1.3.0 — Companion

A zero-dependency terminal companion for the cockpit.

pipx install "git+https://github.com/ninabot-ch/sokkan"
sokkan login http://localhost:3009

sokkan spawn "add pagination to GET /notes"   # memory recall first, waits for your go
sokkan status · sessions · board · mem · note · digest · health
sokkan card "fix the flaky test" --spawn

Spawn and inspect from the terminal — approvals stay in the cockpit, the HITL boundary doesn't move. Local-token auth; single stdlib-only file.

Install/upgrade: curl -fsSL https://sokkan.ch/install.sh | sh

1.2.0 — Open helm

Multi-provider, a self-summarizing memory, and an easier first contact.

• Multi-provider models: point sessions at any Anthropic-compatible endpoint (Kimi/Moonshot, GLM/Z.AI, DeepSeek, or a local LiteLLM→Ollama proxy) from Profile → Model — base URL + key + model, applied per session, presets included. Sessions still run the Claude Code engine.
• Priority notes: mark a durable fact priority: high — recall boost, ★ in the cockpit, tops the generated MEMORY.md.
• Memory digest: one click spawns a session that condenses the whole memory (+ recent git history) into a project-status note.
• Knowledge graph: the Memory/KB tab renders the [[wikilinks]] as an interactive force-directed map — no dependencies added.
• Sample workspace: examples/fastapi-notes/ — a tiny FastAPI project plus the memory notes that make recall click, with a board-seeding script.
• scripts/doctor.sh: read-only install checkup (prereqs, .env, stack health).
• CI cross-builds both images for linux/arm64; new integration tests for the critical flow (spawn → memory pre-seed → tool approval) and the LLM modes.

Meet Nina 🧭

This release also ships Nina (S1), the embedded DevOps assistant — a floating 🧭 in the cockpit that knows the product inside out (sessions, memory, fleet, runbooks) and answers right next to your work.

• Strict guardrails: she never sees your secrets or your code, and touches nothing — she guides, you hold the helm.
• SOKKAN Cloud: included on every instance, zero setup, from your first login — with Swiss sovereignty, mandatory: wherever Nina has access to your context, her inference runs on Infomaniak's AI API, hosted in Switzerland — non-negotiable, never retained, never used for training.
• Self-host: she ships in this repo — enable SOKKAN_FEATURE_ASSISTANT=1 and point her at the model of your choice.
• She also answers product questions on sokkan.ch before you ever install.

Install/upgrade: curl -fsSL https://sokkan.ch/install.sh | sh

SOKKAN v0.2.0 — hardening

Hardening release — security, robustness and open-source hygiene ahead of wider use. 15 atomic commits, full details in #1.

⚠️ Upgrading from v0.1.0

The api container now runs as a non-root user (uid 1000). Data volumes created by v0.1.0 are owned by root — fix once before starting:

docker compose run --rm --user root api chown -R 1000:1000 /data
docker compose up -d --build

(A fresh install needs nothing.)

Security

• SSRF guard on preview screenshots — targets are resolved before Chromium runs; private, loopback, link-local and cloud-metadata addresses are refused (SOKKAN_PREVIEW_ALLOW_PRIVATE=1 to opt out)
• Feature flags enforced server-side — preview/tmux endpoints 404 when disabled; /api/features is only a UI hint
• Rate-limited local login — 5 failures/min per client IP
• WebSocket Origin verification + removal of the CORS wildcard
• Non-root api container + no-new-privileges on both services + healthcheck
• SOKKAN_DEFAULT_ROLE — set to none to reject authenticated-but-unknown emails with 403

Robustness & performance

• Memory reindexing runs in-process (warm embedding model, corpus change detection) — the API serves immediately on boot instead of blocking on the first index
• SDK session history rehydrates from the persisted transcript on refresh (no longer capped by the WS ring buffer)
• DB schemas initialize once per process; fire-and-forget asyncio tasks hold strong references
• Standalone Next.js image (smaller, runs as node)

Open source

• CI (lint, tests, docker smoke), 19 unit tests, CONTRIBUTING.md, issue templates
• Security model section in the README — container boundary, roles, SSRF policy, no telemetry
• All user-facing API messages in English

Install / upgrade: curl -fsSL https://sokkan.ch/install.sh | sh · Apache-2.0 · self-hosted · BYOK

SOKKAN v0.1.0 — first public release

First tagged release of the public SOKKAN container (v0).

SOKKAN is a self-hosted web cockpit for running multiple Claude Code sessions in parallel, with your project memory automatically injected into every session at spawn. The helm, not the autopilot.

Highlights

• Memory auto-injection at spawn — the task description seeds a semantic search (local ONNX embeddings, SQLite — no external service, no telemetry) over the memory notes your sessions write
• Sessions — multi-pane chat grid on the official Claude Agent SDK; permission prompts and questions render as buttons — nothing irreversible without a click
• Board — kanban cards spawn pre-seeded sessions (priorities, due dates, checklists)
• Costs — per-day / per-session token usage and estimated API cost from the transcripts
• Journal — audit trail of every action
• Bundled MCP servers — sessions can search the memory and create/move board cards themselves
• Works with an Anthropic API key or a Claude Pro/Max subscription (claude setup-token)

Install

curl -fsSL https://sokkan.ch/install.sh | sh

(sovereign distribution from sokkan.ch — no GitHub dependency; or clone this repo and docker compose up -d --build, see the README)

Requirements

Linux or macOS (Docker Desktop/OrbStack), Docker Engine 24+ with Compose v2 (the installer can install it), ~4 GB RAM, ~3 GB disk.

Apache-2.0 · self-hosted · BYOK — free without limits.
A managed Swiss sovereign cloud offering is in preparation.