SpaceApp setup 1.1.5

SpaceApp setup 1.1.5 answers the independent reviews of 1.1.4: no credentialed CORS for other local origins, optional modules off by default in new installs, a purpose-bound credential key, a provenance check for this public tree, and every workspace test suite in public CI.

Install: npx --yes run-spaceapp@latest · Update: npx --yes run-spaceapp@latest update

Source: sanitized Space app @ 2a53fd9793 (4255 files). Addresses the
independent reviews of 1.1.4; open items are listed in
docs/quality/KNOWN_LIMITATIONS.md.

Security

• The API no longer grants credentialed CORS to other local origins, and
  rejects session requests that browser fetch metadata (or the Origin header)
  marks as another site. A page on another 127.0.0.1 port can no longer
  read the CSRF token or use your session.
• /metrics answers only loopback scrapers and administrators.
• Child processes (agent CLIs, demo projects, browsers, git) no longer receive
  the session secret or the database URL.
• Stored database passwords use a purpose-bound key; an unreadable password is
  reported instead of being used blank. Backups no longer carry the Google
  OAuth client or Telegram secrets.
• Admin Mode refuses to delete direct children of system roots and the
  workspace with its parents, and every Admin Mode file change is audited.
• Third-party images (PostgreSQL, Temporal, codex-lb) are pinned by digest.

Changed

• The UI no longer calls SpaceApp open source: it is source-available (BSL)
  until its Change Date, as the LICENSE says.
• Optional modules: the games, Job, Mail and Marketing Copilot, Slack/Teams
  channels, Telegram, the waitlist and the desktop update routes run only when
  enabled. New installs start with none of them; an upgraded installation keeps
  all of them. Change the optionalModules field of the launcher's
  config.json (all, none or a list such as job-copilot,games) and run
  spaceapp repair (see docs/operations.md).
• A multi-file upload that fails part-way reports which files were saved.
• npm test runs every exported workspace suite; the quality evidence
  (docs/quality/) ships with the code, and
  scripts/verify-export-provenance.mjs checks this tree against its export
  manifest.

Fixed

• When the first-launch free-model check fails, OpenCode still gets the
  installation instructions and its permission for the memory folder, so the
  first task no longer stops at an "Access external directory" prompt. The
  check runs again on the next launch.
• OpenCode may read /etc (read-only in the CLI container, where its startup
  instructions live) without asking; models that read the installation guide
  from there themselves no longer stop the first task at a permission prompt.
• A Claude Code login imported with a configuration bundle also marks Claude
  Code as onboarded, so its pane no longer repeats the first-run login screens.
• A configuration backup exported from a newer SpaceApp now imports what this
  version knows: settings and entries it does not recognise are skipped and
  named in a warning, and a file with a broken structure is still refused.

Known limitations

• WebSocket handshakes (the VNC stream and the shared-chat socket) do not yet get the same-site Origin
  check that 1.1.5 added for other requests, so a page on another local port of the same machine could
  open them with your session, as in 1.1.4. Fixed for 1.1.6. Until then, do not browse untrusted local
  pages in the browser profile you use for SpaceApp.
• OpenCode Zen's free tier can refuse requests for a while ("OpenCode's free tier can only be used from
  within OpenCode"). This is an upstream condition; in the 1.1.5 lab it hit the first prompt of a brand-new
  installation three times and cleared on its own. Retry later, or connect a provider with /connect.
• On the small profile the CLI container has 2 GiB. Two or more OpenCode panes working at once can reach
  that limit; in the 1.1.5 lab one run ended with an out-of-memory kill in the CLI container. Use the
  medium profile (3 GiB) for several simultaneous OpenCode panes. Capacity work for small is planned for 1.1.6.
• If an install fails and its data cannot be purged, installing again into the same folder reuses the old
  database volume and fails with a PostgreSQL authentication error. Run spaceapp uninstall --purge-data
  for that folder first (or install into another folder). 1.1.6 will detect this case.
• PostgreSQL and Temporal are now pinned by image digest. --local-images (offline use) never pulls, so an
  offline machine must have those exact digests loaded; otherwise an update stops with RECOVERY_REQUIRED and
  keeps the data. A normal update pulls them.
• The icon-package guard test (apps/web/tests/app-icons.test.tsx) is excluded from the public suite for
  1.1.5: two Live pane files at the release source still import icons directly. It returns in 1.1.6.
• The web UI suite retries a failed test up to twice when CI is set (long jsdom tests on shared CI
  runners); locally a failure stays a failure.
• The full register of open findings is docs/quality/KNOWN_LIMITATIONS.md.

