v0.6.0

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.6.0

📝 What's Changed

Added

• ✨ Sign in with OIDC in the editor itself, limited to WS_AUTH_OIDC_ALLOWED_EMAILS (ws-server)
• ✨ Take one WS_AUTH_OIDC_REDIRECT_URL per proxy domain (ws-server)
• ✨ Add pixi, with its global installs and credentials under ~/.local/pixi

Breaking

• 💥 Publish WS_SERVER_PORT (8080) in OIDC mode; the sign-in proxy on 38080 and WS_SERVER_AUTH_PROXY_PORT are gone
• 💥 Require WS_AUTH_OIDC_ALLOWED_EMAILS in OIDC mode, and refuse to start while WS_AUTH_OIDC_ALLOWED_GROUPS is set
• 💥 End an OIDC session WS_AUTH_SESSION_TTL (24 hours by default) after sign-in, instead of after 7 days
• 💥 Drop WS_AUTH_OIDC_FORBIDDEN_MESSAGE, WS_AUTH_OIDC_SESSION_REFRESH and WS_LOGGING_AUTH_PROXY_FILE
• 💥 Drop ws-cli logs --target auth_proxy

Changed

• ♻️ Let a signed-in forwarded port serve its own /login and /logout, in both auth modes (ws-server)
• ♻️ Honour ?to= and set Secure behind a TLS terminator in both auth modes (ws-server)
• ♻️ Share the session cookie across a templated proxy domain, using the most specific matching domain (ws-server)

Dependencies

• ⬆️ Bump community.general to 14.0.0, doctl to 2.3.0, jf to 2.131.0, glab to 1.128.0 and syft to 1.56.0
• ⬆️ Bump grype to 0.121.1, pyrefly to 1.4.1, buildx to 0.38.2 and claude-code to 2.1.318
• ⬆️ Bump op to 2.42.0, ansible-lint to 26.11.0, the Ruff extension to 2026.92.0 and ws-cli to 2217c04

Removed

• 🔥 Remove oauth2-proxy, its access-denied page, logout helper and s6 service (#835)

Security

• 🔒 Refuse /\ and control characters in login return targets, closing an open redirect (ws-server)

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.5.4

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.5.4

📝 What's Changed

Changed

• ⌨️ Let Ctrl+G reach the terminal on Windows and Linux, instead of opening Go to Recent Directory
• 🔧 Enable Python Environments so the Ansible extension stops prompting

Dependencies

• 🔒 Build k9s, kube-linter, gotests, impl and task from source to clear their high and critical CVEs
• 🔒 Raise VS Code's bundled undici to 7.30.1 (ws-server)
• ⬆️ Bump ansible-core to 2.22.0
• ⬆️ Bump claude-code to 2.1.317, uv to 0.13.7, buildx to 0.38.1, compose to 5.7.0, helm to 4.3.1 and starship to 1.27.0

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.5.3

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.5.3

📝 What's Changed

Added

• 🔁 Re-check OIDC sessions with the IdP via WS_AUTH_OIDC_SESSION_REFRESH, so users disabled there lose access (opt-in)

Changed

• 🚪 End the IdP session on OIDC sign-out, through the IdP's end_session_endpoint
• 🚫 Tell OIDC access denials apart from failed sign-ins, and offer "Sign in as a different user" when denied
• 🎨 Make ws-cli output pipe-safe and consistent across every command (#799)
• 📄 Keep the startup console colored and write workspace.log as plain text (#799)
• 🐚 Run startup scripts with the terminal's zsh environment (#782)
• ⚡️ Open new terminals faster by loading fzf-history settings on the first search
• 🔥 Drop the yarn plugin, and its y alias, from the default WS_ZSH_PLUGINS
• 🔒️ Refuse changed SSH host keys outside private networks (#801)
• ⚡️ Expire idle SSH control connections after 10 minutes and detect dead hosts (#801)

