KRATE 0.6.0 alpha.23

KRATE 0.6.0

Tag	v0.6.0-alpha.23
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.23-trixie_amd64.deb	6980c3b7975b3f413ccdf73ab04b7e6e124a868e5bc0e5eee7e18240ee43c528

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (b483b9a)

• fix(zenfw): drop php8.4-fpm from FPM unit fallback list (b483b9a) — @tomcdj71
• feat(zen): export PHP runtime env vars for application handlers (5658740) — @tomcdj71
• feat(zenfw): centralize PHP runtime detection in system module (f3a7a1c) — @tomcdj71
• fix(dashboard): retry composer install from source on dist failure (eef22d3) — @tomcdj71
• fix(zenfw): fail fast when git clone needs interactive credentials (6460b7c) — @tomcdj71
• fix(zenfw): accept manifest executables in software::require (4447f43) — @tomcdj71
• fix(zenfw): emit JSON numbers from integer literals in json::build (0931640) — @tomcdj71
• fix(zenfw): generate jellyfin WebSocket handle in proxy::generate (f1e0bfa) — @tomcdj71
• feat(i18n): add Emby lifecycle error translation keys (d397df4) — @tomcdj71
• fix(zenfw): simplify Jellyfin subpath reverse proxy for native WebSockets (6771d7f) — @tomcdj71
• chore(ci): bump cache and upload-artifact actions (1d2f89f) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (433b6aa) — @tomcdj71
• feat(handler_runtime): add release channel_guard for beta installs (1063326) — @tomcdj71
• fix(workspace): terminate env files with newline and add Python 3.14 (a06a6eb) — @tomcdj71
• fix(dependencies): restore setuptools package specification in pip section (3c60dd4) — @tomcdj71
• fix(dependency): allow mutating grouped APT phase list during install (719a303) — @tomcdj71
• fix(setup): ensure platform PHP APT group runs on cloud Debian images (be629a4) — @tomcdj71
• fix(dependency): allow long timeout for apt-get upgrade (1c45962) — @tomcdj71
• fix(pull): pass release tag into dashboard update helper (6fe1dd7) — @tomcdj71
• fix(dashboard): rebuild Encore when assets or templates change without lock bump (550e8dc) — @tomcdj71
• perf(dashboard): fast-path updates with scoped chown and build stamp (fc8def1) — @tomcdj71
• feat(dashboard): stream composer/pnpm output and log each update step (e455e20) — @tomcdj71
• fix(dashboard): clear prod cache with correct APP_ENV after update (9a17ab4) — @tomcdj71
• fix(i18n): add missing dependency keys and clarify wait_ping_timeout (78d9964) — @tomcdj71
• fix(zenfw): skip apt install when app manifest declares no packages (556cd17) — @tomcdj71
• fix(zenfw): install setuptools in Python venvs via platform pip deps (6f817ad) — @tomcdj71
• fix(zen): normalize hyphen pre-release versions in pull --check (b9bed33) — @tomcdj71
• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (0d37012) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (24e934c) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (f9f6f74) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (ecccdba) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (d3cff02) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (034d7ce) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (7358975) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (a76a743) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (d2207fc) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (7644cd7) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (8d030f1) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (34ae0bf) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (1e86a5b) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (745bfa6) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (667e8fb) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (3f94c2a) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (c84b8de) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (8bed376) — @tomcdj71

setup (bea2ac7)

• fix(setup): persist zenfw.command.timeout during install (bea2ac7) — @tomcdj71
• fix(install): stop pinning APP_ENV in the PHP-FPM pool (29d0e76) — @tomcdj71
• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (f2bf9f0)

• fix(ui): show Emby premiere key when ui_options and CLI flags overlap (f2bf9f0) — @tomcdj71
• fix(migrations): skip ALTER when schema:update already applied columns (280824b) — @tomcdj71
• fix(apps): rescan update flags after manage jobs and sync card dots (346a8e8) — @tomcdj71
• fix(apps): route app updates through the same path as remove (8be953d) — @tomcdj71
• fix(apps): dual-launch zen jobs via messenger and detached CLI (b74afbe) — @tomcdj71
• fix(apps): queue software jobs via detached worker and zen_job table (8f230b7) — @tomcdj71
• fix(apps): sync update notifications and refine update UI (3f907c5) — @tomcdj71
• fix(web): restore clickListenerAttached guard in AppUpdateAction (41e827f) — @tomcdj71
• feat(apps): replace update Yes label with actionable update controls (4f71fd9) — @tomcdj71
• feat(web): expose Emby Premiere and Plex Pass keys in install wizard (ea80ad1) — @tomcdj71
• chore(deps): lock league/commonmark dependencies (0977884) — @tomcdj71
• feat(updater): detect beta update channel from zenfw config (27d99e5) — @tomcdj71
• fix(settings): polish general settings save UX (4abb71b) — @tomcdj71
• fix(updater): place TESTING.md checklist before changelog on update page (f9b09fc) — @tomcdj71
• fix(updater): show TESTING.md checklist on system update page (d64a80c) — @tomcdj71
• feat(apps): add remove action to dashboard app options m...

