v0.18.0

Added

• WebSocket Binary Frame Integrity & Socket Parser Detachment: Fixed binary frame corruption for ttyd web terminal sandboxes and VNC desktops by piping raw Buffer chunks directly. Detached Node's internal HTTP parser (socket.parser = null) on upgrade requests to eliminate 1006 Connection ended parser errors. See ADR-028.
• Cross-Runtime Real Client WebSocket Test Suite: Added src/server/ws-e2e.test.ts to test real WebSocket client connections against the BFF proxy (tty subprotocol negotiation, binary frame echoing, and BASE_URL routing). Documented Bun node:http upgrade socket write limitations (test.skipIf(isBun)). See ADR-029.
• UI Profile Submenu Actions & Manual Sync Controls: Moved the Auto-Relogin toggle into the profile dropdown submenu and added a prominent manual refresh button ([ 🔄 Sync ]) with active loading state indicators. See ADR-030.

v0.17.0

Added

• Non-Admin Workspace Concurrency Limits (MAX_WORKSPACES_PER_USER): Introduced --max-workspaces-per-user CLI option and MAX_WORKSPACES_PER_USER environment variable setting (defaults to 0 for unlimited). Limits the maximum number of concurrent active workspaces a non-admin user can own. Administrators bypass quota limits. See ADR-026.
• Template Role & Scope Authorization Annotations (nogoo9/allowed-roles & nogoo9/allowed-scopes): Added template annotations to restrict workspace creation from specific pod templates to users possessing required OIDC roles or scopes. Evaluates using strict AND logic. Administrators bypass template annotations. See ADR-027.
• Template Discovery Metadata: Extended list_templates and get_template tool outputs to expose allowedRoles and allowedScopes metadata arrays for UI clients.
• E2E Test Suite for Limits and Templates: Added scripts/test-e2e-workspace-limits-and-templates.ts to test quota limits, admin quota bypass, template authorization annotations, and resource cleanup.

v0.16.0

Added

• Admin User Whitelist (AUTH_ADMIN_USERS): Added support for an AUTH_ADMIN_USERS environment variable specifying a comma-separated list of user subject IDs (sub). Authenticated callers matching the whitelist bypass OIDC client scope and role claim checks to gain administrator privileges (isAdmin = true). Note: This is an administrative workaround for unmapped IdP scopes.

v0.15.0

Added

• Deep Wiki Knowledge Base & Strategy: Created 8 comprehensive Deep Wiki articles under docs/wiki/ and established /generate-deep-wiki strategy workflow for automated codebase auditing, architecture diagramming, and VitePress navigation updates.
• Automatic ADR Discovery: Added dynamic ADR auto-discovery (syncAdrs()) to scripts/update-docs.ts to automatically register new Architecture Decision Records in docs/.vitepress/config.ts on build.
• Repeatable Documentation Accuracy Audit: Created /audit-docs-accuracy workflow to systematically audit tool parameters, configuration tables, pod annotations, and state machine flowcharts against codebase truth.
• Import Boundary & Path Alias Envariant: Added bun run lint (scripts/check-imports.ts) to format, commit, and pre-push quality gates, enforcing project path alias (~/) invariants across src/ modules.

Changed

• Server Subsystem Modularization: Refactored src/server/ into decoupled modules (sse.ts, auth-singleflight.ts, routes/proxy-auth.ts, routes/proxy.ts), improving code readability and maintainability.

v0.14.0

Added

• Multi-User Upgrade Authorization & Access Control: Enforced strict RBAC permission scoping for template upgrades — upgrade_all_workspaces is restricted exclusively to administrators (Forbidden for non-admins), while normal users can only upgrade their own workspaces 1-by-1 (Access Denied for cross-user non-admin upgrades).
• Owner Identity & Routing Preservation: Ensured single and bulk workspace upgrades retain original workspace owner identities (nogoo9/user-sub) and URL routing endpoints (workspacePath/previewPath) across all user and administrator upgrades.
• AsyncLocalStorage Context Propagation: Preserved caller JWT identity and role context across /mcp HTTP JSON-RPC tool dispatch bounds via requestContextStore.
• Multi-User E2E Upgrade Test Suite: Expanded E2E validation script (scripts/test-e2e-upgrade.ts) to test non-admin rejections, admin cross-user upgrades, owner retention, full upgrade lifecycle completion (old pod termination, upgraded env marker verification), and RWO PVC recreate-style upgrade fallback.

Security

• Updated Core Dependencies: Upgraded direct dependencies (@fastify/static to v10.1.2, @modelcontextprotocol/sdk to v1.30.0) and patched transitive security advisories (body-parser, vite, esbuild) to achieve a 100% clean security audit.

v0.13.0

[0.13.0] — 2026-07-07

Added

• Template Version & Outdated Display in UI: Added template version indicators and update arrows (e.g. v1.0.0 → v1.1.0) on both workspace cards and the console view specs card.
• Upgrade Failure Display in UI: Added inline alert boxes on workspace cards and the console specifications panel to show the latest upgrade error annotation (nogoo9/last-upgrade-error).
• Upgrade Demo Tasks: Added moon run mcp:trigger-upgrade-demo and moon run mcp:revert-upgrade-demo tasks to k3d, introducing a 30s initContainer delay to easily witness the upgrade transition process.

