v0.8.1

Fixes

• Groups that only the login app asserts now admit mesh users. On a Spot with both mesh identity and delegated login, a restricted site whose allowlist names a group the mesh does not know (such as a platform-wide group, a team or a group) refused every viewer with 403, because the mesh identity was used and sign-in never started. Such a viewer now goes to sign-in, like an anonymous visitor: page loads redirect to the login app and other requests answer 401. Viewers the allowlist admits by their mesh identity still open the site without signing in, and refused signed-in or forward-auth viewers still get 403. #30
• A deploy refused after authorization (a bundle without index.html, preserve_access=require with no stored policy, or a site type conflict) no longer moves the site to the top of sort=updated listings or advances its content generation. #28

Images

docker pull ghcr.io/melonamin/spot-api:0.8.1
docker pull ghcr.io/melonamin/spot-caddy:0.8.1

See the changelog for the full list of changes.

v0.8.0

Highlights

• Ship reusable site types. A platform admin uploads a type once: a viewer page, its assets, an optional SKILL.md for agents, and a type.json that declares which data paths an instance may hold. Every site built on the type then deploys only its data, and the viewer stays fixed. Versions are immutable, can be yanked and un-yanked, and are listed with their instructions and a preview package through /api/types. #27
• Pin a viewer version, or follow a major. A typed site serves an exact version by default. A manager can switch it to follow new releases within its major, and following only moves forward: yanking a broken release stops new pins, and a fixed patch moves followers on. PUT /api/sites/{name}/type repins, and a deploy can repin and migrate its data in one step with type_target. #27
• Edit typed sites safely. Deploys name the type version they were written for, so an edit prepared against an older viewer cannot silently undo a repin. Source downloads report the version in X-Spot-Type, and deploy events carry site_type so open pages reload after a repin. #27
• Manage types from the CLI. spot deploy --type name@version, with --type-target, --follow major or --pinned, plus spot types list|show|skill|pull|upload|yank|unyank|repin. The gallery and My spots show each site's type, and examples/types/card is a small type to start from. #27

See docs/site-types.md for the package format, the API, caching rules and viewer conventions.

Breaking change

Every site, typed or not, now answers 400 for request paths that contain an empty segment (//), a . or .. segment, an encoded separator (%2F, %5C), a backslash or a control character. Before, // and dot segments redirected to the cleaned path, %2F was decoded and served as /, and %5C answered 404. Browsers resolve dot segments before sending a request, so this mostly affects raw HTTP clients and pages that build URLs with a double slash.

Upgrade notes

• The schema change is additive and applied at startup: SQLite gains the site_type_versions table and three sites columns, and existing sites stay untyped. Type packages are stored under a new _types/ root in the sites bucket or the local sites directory. Back up the database and site storage together, including _types/.
• Rolling back to 0.7.0 is not a binary swap once typed sites exist: 0.7.0 starts and serves ordinary sites, but typed sites lose their viewer, and a deploy made under 0.7.0 is hidden again after re-upgrading. Restore a pre-upgrade backup instead. See Upgrade and rollback.
• Typed sites cannot be published to Cloudflare Pages. Unpublish a site before converting it to a typed site.
• Type uploads, yanks and repins share the deploy rate limit. Proxies that prove the forward-auth secret are exempt, as for deploys.

Images

docker pull ghcr.io/melonamin/spot-api:0.8.0
docker pull ghcr.io/melonamin/spot-caddy:0.8.0

See the full changelog or compare v0.7.0...v0.8.0.

v0.7.0

Highlights

• Added paging and filters to the site listings. GET /api/sites/mine, manageable, public, and visible take limit and cursor plus q, tag, names, yours, and sort, and report total, matched, and next_cursor. Cursors are keyset positions, so a redeploy between requests never repeats a site already returned. spot.sites.page() wraps the paged API. (#26)
• The gallery and My spots load a page at a time, with search, tags, saved spots, and sort applied on the server, and fetch more as you scroll. Listings check screenshots and internet-publishing status only for the returned page and resolve access policies in parallel, so large installs browse much faster.
• Files that mention /api/ in prose, such as documentation describing endpoints, can now be published to the internet; only URLs in code are flagged.
• Built with Go 1.26.9, which fixes standard library vulnerabilities reachable from the server. (#26)

Compatibility notes

Requests without limit or cursor still return the whole filtered list, and the new response fields are additive, so existing clients keep working. Pass next_cursor back with the same filters and sort; a cursor from another sort is refused. See the README for the listing parameters.

Images

docker pull ghcr.io/melonamin/spot-api:0.7.0
docker pull ghcr.io/melonamin/spot-caddy:0.7.0

See the changelog for the full list of changes.

v0.6.3

Changes

• chore(release): v0.6.3 (d8687dc)
• Release a deleted site name only with an explicit admin request (#25) (b01d8da)

Images

docker pull ghcr.io/melonamin/spot-api:0.6.3
docker pull ghcr.io/melonamin/spot-caddy:0.6.3

v0.6.2

Changes

• chore(release): v0.6.2 (7b28b81)
• Keep deleted site names with their owner; no-store for restricted content (#24) (f07e5b6)

Images

docker pull ghcr.io/melonamin/spot-api:0.6.2
docker pull ghcr.io/melonamin/spot-caddy:0.6.2

v0.6.1

Changes

• chore(release): v0.6.1 (928bb5b)
• Sites hardening: hidden access policy, auth before upload, preserve_access=require (#23) (4afad48)