Evidence

• Lab acceptance for this exact tree (Linux, Windows 11, macOS: install, 1.1.4 → 1.1.5 update, repair, Docker stopped, first agent task, small/medium/large profiles, plus the 1.1.3 upgrade, doctor, update badge and telemetry checks): release/acceptance.json.
• npm run-spaceapp@1.1.5 and the GHCR images (linux/amd64, linux/arm64) carry build provenance attestations.
• node scripts/verify-export-provenance.mjs . checks this tree against PUBLIC_EXPORT_MANIFEST.json.
• Review snapshot: the spaceapp-review-1.1.5 assets of this release.

SpaceApp setup 1.1.4

SpaceApp setup 1.1.4 lets a first prompt build something right away, tells you when an update is available, and adds an opt-in "first answer" signal.

What's new

• Rooms without a project get their own folder. A CLI pane in such a room starts in /workspaces/<room>, so a first prompt like "build me a page" can write files.
• Update available. The app shows "Update available: vX" when a newer release exists and opens the update command with a Copy button.
• First prompts. The setup wizard's Ready step offers three first prompts to copy.
• Browser error reports. Browser errors are reported to your installation's own API (error name and bundle location only), so they appear in its logs.
• Opt-in first_answer telemetry. With telemetry Yes, one anonymous event is sent the first time an agent finishes an answer (event, random id, version, CPU architecture, date). Nothing is sent with telemetry No, and an explicit SPACEAPP_TELEMETRY at install is kept across updates.
• Current application. The app is updated to the current SpaceApp source. Quieter request logs; fast-uri 4 for the JSON serializer. The core image includes the Space Gateway tree-sitter grammars (MIT, listed in THIRD_PARTY_NOTICES.md).

Install or update

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation

• Exact candidate tested on Linux, Windows 11 (signed-in desktop) and macOS: update from 1.1.3 and from 1.1.2, fresh install with automatic browser opening, owner setup, a first native AI task on Big Pickle with no permission prompt, the first prompt writing index.html in /workspaces/<room>, telemetry No sending nothing, the update badge, two panes without out-of-memory kills, repair, stopped Docker, doctor --fix, and small/medium/large profiles. Telemetry Yes was checked on Linux: exactly one first_answer, confirmed at the collector.
• Release workflow: https://github.com/oll4com/spaceapp/actions/runs/38438934334

Known limitations

• Free models can change upstream at any time. If the selected free model stops responding, choose another model in OpenCode.
• The arm64 core image is close to its size budget (1045.6 of 1050 MiB).

SpaceApp setup 1.1.3

SpaceApp setup 1.1.3 lets the first OpenCode task run without stopping at a permission prompt, ships the current SpaceApp application, and makes the contributor path work on a fresh clone.

Fixes

• No permission prompt on the first task. OpenCode's first run now authorizes only its own private scratch directory, and the bootstrap instructions send temporary files there. Before, a first task on macOS stopped at "Access external directory /tmp" until someone answered. Other paths outside the workspace still ask.
• The Getting Started pane always starts. The default room project now resolves to the documented session directory inside the CLI container, so the OpenCode pane no longer exits with "chdir(2) failed". If the first-run free-model check fails, OpenCode starts anyway and explains how to pick a model.
• Current application. The app is updated to the current SpaceApp source, including guided setup on every screen size and session sign-outs that survive restarts. The gateway's Antigravity sign-in uses an OAuth client you supply, as the API already did.

For contributors

• npm run check works on a fresh clone, npm test runs the public test suite, and the offline smoke and dependency-boundary checks are included. README and CONTRIBUTING link only to files in this repository.

