v0.15.0 — rotate monitoring secrets in place

Record your screencast with the push URL on screen, then press one key and it's dead: r rotates a vanity site's monitoring secrets in place — no monitor deleted, no history lost. Plus vanity sites now stand out in the Servers tab.

Highlights

• Rotate monitoring secrets (r in the m overlay). Two secrets can end up on screen in a recording: the Kuma push URL (Kuma displays it in full) and the health key in a ?format=json&key=… URL. r on a vanity site mints fresh ones and kills the old ones immediately — a new push token is edited into the existing push monitor (same monitor row: heartbeat history, uptime stats and notification wiring all survive), the heartbeat cron is rewritten over SSH, a new health key is re-seeded into the page, and any Kuma monitor URL still embedding the old key is re-keyed automatically. Confirm-gated; expect at most a missed beat or two, absorbed by the monitor's retries.
• Works without Kuma too. Unconnected, r still rotates the health key (there's no push monitor to edit) and says so.
• Vanity sites stand out in the Servers tab. The server's own vanity/health page is marked ⌂ with a brand-green tint in the sites list — with servers named like domains (the vanity convention), it otherwise hides among regular sites.

Notes

• Rotation never deletes or re-creates monitors — it uses Kuma's edit API, so dashboards, status pages and notification assignments keep pointing at the same monitor.
• The old push URL stops accepting beats the moment the rotation lands; the old health key starts returning 403 as soon as the page is re-seeded.
• Acceptance-tested against a live Uptime Kuma instance and a real server: history intact across rotation, old secrets verified dead, new heartbeat flowing within a minute.

Update: press u in ? Help, or git pull in your checkout. No new dependencies.

Full changelog: v0.14.0...v0.15.0

🤖 Generated with Claude Code