KRATE 0.6.0 alpha.22

KRATE 0.6.0

Tag	v0.6.0-alpha.22
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.22-trixie_amd64.deb	9bc2d5aff8cf2242c2986be8d6a2e28484550d83f347aa355373297c084e6031

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (eef22d3)

• fix(dashboard): retry composer install from source on dist failure (eef22d3) — @tomcdj71
• fix(zenfw): fail fast when git clone needs interactive credentials (6460b7c) — @tomcdj71
• fix(zenfw): accept manifest executables in software::require (4447f43) — @tomcdj71
• fix(zenfw): emit JSON numbers from integer literals in json::build (0931640) — @tomcdj71
• fix(zenfw): generate jellyfin WebSocket handle in proxy::generate (f1e0bfa) — @tomcdj71
• feat(i18n): add Emby lifecycle error translation keys (d397df4) — @tomcdj71
• fix(zenfw): simplify Jellyfin subpath reverse proxy for native WebSockets (6771d7f) — @tomcdj71
• chore(ci): bump cache and upload-artifact actions (1d2f89f) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (433b6aa) — @tomcdj71
• feat(handler_runtime): add release channel_guard for beta installs (1063326) — @tomcdj71
• fix(workspace): terminate env files with newline and add Python 3.14 (a06a6eb) — @tomcdj71
• fix(dependencies): restore setuptools package specification in pip section (3c60dd4) — @tomcdj71
• fix(dependency): allow mutating grouped APT phase list during install (719a303) — @tomcdj71
• fix(setup): ensure platform PHP APT group runs on cloud Debian images (be629a4) — @tomcdj71
• fix(dependency): allow long timeout for apt-get upgrade (1c45962) — @tomcdj71
• fix(pull): pass release tag into dashboard update helper (6fe1dd7) — @tomcdj71
• fix(dashboard): rebuild Encore when assets or templates change without lock bump (550e8dc) — @tomcdj71
• perf(dashboard): fast-path updates with scoped chown and build stamp (fc8def1) — @tomcdj71
• feat(dashboard): stream composer/pnpm output and log each update step (e455e20) — @tomcdj71
• fix(dashboard): clear prod cache with correct APP_ENV after update (9a17ab4) — @tomcdj71
• fix(i18n): add missing dependency keys and clarify wait_ping_timeout (78d9964) — @tomcdj71
• fix(zenfw): skip apt install when app manifest declares no packages (556cd17) — @tomcdj71
• fix(zenfw): install setuptools in Python venvs via platform pip deps (6f817ad) — @tomcdj71
• fix(zen): normalize hyphen pre-release versions in pull --check (b9bed33) — @tomcdj71
• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (0d37012) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (24e934c) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (f9f6f74) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (ecccdba) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (d3cff02) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (034d7ce) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (7358975) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (a76a743) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (d2207fc) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (7644cd7) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (8d030f1) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (34ae0bf) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (1e86a5b) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (745bfa6) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (667e8fb) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (3f94c2a) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (c84b8de) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (8bed376) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71

setup (bea2ac7)

• fix(setup): persist zenfw.command.timeout during install (bea2ac7) — @tomcdj71
• fix(install): stop pinning APP_ENV in the PHP-FPM pool (29d0e76) — @tomcdj71
• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (f2bf9f0)

• fix(ui): show Emby premiere key when ui_options and CLI flags overlap (f2bf9f0) — @tomcdj71
• fix(migrations): skip ALTER when schema:update already applied columns (280824b) — @tomcdj71
• fix(apps): rescan update flags after manage jobs and sync card dots (346a8e8) — @tomcdj71
• fix(apps): route app updates through the same path as remove (8be953d) — @tomcdj71
• fix(apps): dual-launch zen jobs via messenger and detached CLI (b74afbe) — @tomcdj71
• fix(apps): queue software jobs via detached worker and zen_job table (8f230b7) — @tomcdj71
• fix(apps): sync update notifications and refine update UI (3f907c5) — @tomcdj71
• fix(web): restore clickListenerAttached guard in AppUpdateAction (41e827f) — @tomcdj71
• feat(apps): replace update Yes label with actionable update controls (4f71fd9) — @tomcdj71
• feat(web): expose Emby Premiere and Plex Pass keys in install wizard (ea80ad1) — @tomcdj71
• chore(deps): lock league/commonmark dependencies (0977884) — @tomcdj71
• feat(updater): detect beta update channel from zenfw config (27d99e5) — @tomcdj71
• fix(settings): polish general settings save UX (4abb71b) — @tomcdj71
• fix(updater): place TESTING.md checklist before changelog on update page (f9b09fc) — @tomcdj71
• fix(updater): show TESTING.md checklist on system update page (d64a80c) — @tomcdj71
• feat(apps): add remove action t...

