v1.17.0

Changelog

• 5f08bf9 Allow a dedicated HTTPS port for the tailnet UI API
• 2ecd579 Authenticate reverse-proxied browser UI with paired sessions
• 51c4f49 Default Codex launches and resumes to inline scrollback
• 1a904ad Document mobile scrolling without cursor-key fallback
• 1e64922 feat(app): approve a waiting browser from its notification (td-ba7a17)
• 430ce84 feat(cli): sidecar api requests, approve, deny and devices (td-ba7a17)
• 9d52b93 feat(cli,app): say so when several browsers are waiting (td-ba7a17)
• c0492de feat(filefind): expose shared project finder API and CLI (td-de0865)
• 688998a feat(notifications): batch read and dismiss as one store change (td-e33667)
• 9ec2d4a feat(uiapi): approve a new browser by code from a trusted surface (td-ba7a17)
• 947d5e5 feat(uiapi): describe notification settings for forms
• 92712cc feat(uiapi): direct Tailnet listener with per-connection Tailscale identity (td-accec4)
• 4cd354e feat(uiapi): the pairing page names the browser it pairs (td-2c67b6)
• bc54891 feat(uiapi,cli): record the device a tailnet login approved from (td-360913)
• f2cb8a5 feat: start inactive workspace terminals through CLI and API
• d0fdfee fix(contentservice): a lingering helper is not a failure; cancellation is not a refusal (td-e4be7d)
• 47b6e37 fix(contentservice): stop issue reads when the API request is cancelled (td-ea81ec)
• 28e3dca fix(filefind): choose exact best alignments and preserve highlights (td-eea315)
• b9b8464 fix(mobile): reduce catalog CPU, bound owner lifetime and reuse streams (td-317486, td-e45164, td-97f393)
• 1a3fe4c fix(notifications): apply forwarded episodes in wire order (td-d26d51)
• 9c1d7e4 fix(notifications): cap a batch at 1000 ids to stay inside the body limit (td-e33667)
• c7f43c9 fix(notifications): refuse id and ids together on read and dismiss (td-e33667)
• 5d1c610 fix(notifications): share remote transition ingestion with headless API (td-d26d51)
• 33f4a0f fix(notify): access requests offer no calls to action (td-ba7a17)
• 2003f8a fix(projectdir): share missing-ancestor resolution without stale identity (td-317486)
• a407d80 fix(shellstate): restore a deleted shell under a free name (td-86f2b2)
• 630757a fix(terminal): make shell exit final and refresh catalog promptly (td-28824e, td-281f69)
• ca376a5 fix(terminal): observe silent retained pane exits (td-28824e, td-281f69)
• 5738290 fix(ui-api): acknowledge applied viewer actions and expose notification centre (td-b5d9c5 td-d26d51 td-8e1394)
• df2c569 fix(ui-api): advertise notification negotiation and honor qualified projects (td-d26d51)
• c55f0ed fix(ui-api): fence expired relays and preserve notification workspace ownership (td-b5d9c5 td-d26d51)
• 30bd905 fix(uiapi): bound only the body read; stale codes and stored labels (td-ba7a17)
• 7beca38 fix(uiapi): close the Phase B review's low findings (td-f85236)
• e9106be fix(uiapi): close the access review's findings (td-ba7a17)
• 5dfb53b fix(uiapi): free content-read slots promptly when a client abandons a read (td-e4be7d)
• 8dbefd1 fix(uiapi): harden direct Tailnet admission after security review (td-accec4)
• 52f2f03 fix(uiapi): ignore a serve-mode Tailnet socket in direct mode instead of refusing to start (td-accec4)
• e464bd1 fix(uiapi): refuse a non-DNS node name and log unreadable serve routes (td-accec4)
• a569810 fix(uiapi): report an approval as the registration stores it (td-ba7a17)
• 4b39a6f fix(workspace): discover live shells without a locale
• b9b9d92 fix: refresh shared workspace catalog after mutations
• cc4182a release: prepare v1.17.0
• e67f452 test(app): lock bind lease claim across every live sibling session
• b1ee0d1 test(cli): use /tmp for the private-server shell-end test so it runs on Linux
• 98447fe test(mobile): carry tool paths into private SSH owner proof (td-e45164)