Dependencies

• 🔼 Bump VS Code to 1.144.0 (ws-server#35, ws-server#36)
• ⬆️ Bump http-proxy-3 to 2.0.1 (ws-server#34)
• ⬆️ Sweep Renovate updates, including uv 0.13 and the Kubernetes Python client 37 (#800)
• ⬆️ Bump Node.js to 24.22.2 and sweep Renovate updates, including Go 1.27.3 and Rust 1.99.1 (#801)

Fixed

• 🔒 Stop forwarding the workspace session cookies to forwarded ports on websocket upgrades (ws-server#34)
• 🧩 Load TypeScript server plugin extensions on the workspace host (ws-server#35)
• 📜 Fix ws logs filtering with --level, --tail and --follow (#799)
• ⏱️ Time out ws info extensions instead of hanging
• 🏠 Own ~/.ws for kloud when it is a mounted volume (#782)
• 🧷 Render a & in WS_AUTH_OIDC_FORBIDDEN_MESSAGE literally

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.5.2

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.5.2

📝 What's Changed

Breaking

• ✂️ Separate WS_SERVER_PROXY_DOMAIN and WS_SERVER_SSL_HOSTS entries with spaces only; commas no longer split
• 📦 Drop the gh, cloudflared, hashicorp and jfrog apt sources; install those tools through their features

Added

• 🐍 Build pet from source for the Python extensions

Changed

• 🔗 Resolve forwarded-port links from the host the editor is viewed at; terminals no longer get VSCODE_PROXY_URI
• 🧰 Install the vendor-apt CLIs from static release binaries
• 🚚 Fetch sops and talos from the <name>/<arch> store path
• 👷 Build each image once: promote the tested PR image to :dev, release on native arm64 (#780)

Dependencies

• ⬆️ Sweep Renovate dependency updates (#778)

Fixed

• 💪 Ship arm64-native kube-linter and starship; earlier arm64 images had wrong-arch builds (#781)
• 🍪 Scope OIDC cookie domains the way ws-server parses proxy domains (#779)
• 🔐 Fix startup feature installs and WS_NPM_ADDITIONAL_PACKAGES failing TLS behind a custom root CA (#777)
• 🤖 Point Renovate at the features.d playbook pins

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.5.1

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.5.1

📝 What's Changed

Dependencies

• 🤖 Bump claude-code to 2.1.289
• 🐍 Bump uv to 0.12.23 and ruff to 0.16.10
• 🐹 Build on Go 1.27.1
• 📦 Bump pnpm to 11.28.4
• 🐳 Bump docker compose to 5.6.0 and the docker Python SDK to 7.2.0
• ☸️ Bump helm to 4.3.0 and the kubernetes.core collection to 6.6.0
• 🔎 Bump fzf to 0.74.4
• 📋 Bump go-task to 3.54.0
• ⚡ Bump ws-cli to Go 1.27.1 and its latest modules

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.5.0

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.5.0

📝 What's Changed

Breaking

• 🚚 Move editor settings and extensions to ~/.local/share/ws-server/; existing volumes are not migrated
• 🛒 Read the extension gallery from the WS_MARKETPLACE_* variables; EXTENSIONS_GALLERY is ignored
• 🗑️ Remove /etc/workspace/config.yaml; the editor is configured through WS_* variables only
• 🔐 Remove WS_SERVER_SSL_ROOT; self-signed certificates are minted in memory
• 🔤 Remove ws serve font; install fonts from their upstream projects

Added

• 🆙 Ship VS Code 1.140.0
• 🎨 Rebrand the editor and docs with the Kloud Workspace icons
• 🚪 Add a Sign out action to the editor, overridable via WS_EDITOR_LOGOUT_URL
• 📁 Add WS_EDITOR_DISABLE_FILE_DOWNLOADS and WS_EDITOR_DISABLE_FILE_UPLOADS
• 🐞 Enable .NET debugging + revive terminal-link remap on the live workbench bundle (#735)
• 🌱 Seed files from a durable source directory on startup (#727)
• 📡 Add editor-state IPC routes + ws-cli editor; rewire open/openn
• ⌨️ Add ws completion via compdef ws=ws-cli
• 🤖 Agent-consumable documentation: llms.txt, llms-full.txt, per-page raw Markdown, and AI-crawler hints