KRATE 0.6.0 alpha.21

KRATE 0.6.0

Tag	v0.6.0-alpha.21
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.21-trixie_amd64.deb	6f7e06a8ef440cbd8934d8f0e169f4a7da2683901d2fe287d6d08d6cc5e3c161

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (6460b7c)

• fix(zenfw): fail fast when git clone needs interactive credentials (6460b7c) — @tomcdj71
• fix(zenfw): accept manifest executables in software::require (4447f43) — @tomcdj71
• fix(zenfw): emit JSON numbers from integer literals in json::build (0931640) — @tomcdj71
• fix(zenfw): generate jellyfin WebSocket handle in proxy::generate (f1e0bfa) — @tomcdj71
• feat(i18n): add Emby lifecycle error translation keys (d397df4) — @tomcdj71
• fix(zenfw): simplify Jellyfin subpath reverse proxy for native WebSockets (6771d7f) — @tomcdj71
• chore(ci): bump cache and upload-artifact actions (1d2f89f) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (433b6aa) — @tomcdj71
• feat(handler_runtime): add release channel_guard for beta installs (1063326) — @tomcdj71
• fix(workspace): terminate env files with newline and add Python 3.14 (a06a6eb) — @tomcdj71
• fix(dependencies): restore setuptools package specification in pip section (3c60dd4) — @tomcdj71
• fix(dependency): allow mutating grouped APT phase list during install (719a303) — @tomcdj71
• fix(setup): ensure platform PHP APT group runs on cloud Debian images (be629a4) — @tomcdj71
• fix(dependency): allow long timeout for apt-get upgrade (1c45962) — @tomcdj71
• fix(pull): pass release tag into dashboard update helper (6fe1dd7) — @tomcdj71
• fix(dashboard): rebuild Encore when assets or templates change without lock bump (550e8dc) — @tomcdj71
• perf(dashboard): fast-path updates with scoped chown and build stamp (fc8def1) — @tomcdj71
• feat(dashboard): stream composer/pnpm output and log each update step (e455e20) — @tomcdj71
• fix(dashboard): clear prod cache with correct APP_ENV after update (9a17ab4) — @tomcdj71
• fix(i18n): add missing dependency keys and clarify wait_ping_timeout (78d9964) — @tomcdj71
• fix(zenfw): skip apt install when app manifest declares no packages (556cd17) — @tomcdj71
• fix(zenfw): install setuptools in Python venvs via platform pip deps (6f817ad) — @tomcdj71
• fix(zen): normalize hyphen pre-release versions in pull --check (b9bed33) — @tomcdj71
• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (0d37012) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (24e934c) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (f9f6f74) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (ecccdba) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (d3cff02) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (034d7ce) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (7358975) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (a76a743) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (d2207fc) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (7644cd7) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (8d030f1) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (34ae0bf) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (1e86a5b) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (745bfa6) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (667e8fb) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (3f94c2a) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (c84b8de) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (8bed376) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71

setup (bea2ac7)

• fix(setup): persist zenfw.command.timeout during install (bea2ac7) — @tomcdj71
• fix(install): stop pinning APP_ENV in the PHP-FPM pool (29d0e76) — @tomcdj71
• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (f2bf9f0)

• fix(ui): show Emby premiere key when ui_options and CLI flags overlap (f2bf9f0) — @tomcdj71
• fix(migrations): skip ALTER when schema:update already applied columns (280824b) — @tomcdj71
• fix(apps): rescan update flags after manage jobs and sync card dots (346a8e8) — @tomcdj71
• fix(apps): route app updates through the same path as remove (8be953d) — @tomcdj71
• fix(apps): dual-launch zen jobs via messenger and detached CLI (b74afbe) — @tomcdj71
• fix(apps): queue software jobs via detached worker and zen_job table (8f230b7) — @tomcdj71
• fix(apps): sync update notifications and refine update UI (3f907c5) — @tomcdj71
• fix(web): restore clickListenerAttached guard in AppUpdateAction (41e827f) — @tomcdj71
• feat(apps): replace update Yes label with actionable update controls (4f71fd9) — @tomcdj71
• feat(web): expose Emby Premiere and Plex Pass keys in install wizard (ea80ad1) — @tomcdj71
• chore(deps): lock league/commonmark dependencies (0977884) — @tomcdj71
• feat(updater): detect beta update channel from zenfw config (27d99e5) — @tomcdj71
• fix(settings): polish general settings save UX (4abb71b) — @tomcdj71
• fix(updater): place TESTING.md checklist before changelog on update page (f9b09fc) — @tomcdj71
• fix(updater): show TESTING.md checklist on system update page (d64a80c) — @tomcdj71
• feat(apps): add remove action to...