Fixed

• Aligned Workspace Upgrade Status: Fixed an inconsistency where get_workspace bypassed reconcileUpgradeTransition and returned the raw first pod, resulting in incorrect status reporting and skipping dynamic reconciliation cleanups during upgrade.

v0.12.0

[0.12.0] — 2026-07-06

Added

• Non-Blocking Workspace Template Upgrades (ADR-024): Implemented asynchronous background upgrade processing for running workspaces, allowing long-running workspace migrations to run without client-side timeouts.
• RWO Volume Recreate Fallback: Automatically fallback to recreate-style upgrades when PersistentVolumeClaims (PVCs) use ReadWriteOnce mode, preventing multi-pod mounting conflicts.
• Upgrade Failure Logs: Added a nogoo9/last-upgrade-error annotation to preserve detailed logs on the old pod if a background upgrade fails.
• Upgrades Documentation: Added a dedicated VitePress guide for workspace upgrades and template versioning.

Changed

• Spawner Module Consolidation: Refactored and incorporated spawner entry point (src/mcp/spawner.ts -> src/mcp/spawner/index.ts) and test files into the spawner sub-package directory.
• Simplified Handler Architecture: Modularized handler code in src/mcp/spawner/handlers.ts to delegate to extracted helper modules in helpers.ts.

Security

• CVE Mitigation & Package Hardening: Upgraded nested dependencies (dompurify, form-data, undici) to secure versions via overrides/resolutions.

[0.11.1] — 2026-06-14

Fixed

• Cookie TTL Alignment: nocr_token cookie Max-Age is now derived from the JWT exp claim and nocr_refresh from the IdP's refresh_expires_in field, preventing stale cookies from outliving their tokens. Configurable fallbacks via PROXY_TOKEN_COOKIE_TTL and PROXY_REFRESH_COOKIE_TTL.
• Stale Refresh Cookie Cleanup: When the IdP rejects an expired refresh token (invalid_grant), the gateway immediately clears the nocr_refresh cookie to prevent repeated futile round-trips.
• Refresh Token Rotation Safety: Added singleflight deduplication to performTokenRefresh — concurrent requests for the same refresh token share a single IdP round-trip, preventing race conditions with strict refresh token rotation.

v0.11.1

[0.11.1] — 2026-06-14

Fixed

• Cookie TTL Alignment: nocr_token cookie Max-Age is now derived from the JWT exp claim and nocr_refresh from the IdP's refresh_expires_in field, preventing stale cookies from outliving their tokens. Configurable fallbacks via PROXY_TOKEN_COOKIE_TTL and PROXY_REFRESH_COOKIE_TTL.
• Stale Refresh Cookie Cleanup: When the IdP rejects an expired refresh token (invalid_grant), the gateway immediately clears the nocr_refresh cookie to prevent repeated futile round-trips.
• Refresh Token Rotation Safety: Added singleflight deduplication to performTokenRefresh — concurrent requests for the same refresh token share a single IdP round-trip, preventing race conditions with strict refresh token rotation.

v0.11.0

[0.11.0] — 2026-06-12

Added

• Health Check Dependent on Session Key Resolution (ADR-022): Blocked gateway healthcheck readiness endpoints (/healthz and /mcp/healthz) until the shared session signing key is successfully negotiated and available in the pod. Unresolved keys return a 503 Service Unavailable error, preventing traffic routing by Kubernetes to uninitialized replicas.
• Proxy Keep-Alive Configuration: Added a runtime config variable PROXY_KEEP_ALIVE (defaults to true) and attached a keep-alive http.Agent to the routing proxy when active to reduce TCP handshake overhead for downstream workspace resources.
• Peer Discovery Integration & Verification Script: Created an E2E validation script (scripts/e2e-peer-discovery.sh) to test multi-replica leader/follower negotiation, validating that replicas simultaneously negotiate and share the exact same session key.

Changed

• Startup Sequence Documentation: Updated user guides and getting-started tutorials with a comprehensive Mermaid sequence diagram mapping the pod's boot, leader selection, fallback file negotiation, and readiness health-check validation.

v0.10.0

[0.10.0] — 2026-06-12

Added

• Fine-Grained Permissions & Scope Checks (ADR-020): Refactored the authorization engine to support granular permissions checking. Promoted standard Readers (viewer role) to allow starting and stopping their own sandboxes, while Writers (user role) can additionally create and edit templates. Bypassed scope validation for credentials that completely lack a scope claim.
• Template Creator Tracking & Immutability (ADR-020): Stamped all dynamic ConfigMap templates with the creator's user subject (nogoo9/user-sub). Standard users can only update or delete templates created by them, while local filesystem-loaded templates are made fully immutable and protected against updates or deletions.
• Workspace API Routing & Visibility Annotations (ADR-021): Created a dedicated specification for dynamic workspace sub-API annotations. Added support for scope:<scope_name> and role:<role_name> visibility checks, allowing developers to restrict access to subpaths to callers possessing specific OIDC scopes or roles.
• UI Workspace & Template Permissions Adaptation (ADR-020): Enhanced the React dashboard to display creator metadata, conditionally enable template deletion (trash icon) and workspace stop/upgrade actions according to the authenticated user's permissions and roles.

Fixed

• Admin Visibility Check Fix: Fixed a bug where the allowed status was not assigned in the proxy authentication handler (auth.ts) and WebSocket upgrade proxy (ws-proxy.ts) when API visibility was set to "admin", resolving access issues for administrator accounts on restricted endpoints (such as stats or last_activity).