Changed

• 🌐 Treat a leading *. in WS_SERVER_PROXY_DOMAIN as the bare suffix instead of rejecting it
• 🔖 Single-source the workspace version through manifest.json
• 🫙 Swap to the ws-cli seed engine, retire the vault + seed tier (#728)
• 👷 Adopt shared ws-meta CI actions for changelog + PR emoji check
• 📜 Propagate CHANGELOG.md to ws-meta for the public surface (#723)

Dependencies

• 🐍 Bump pylint to 4.1.2
• 🔑 Bump ansible-lint to 26.9.0 and op to 2.40.0
• 🧰 Bump deps: setup-node v6, claude-code, delve, uv, starship
• ⚡ Bump ws-cli to 0.0.69
• ⚡ Bump ws-cli to 0.0.68
• 📦 Bump claude-code, uv, pnpm, ruff
• 🐧 Bump base-image v0.1.2 (Debian 13.5) & ws-cli v0.0.65

Fixed

• 🐳 Skip dockerd when CAP_NET_ADMIN is missing instead of restart-looping
• 🔗 Make file:// terminal links clickable in browser (#725)

Removed

• ✂️ Remove the openn alias

Security

• 🛡️ Trust custom CAs in git, cargo & aws via CA-bundle env vars
• 🐋 Install docker compose/buildx from upstream releases (#724)

---

📚 Documentation · 🐳 Container image · 📜 Full changelog

v0.4.0

🐳 Pull

docker pull ghcr.io/kloudkit/workspace:v0.4.0

📝 What's Changed

Breaking

• 💥 Reject wildcard proxy domains instead of silently stripping the *. prefix
• 💥 Move shell/REPL history to ~/.ws/history; history at the previous paths is not migrated (#704)

Added

• ✨ dotnet: Debian 13 trixie + selectable version bands (8.0/9.0/10.0)
• ✨ Install additional pip packages and uv tools via env vars (#703)
• ✨ Install additional npm packages via WS_NPM_ADDITIONAL_PACKAGES
• ✨ Run cloudflared as a supervised s6 tunnel daemon (#700)
• ✨ Skip feature-install sections via --skip-* flags (#698)
• ✨ Enable built-in Markdown features and markdownlint parity (#697)
• ✨ Add user feature playbooks under ~/.ws/features.d (#696)
• ✨ Query show env by canonical dotted keys, retire WS_* query form (#693)
• ✨ Enforce WS_* value validation via declared patterns
• ✨ Retire common.sh env wrappers into ws-cli show env
• ✨ Add in-workspace OIDC auth via oauth2-proxy (#690)
• ✨ Add fonts.yaml manifest and render to fonts.sh (#683)

Changed

• 🏗️ Automate release tagging and changelog from a WS_VERSION literal (#722)
• ♻️ dotnet: DRY the version var, trim zshenv comments
• 🚚 Move shell/REPL history to ~/.ws/history and consolidate env into zshenv (#704)
• ♻️ Extract github_binary role task and sweep feature playbooks (#701)
• 🚚 Replace dumb-init with s6-overlay v3 daemon supervision (#699)
• 🏗️ Audit image build: isolate code-server into a cache-stable stage (#695)
• 🏗️ Audit dependency manifest: sudo PATH parity + Renovate hygiene (#694)
• 🚀 Swap jedi for pyrefly LSP (#689)

Fixed

• 🐛 Fixed renovate syntax
• 🐛 Own proxy-domain {{port}} prefix in startup, reject wildcards

---

📚 Documentation · 🐳 Container image · 📜 Full changelog