KRATE 0.6.0 alpha.20

KRATE 0.6.0

Tag	v0.6.0-alpha.20
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.20-trixie_amd64.deb	efa9ad81574c394e550a37047d449ee12ad44edfd2f57f2f2a784095e82bcf8e

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (e670e62)

• fix(workspace): terminate env files with newline and add Python 3.14 (e670e62) — @tomcdj71
• fix(dependencies): restore setuptools package specification in pip section (1270f73) — @tomcdj71
• fix(dependency): allow mutating grouped APT phase list during install (fe8936d) — @tomcdj71
• fix(setup): ensure platform PHP APT group runs on cloud Debian images (e60ef75) — @tomcdj71
• fix(dependency): allow long timeout for apt-get upgrade (dd8afc6) — @tomcdj71
• fix(pull): pass release tag into dashboard update helper (d1e0c46) — @tomcdj71
• fix(dashboard): rebuild Encore when assets or templates change without lock bump (7122dbb) — @tomcdj71
• perf(dashboard): fast-path updates with scoped chown and build stamp (be2ee9d) — @tomcdj71
• feat(dashboard): stream composer/pnpm output and log each update step (bfc2e47) — @tomcdj71
• fix(dashboard): clear prod cache with correct APP_ENV after update (9e3c793) — @tomcdj71
• fix(i18n): add missing dependency keys and clarify wait_ping_timeout (ab37e8f) — @tomcdj71
• fix(zenfw): skip apt install when app manifest declares no packages (e9d6c3c) — @tomcdj71
• fix(zenfw): install setuptools in Python venvs via platform pip deps (25ab083) — @tomcdj71
• fix(zen): normalize hyphen pre-release versions in pull --check (fbe34cb) — @tomcdj71
• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (6c81c2a) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (bcb8656) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (17ce447) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (af1e2ff) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (228b2a9) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (bec2377) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (38bc393) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71

setup (bea2ac7)

• fix(setup): persist zenfw.command.timeout during install (bea2ac7) — @tomcdj71
• fix(install): stop pinning APP_ENV in the PHP-FPM pool (29d0e76) — @tomcdj71
• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (f2bf9f0)

• fix(ui): show Emby premiere key when ui_options and CLI flags overlap (f2bf9f0) — @tomcdj71
• fix(migrations): skip ALTER when schema:update already applied columns (280824b) — @tomcdj71
• fix(apps): rescan update flags after manage jobs and sync card dots (346a8e8) — @tomcdj71
• fix(apps): route app updates through the same path as remove (8be953d) — @tomcdj71
• fix(apps): dual-launch zen jobs via messenger and detached CLI (b74afbe) — @tomcdj71
• fix(apps): queue software jobs via detached worker and zen_job table (8f230b7) — @tomcdj71
• fix(apps): sync update notifications and refine update UI (3f907c5) — @tomcdj71
• fix(web): restore clickListenerAttached guard in AppUpdateAction (41e827f) — @tomcdj71
• feat(apps): replace update Yes label with actionable update controls (4f71fd9) — @tomcdj71
• feat(web): expose Emby Premiere and Plex Pass keys in install wizard (ea80ad1) — @tomcdj71
• chore(deps): lock league/commonmark dependencies (0977884) — @tomcdj71
• feat(updater): detect beta update channel from zenfw config (27d99e5) — @tomcdj71
• fix(settings): polish general settings save UX (4abb71b) — @tomcdj71
• fix(updater): place TESTING.md checklist before changelog on update page (f9b09fc) — @tomcdj71
• fix(updater): show TESTING.md checklist on system update page (`d64a...

KRATE 0.6.0 alpha.19

KRATE 0.6.0

Tag	v0.6.0-alpha.19
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.19-trixie_amd64.deb	56866edad70ddcf667b29a593f0cca607f046cd0083d1b7b2853e0ce01da412f

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (ab37e8f)

• fix(i18n): add missing dependency keys and clarify wait_ping_timeout (ab37e8f) — @tomcdj71
• fix(zenfw): skip apt install when app manifest declares no packages (e9d6c3c) — @tomcdj71
• fix(zenfw): install setuptools in Python venvs via platform pip deps (25ab083) — @tomcdj71
• fix(zen): normalize hyphen pre-release versions in pull --check (fbe34cb) — @tomcdj71
• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (6c81c2a) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (bcb8656) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (17ce447) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (af1e2ff) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (228b2a9) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (bec2377) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (38bc393) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (29d0e76)

• fix(install): stop pinning APP_ENV in the PHP-FPM pool (29d0e76) — @tomcdj71
• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (ea80ad1)

• feat(web): expose Emby Premiere and Plex Pass keys in install wizard (ea80ad1) — @tomcdj71
• chore(deps): lock league/commonmark dependencies (0977884) — @tomcdj71
• feat(updater): detect beta update channel from zenfw config (27d99e5) — @tomcdj71
• fix(settings): polish general settings save UX (4abb71b) — @tomcdj71
• fix(updater): place TESTING.md checklist before changelog on update page (f9b09fc) — @tomcdj71
• fix(updater): show TESTING.md checklist on system update page (d64a80c) — @tomcdj71
• feat(apps): add remove action to dashboard app options menu (6ea8740) — @tomcdj71
• fix(updater): normalize hyphen pre-release versions in comparison (f1ccd47) — @tomcdj71
• fix(updater): remove redundant up-to-date sentence on settings page (8d1da59) — @tomcdj71
• fix(dashboard): show up-to-date check icon beside footer label (3da151b) — @tomcdj71
• fix(updater): run dashboard self-update in detached CLI process (0c3f9c1) — @tomcdj71
• fix(updater): reconcile installed version when zen reports false positive (40321ef) — @tomcdj71
• style(changelogs): increase modal width for system update changelog (f11d30a) — @tomcdj71
• fix(vault): use named API_ENDPOINTS import for unlock request (c803a4f) — @tomcdj71
• fix(vault): load vault page script from app bundle instead of profile_vault (ac7f851) — @tomcdj71
• fix(updater): format last check time in PHP for notification footer (fe1e4c0) — @tomcdj71
• fix(dashboard): format last update check time with format_datetime (`e5a92ea...