Images

docker pull ghcr.io/melonamin/spot-api:0.6.1
docker pull ghcr.io/melonamin/spot-caddy:0.6.1

v0.6.0

Highlights

• Added delegated login for embedding applications. Restricted sites can use short-lived, single-use sign-in tokens and per-site sessions. Configurable frame ancestors, apex redirects, and Caddy on-demand TLS checks support embedded deployments. (#22)
• Added PUT /api/sites/{name}/access to update a site's access policy without redeploying, GET /api/sites/visible, and access rules in site listings. (#22)
• Site updates that omit _access.json now preserve the stored access policy. Use spot deploy --replace-access, preserve_access=false, or Clear in the web deployer to remove it. (#22)
• Site hosts now serve uploads only for their own site; the apex can still serve uploads across sites. (#22)
• Formatted storage usage on the stats page and kept the homepage GitHub link aligned with the other header actions. (#21)

Configuration notes

Delegated login uses SPOT_LOGIN_URL; the login application must copy the redirect's state into the token's state claim. It requires HTTPS or *.localhost. SPOT_FRAME_ANCESTORS and SPOT_APEX_REDIRECT_URL are optional. See the README for setup details.

Images

docker pull ghcr.io/melonamin/spot-api:0.6.0
docker pull ghcr.io/melonamin/spot-caddy:0.6.0

See the changelog for the full list of changes.

v0.5.0

Highlights

• Deploy safely from CI. Named, repository-scoped publishing keys can create and update sites under one fixed prefix, preserve human ownership, show trusted publisher attribution, and be rotated or revoked in /spots. #20
• Build richer Spot Show reports. Reports now have structural validation, safe local image bundling, stable links, themes, fullscreen Mermaid and images, sandboxed HTML, line-numbered highlighting, ANSI terminal output, split diffs, and trace timelines. #18
• Get dependable gallery previews. Screenshot capture now prefers the headless shell, waits for deferred rendering, validates completed PNGs, and uses bounded process shutdown. #19
• See clearer deployment attribution. NetBird peer names replace raw IP addresses where available.

Upgrade notes

There are no breaking configuration changes. Existing databases gain publishing-key tables through additive startup schema setup. Publishing keys authenticate deploy requests but do not provide network access; CI still needs a routable HTTPS path to the Spot apex.

Contributors

Thanks to @DmitriyAlergant for diagnosing and fixing screenshot capture reliability in #19.

Images

docker pull ghcr.io/melonamin/spot-api:0.5.0
docker pull ghcr.io/melonamin/spot-caddy:0.5.0

See the full changelog or compare v0.4.0...v0.5.0.

v0.4.0

Highlights

• Publish eligible sites to Cloudflare Pages with public or email-restricted access, durable ownership tracking, reload-safe jobs, and recovery flows in /spots. See #14 and #15.
• Delegate site management through _access.json maintainers without giving up the original owner's permanent recovery claim. Manageable-site APIs and recovery tombstones preserve safe lifecycle semantics. See #17.
• Build, deploy, and watch Spot Show report sites containing Markdown, Mermaid, diffs, terminal output, JSON, images, and sandboxed HTML. See #10.
• Explore aggregate platform activity on the new public /stats page and follow common workflows in the responsive /help field guide. See #11 and #16.
• Capture gallery previews during Spot Show deploys, filter saved spots, and use request-aware agent instructions that can be copied in full without an external fetch. See #13.

Fixes

• Preserved uploaded files' original content types when serving them.
• Improved gallery cards with separate author attribution, stable row sizing, and safer text wrapping.
• Bounded generated Cloudflare Pages project names to the provider's length limit.

Upgrade notes

This release has no breaking configuration changes. Existing site rows migrate to the active lifecycle state, and existing _access.json files remain valid; omitting maintainers grants no additional authority.

Cloudflare Pages publishing is optional and remains disabled until all required SPOT_CLOUDFLARE_* values are configured. The repository includes scripts/setup-cloudflare-pages-token.sh to create the runtime token and email one-time PIN identity provider.

Contributors

Thanks to @Codeabunga for the request-aware agent instructions and full-copy workflow in #13, and @mishamsk for the initial Cloudflare Pages publishing implementation.

Images

docker pull ghcr.io/melonamin/spot-api:0.4.0
docker pull ghcr.io/melonamin/spot-caddy:0.4.0

See the full changelog or compare v0.3.0...v0.4.0.

v0.3.0

Highlights

Spot v0.3.0 adds forward-auth identity support, an outgoing Slack message proxy, and a richer public gallery with site metadata, tags, AI tag suggestions, screenshots, and backfill tooling for existing deployments.

Added

• Identity — support deployments behind an authenticating reverse proxy with forward-auth identity headers. (#7)
• Slack integration — spot.slack.send sends visitor opt-in Slack messages through a server-side bot token. (#8)
• Gallery — _spot.json, extracted HTML titles/descriptions, public tag chips, and tag-aware gallery search/filtering. (#9)
• Gallery — optional AI tag suggestions for public sites without explicit tags.
• Operations — gallery backfill command for metadata, _spot.json, and optional screenshots without redeploying or changing ownership.

Fixed

• Hardened deploys that add, remove, or broaden _access.json policies so metadata and policy caches remain fail-closed if storage updates fail.
• Fixed gallery title sorting and source-download controls for titled sites and touch devices.
• Fixed gallery card layout with fixed-height cards and scrollable tag rows.
• Kept Chromium available for screenshot generation without carrying it into the runtime image.

Images

docker pull ghcr.io/melonamin/spot-api:0.3.0
docker pull ghcr.io/melonamin/spot-caddy:0.3.0

Also published as :0.3 and :latest (multi-arch: linux/amd64, linux/arm64).

Full changelog: v0.2.0...v0.3.0