend API client + hooks for the VPN surface
• b579fa1 feat(vpn): grade eRPC ingress on a provisioned overlay as private
• 34f1294 feat(vpn): persist BYO WireGuard overlays in local config
• 0d06084 feat(vpn): persist provisioned WireGuard servers + enrolled peers
• c618209 feat(vpn): provider-neutral WireGuard tunnel layer (BYO-first)
• 71ead7e feat(vpn): provision a WireGuard server on a target
• c3446b3 feat(vpn): server API for bring-your-own overlays
• cf3f1f2 feat(vpn): server API for provisioning + device enrollment
• 86972cf release: rename artifacts valve-node-app -> jumpgate (clean public naming)
• e24683e test(vpn): live-box integration test for the full server lifecycle