KRATE 0.6.0 alpha.18

KRATE 0.6.0

Tag	v0.6.0-alpha.18
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.18-trixie_amd64.deb	f5f13cfbba3a1331875e13e0ecd4b68bfc8c4f9b54d0a8f82eaabf3a8fb9dacf

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (6c81c2a)

• fix(dashboard): wipe Symfony prod/dev cache before dashboard::update (6c81c2a) — @tomcdj71
• fix(zen): match installed krate package by tag and codename suffix (bcb8656) — @tomcdj71
• fix(zen): delegate vault commands to zenfw SQLite vault API (17ce447) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (af1e2ff) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (228b2a9) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (bec2377) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (38bc393) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (1b412e3)

• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (04df061)

• docs: add conventional commit guidelines for agents (04df061) — @tomcdj71
• fix(updater): run dashboard self-update in detached CLI process (1019cd3) — @tomcdj71
• fix(updater): reconcile installed version when zen reports false positive (902b21e) — @tomcdj71
• style(changelogs): increase modal width for system update changelog (4d3ed18) — @tomcdj71
• fix(vault): use named API_ENDPOINTS import for unlock request (fd9ae4b) — @tomcdj71
• fix(vault): load vault page script from app bundle instead of profile_vault (2d8eaa0) — @tomcdj71
• fix(updater): format last check time in PHP for notification footer (fdf99c5) — @tomcdj71
• fix(dashboard): format last update check time with format_datetime (0b1e550) — @tomcdj71
• fix(vault): register profile vault route via controller attribute (6e4d328) — @tomcdj71
• i18n(vault): add EN/FR strings for password vault page (dbe74f6) — @tomcdj71
• feat(vault): add profile vault UI with unlock toggle and copy actions (3cc9f87) — @tomcdj71
• feat(vault): add profile page route and password-gated reveal API (feeba60) — @tomcdj71
• feat(vault): add service to list and reveal user-scoped credentials (3e4e993) — @tomcdj71
• i18n(widgets): add EN/FR strings for dashboard widget display preference (354b600) — @tomcdj71
• feat(widgets): add profile toggle for dashboard widget row-2 display (a287101) — @tomcdj71
• feat(widgets): show or collapse dashboard widget row 2 based on user preference (1c934ef) — @tomcdj71
• feat(widgets): persist dashboard widget row-2 display preference from profile (ae92f01) — @tomcdj71
• feat(widgets): add dashboard widget row-2 collapsible preference field (e0422f9) — @tomcdj71
• feat(dashboard): show green check on notification bell when KRATE is up to date (639adff) — @tomcdj71
• feat(dashboard): show last KRATE update check time in the UI (bb8f58a) — @tomcdj71
• feat(sett...

KRATE 0.6.0 alpha.17

KRATE 0.6.0

Tag	v0.6.0-alpha.17
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.17-trixie_amd64.deb	b89cc03369dd9411952d0061ce3723008160b98de6bc9f2df0c27207af635f24

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (17ce447)

• fix(zen): delegate vault commands to zenfw SQLite vault API (17ce447) — @tomcdj71
• fix(zen): treat dotted pre-release .deb names as up to date (af1e2ff) — @tomcdj71
• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (228b2a9) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (bec2377) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (38bc393) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (1b412e3)

• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (18d92e1)

• fix(vault): use named API_ENDPOINTS import for unlock request (18d92e1) — @tomcdj71
• fix(vault): load vault page script from app bundle instead of profile_vault (6d0e9e7) — @tomcdj71
• fix(updater): format last check time in PHP for notification footer (8fa40df) — @tomcdj71
• fix(dashboard): format last update check time with format_datetime (b3dc634) — @tomcdj71
• fix(vault): register profile vault route via controller attribute (4adbea9) — @tomcdj71
• i18n(vault): add EN/FR strings for password vault page (29134a1) — @tomcdj71
• feat(vault): add profile vault UI with unlock toggle and copy actions (7d5d3d9) — @tomcdj71
• feat(vault): add profile page route and password-gated reveal API (dfaebec) — @tomcdj71
• feat(vault): add service to list and reveal user-scoped credentials (83bbbb6) — @tomcdj71
• i18n(widgets): add EN/FR strings for dashboard widget display preference (464622a) — @tomcdj71
• feat(widgets): add profile toggle for dashboard widget row-2 display (56f80b3) — @tomcdj71
• feat(widgets): show or collapse dashboard widget row 2 based on user preference (40af4f3) — @tomcdj71
• feat(widgets): persist dashboard widget row-2 display preference from profile (a3c58a8) — @tomcdj71
• feat(widgets): add dashboard widget row-2 collapsible preference field (7aa23d3) — @tomcdj71
• feat(dashboard): show green check on notification bell when KRATE is up to date (e1a70df) — @tomcdj71
• feat(dashboard): show last KRATE update check time in the UI (61de322) — @tomcdj71
• feat(settings): show installed changelog with modal for pending update (9f80d04) — @tomcdj71
• feat(updater): expose installed and available release changelogs (b8b41a2) — @tomcdj71
• feat(settings): display rendered markdown on system update page (8a3293b) — @tomcdj71
• feat(updater): render release notes markdown to HTML server-side (c74db5b) — @tomcdj71
• fix(updater): show full package version for pre-release updates (0f72744) — @tomcdj71
• i18n(updater): add EN/FR translations for system update UI (79bfb1e) — @tomcdj71
• feat(settings):...

KRATE 0.6.0 alpha.16

KRATE 0.6.0

Tag	v0.6.0-alpha.16
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.16-trixie_amd64.deb	d7c28f6f46361a2ad4479f13c3aee70ff54f1dfa3140ee33b0186fb6167698ea

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (228b2a9)

• fix(zenfw): declare switch_app_env_to_dev before AppEnvSwitchGuard (228b2a9) — @tomcdj71
• feat(zenfw): reload PHP-FPM after dashboard update (bec2377) — @tomcdj71
• fix(zenfw): preserve APP_ENV across dashboard update (38bc393) — @tomcdj71
• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (1b412e3)

• fix(setup): persist krate.conf branch=beta to zenfw.conf.local (1b412e3) — @tomcdj71
• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (9b5dbe0)

• fix(harmony): drop CDN bundle badge and fix doc link translations (9b5dbe0) — @tomcdj71
• feat(harmony): notify admins when KRATE update check fails (4d6067e) — @tomcdj71
• fix(harmony): harden KRATE system update check reliability (a815cef) — @tomcdj71
• feat(harmony): let admins configure the system email sender address (145ba9a) — @tomcdj71
• feat(harmony): send customizable welcome email after activation (7f329a4) — @tomcdj71
• fix(harmony): translate toggle switch labels in forms (dd86921) — @tomcdj71
• feat(harmony): add harmony:create:user console command (881d1dc) — @tomcdj71
• feat(harmony): implement deferred account activation pipeline (35f1706) — @tomcdj71
• feat(harmony): expose account creation policy in general settings (388ca9f) — @tomcdj71
• feat(harmony): add account creation mode and pending password storage (0b2f220) — @tomcdj71
• fix(harmony): read license.json for the license settings page (5002dbd) — @tomcdj71
• refactor(harmony): remove remove service action from app menus (de3bcca) — @tomcdj71
• fix(harmony): make system update checks reliable for the krate user (f7d3f64) — @tomcdj71
• fix(harmony): remove duplicate body background behind scroll backdrop (cd1912b) — @tomcdj71
• fix(harmony): read update-check TTL from env to match compiled prod container (704532b) — @tomcdj71
• fix(harmony): wire SystemUpdateChecker env args in services.yaml (2948879) — @tomcdj71
• fix(harmony): refresh and display runtime app versions on status poll (b7e23c4) — @tomcdj71
• fix(harmony): keep dashboard wallpaper visible while scrolling (58d5c6d) — @tomcdj71
• fix(harmony): throttle background update checks with configurable TTL (7487fa6) — @tomcdj71
• feat(harmony): report and apply KRATE updates from the dashboard (683ec7e) — @tomcdj71
• fix(harmony): dedupe beta branch chip and extend dashboard backdrop (3c5bf18) — @tomcdj71
• feat(harmony): refresh runtime app versions before status snapshot (f7a4be7) — @tomcdj71
• fix(deploy): track composer and pnpm lock files for dashboard install. (0588cfa) — @tomcdj71
• fix(firewall): load admin page from app bundle and fix prod webpack build (26b7fa7) — @tomcdj71
• fix(firewall): display port ranges in admin Firewall pag...

KRATE 0.6.0 alpha.15

KRATE 0.6.0

Tag	v0.6.0-alpha.15
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.15-trixie_amd64.deb	6acdc836169d0e7d83cab4e2174b27c3db0c79a6cc5f523c898a7a95240e8a19

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (b26cae3)

• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (1fcf013)

• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (145ba9a)

• feat(harmony): let admins configure the system email sender address (145ba9a) — @tomcdj71
• feat(harmony): send customizable welcome email after activation (7f329a4) — @tomcdj71
• fix(harmony): translate toggle switch labels in forms (dd86921) — @tomcdj71
• feat(harmony): add harmony:create:user console command (881d1dc) — @tomcdj71
• feat(harmony): implement deferred account activation pipeline (35f1706) — @tomcdj71
• feat(harmony): expose account creation policy in general settings (388ca9f) — @tomcdj71
• feat(harmony): add account creation mode and pending password storage (0b2f220) — @tomcdj71
• fix(harmony): read license.json for the license settings page (5002dbd) — @tomcdj71
• refactor(harmony): remove remove service action from app menus (de3bcca) — @tomcdj71
• fix(harmony): make system update checks reliable for the krate user (f7d3f64) — @tomcdj71
• fix(harmony): remove duplicate body background behind scroll backdrop (cd1912b) — @tomcdj71
• fix(harmony): read update-check TTL from env to match compiled prod container (704532b) — @tomcdj71
• fix(harmony): wire SystemUpdateChecker env args in services.yaml (2948879) — @tomcdj71
• fix(harmony): refresh and display runtime app versions on status poll (b7e23c4) — @tomcdj71
• fix(harmony): keep dashboard wallpaper visible while scrolling (58d5c6d) — @tomcdj71
• fix(harmony): throttle background update checks with configurable TTL (7487fa6) — @tomcdj71
• feat(harmony): report and apply KRATE updates from the dashboard (683ec7e) — @tomcdj71
• fix(harmony): dedupe beta branch chip and extend dashboard backdrop (3c5bf18) — @tomcdj71
• feat(harmony): refresh runtime app versions before status snapshot (f7a4be7) — @tomcdj71
• fix(deploy): track composer and pnpm lock files for dashboard install. (0588cfa) — @tomcdj71
• fix(firewall): load admin page from app bundle and fix prod webpack build (26b7fa7) — @tomcdj71
• fix(firewall): display port ranges in admin Firewall page (7202637) — @tomcdj71
• fix(php): rely on package upgrade for 99-krate.ini permissions (95d4e1f) — @tomcdj71
• feat(firewall): add admin Firewall page listing declared open ports (cce2aa4) — @tomcdj71
• docs: update README to remove outdated production layout and stack details (96c50e1) — @tomcdj71
• fix(ui): add pulse animation to status badges for enhanced feedback (19fe95e) — @tomcdj71
• fix(ui): add pulse animation to widget icons for improved visual feedback (eed9a39) — @tomcdj71
• fix(ui): sort App Store search results by name (ca1c8eb) — @tomcdj71
• fix(ui): keep App Store open after job and left-align console output (f98461a) — @tomcdj71
• fix(u...

KRATE 0.6.0 alpha.14

KRATE 0.6.0

Tag	v0.6.0-alpha.14
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.6.0.alpha.14-trixie_amd64.deb	f83da159843c110f8a26247aab8eedbffbf81d0bcb1429d5ddfddaa7995e60a1

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (b26cae3)

• feat(zen): provision HarmonyUI user after zen user add (b26cae3) — @tomcdj71
• fix(systemd): set krate-app-statusd working directory for krate user (eb3150e) — @tomcdj71
• fix(runtime): let krate user refresh versions and run background timers (cce3cbb) — @tomcdj71
• feat(zen): run dashboard::update after zen pull installs a release (217bb01) — @tomcdj71
• feat(version): report runtime app versions via manifest probe cascade (98f863b) — @tomcdj71
• fix(firewall): allow ICMP/ICMPv6 in default-deny input chain. (8a71630) — @tomcdj71
• fix(caddy): add www-data supplementary group for php-fpm socket access. (3228de2) — @tomcdj71
• fix(dashboard): defer var/ www-data handoff until setup finishes. (591e69e) — @tomcdj71
• fix(dashboard): keep var/ writable during HarmonyUI install. (04a29a2) — @tomcdj71
• fix(dashboard): composer install from lock with update fallback on drift. (06ffdab) — @tomcdj71
• feat(crypto): add KRATEH2 handler encryption with slim runtime bootstrap. (53145f6) — @tomcdj71
• fix(dashboard): resolve node PATH and preserve var/ ownership on build (5c791d3) — @tomcdj71
• feat(lifecycle): sync manifest-declared git repos on add and update (981e785) — @tomcdj71
• fix(pull): resolve GitHub release assets when tilde is stored as dot (13055d0) — @tomcdj71
• fix(firewall): do not open default_port/ssl_port in host firewall (bb6690c) — @tomcdj71
• feat(firewall): open autogen ports in zen lifecycle, support port ranges (e026f39) — @tomcdj71
• feat(zen): add firewall CLI command for status and apply (001dbce) — @tomcdj71
• feat(firewall): add setup phase translation keys for firewall init and port open (d61d967) — @tomcdj71
• refactor(firewall): use instance IDs instead of app names for port declarations (b774601) — @tomcdj71
• feat(firewall): add nftables firewall module with per-app port declarations (b20b872) — @tomcdj71
• fix(dashboard): restore www-data ownership on var/ after update (7607d3d) — @tomcdj71
• fix(worker): clear prod cache before messenger worker starts (66d83c5) — @tomcdj71
• fix(worker): set APP_ENV=prod and schema update on dashboard update (e061c14) — @tomcdj71
• fix(dashboard): dump JS translations before HarmonyUI webpack build (53a3505) — @tomcdj71
• fix(templates): track modprobe.d, tmpfiles.d and apt preferences templates (da3a13d) — @tomcdj71
• feat(systemd): add krate-harmony-worker for App Store async jobs (f99d502) — @tomcdj71
• docs: document update_channel and dpkg-based zen pull versioning (9c008e0) — @tomcdj71
• feat(zen): honor update_channel from zenfw.conf for zen pull (79fde07) — @tomcdj71
• feat(zenfw): resolve installed krate version from dpkg (9d1e33e) — @tomcdj71
• fix: update environment variable references in gen_license_signed.sh (45c653a) — @tomcdj71
• fix: link new release repo in core files (807d1de) — @tomcdj71
• docs: update README.md with new release repo (krate-client/krate) (3fde3bd) — @tomcdj71
• chore: reinit console repo (69a4295) — @tomcdj71
• Initial branch (c9b6d7a) — @tomcdj71

setup (1fcf013)

• fix(setup): declare zenfw_conf_finalize_local_permissions after permission_set (1fcf013) — @tomcdj71
• fix(setup): normalize krate runtime permissions for timers and vault (987dff3) — @tomcdj71
• fix(php): restart php instead reload (52b8937) — @tomcdj71
• fix(setup): grant Caddy access to php-fpm socket via listen.acl_users. (1514f67) — @tomcdj71
• fix(setup): pre-declare SSH and web ports before nftables default-deny. (97c0616) — @tomcdj71
• fix(setup): open firewall port 443/tcp for Caddy after nftables init. (3ead361) — @tomcdj71
• fix(setup): ensure var/ is writable by krate before Harmony migrations. (e567056) — @tomcdj71
• feat(setup): wire nftables firewall into SSH/FTP setup phase (ada4ae7) — @tomcdj71
• fix(setup): expose APP_ENV=prod to php-fpm for HarmonyUI (83bc984) — @tomcdj71
• feat(setup): enable HarmonyUI messenger worker after install (1d29000) — @tomcdj71
• docs: document update_channel setup flow in README (9c6ef96) — @tomcdj71
• feat(setup): persist update_channel from krate.conf branch to zenfw.conf.local (2ebf9a7) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (881d1dc)

• feat(harmony): add harmony:create:user console command (881d1dc) — @tomcdj71
• feat(harmony): implement deferred account activation pipeline (35f1706) — @tomcdj71
• feat(harmony): expose account creation policy in general settings (388ca9f) — @tomcdj71
• feat(harmony): add account creation mode and pending password storage (0b2f220) — @tomcdj71
• fix(harmony): read license.json for the license settings page (5002dbd) — @tomcdj71
• refactor(harmony): remove remove service action from app menus (de3bcca) — @tomcdj71
• fix(harmony): make system update checks reliable for the krate user (f7d3f64) — @tomcdj71
• fix(harmony): remove duplicate body background behind scroll backdrop (cd1912b) — @tomcdj71
• fix(harmony): read update-check TTL from env to match compiled prod container (704532b) — @tomcdj71
• fix(harmony): wire SystemUpdateChecker env args in services.yaml (2948879) — @tomcdj71
• fix(harmony): refresh and display runtime app versions on status poll (b7e23c4) — @tomcdj71
• fix(harmony): keep dashboard wallpaper visible while scrolling (58d5c6d) — @tomcdj71
• fix(harmony): throttle background update checks with configurable TTL (7487fa6) — @tomcdj71
• feat(harmony): report and apply KRATE updates from the dashboard (683ec7e) — @tomcdj71
• fix(harmony): dedupe beta branch chip and extend dashboard backdrop (3c5bf18) — @tomcdj71
• feat(harmony): refresh runtime app versions before status snapshot (f7a4be7) — @tomcdj71
• fix(deploy): track composer and pnpm lock files for dashboard install. (0588cfa) — @tomcdj71
• fix(firewall): load admin page from app bundle and fix prod webpack build (26b7fa7) — @tomcdj71
• fix(firewall): display port ranges in admin Firewall page (7202637) — @tomcdj71
• fix(php): rely on package upgrade for 99-krate.ini permissions (95d4e1f) — @tomcdj71
• feat(firewall): add admin Firewall page listing declared open ports (cce2aa4) — @tomcdj71
• docs: update README to remove outdated production layout and stack details (96c50e1) — @tomcdj71
• fix(ui): add pulse animation to status badges for enhanced feedback (19fe95e) — @tomcdj71
• fix(ui): add pulse animation to widget icons for improved visual feedback (eed9a39) — @tomcdj71
• fix(ui): sort App Store search results by name (ca1c8eb) — @tomcdj71
• fix(ui): keep App Store open after job and left-align console output (f98461a) — @tomcdj71
• fix(ui): replace xterm with scrollable log panel in App Store (37a5144) — @tomcdj71
• fix(ui): read zen job status from SQLite and improve job console (b4910a8) — @tomcdj71
• fix(api): pin ZenJobMessageHandler DI wiring for prod container (716cb44) — @tomcdj71
• ...