Install or update

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation

• Candidate tested on Linux, Windows 11 (signed-in desktop) and macOS Sonoma (the published commit adds only an export-tooling fix to it): fresh install with automatic browser opening, owner setup, a first native AI task on Big Pickle with no permission prompt, two OpenCode panes without out-of-memory kills, update from 1.1.2 and from 1.1.1, repair, stopped Docker, doctor --fix, and small/medium/large profiles.
• Release workflow: https://github.com/oll4com/spaceapp/actions/runs/38341179443. The published package and images were verified against their attestations; the lab upgrade from the registry package was not repeated for this release.

Known limitations

• Free models can change upstream at any time. If the selected free model stops responding, choose another model in OpenCode.
• The core and browser images are larger than in 1.1.2 (about 1.0 GiB and 1.7 GiB) because of new application dependencies.

spaceapp setup 1.1.2

SpaceApp setup 1.1.2 picks a first-run free model that can actually use tools, pins the optional Headroom companion, and makes the setup text and documentation match the launcher.

Fixes

• A first-run model that works with tools. The free OpenCode model for the first session is now checked with a real tool call: it must read a small file with its read tool and answer with the random token inside it. Big Pickle is tried first; when it fails, the newest free tool-capable models are tried. Before, a plain text reply was enough, so a model could be chosen that failed upstream as soon as a task used tools.
• Setup text matches what you get. The setup wizard and Help no longer promise the retired DeepSeek V4 Flash model. The documentation now matches the launcher: the Big Pickle starter model and its first-launch check, profile sizes, @latest commands, the 12-character owner password, telemetry, and what stays on your machine when you use a remote model provider.

Supply chain

• The optional Headroom companion image is pinned to a reviewed digest (headroom-codex-lb:code-5b15319@sha256:491c856a…) instead of the moving code tag, so installs and updates with companions enabled always run the same image.

Install or update

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation

• Exact candidate tested on Linux (VM218), Windows 11 (VM219, signed-in desktop) and macOS Sonoma (VM221): fresh install with automatic browser opening, owner setup, a first native AI task on a free OpenCode model, update from 1.1.1, repair, stopped Docker, stopped-PostgreSQL upgrade, small/medium/large profile changes, doctor --fix, and a real guest restart with the same containers.
• After publication, run-spaceapp@next was installed fresh and used to upgrade a retained 1.1.1 installation (first installed from the registry at 1.0.35) on all three systems; the containers ran the exact published GHCR digests and the database, files, secrets and workspaces were preserved.
• After promotion to latest, npx --yes run-spaceapp@latest update (no explicit version, no local images) upgraded another retained 1.1.1 installation on all three systems to the exact published digests, with database, files, secrets and workspaces preserved.
• Release workflow: https://github.com/oll4com/spaceapp/actions/runs/38210739244

Known limitations

• Free models can change upstream at any time. If the selected free model stops responding, switch models in OpenCode; the next fresh install checks the models again.
• macOS: in the restart test, a file written a few seconds before the Mac restarted was lost unless the data was flushed inside the core container first (Docker Desktop writes its VM disk on its own schedule). Data written earlier was preserved.

spaceapp setup 1.1.1

SpaceApp setup 1.1.1 fixes fresh installs on smaller machines, respects the telemetry answer, and updates dependencies with security fixes.

Fixes

• Small-profile installs work again. On machines that select the small profile (the automatic choice on 8 GB systems), 1.0.36 and 1.1.0 waited for a workflow worker that this profile deliberately does not start, then rolled the installation back after ten minutes. Readiness now treats the disabled worker as expected, and a fresh small install completes in under a minute.
• The telemetry answer is respected. The first-install ping is now sent only when you answer Yes to "Enable anonymous usage telemetry?" (the default is No) or set SPACEAPP_TELEMETRY to 1, true, yes or on. SPACEAPP_TELEMETRY=0 always disables it.

Security

• @modelcontextprotocol/sdk 1.32.1, and patched proxy-addr 2.0.8, @fastify/busboy 3.2.2, source-map-js 1.2.2 and http-cache-semantics 4.3.0.
• Runtime images replace npm's bundled postcss-selector-parser with 7.1.6 (CVE-2026-104844).
• GHSA-2mjx-qc3c-rqvc affects the rustls copy compiled into @temporalio/core-bridge 1.24.0, the latest Temporal SDK. SpaceApp reaches Temporal only over its private compose network without TLS, so the flaw has no reachable path. A narrow ignore expires on 2026-11-10 and will be removed when a Temporal SDK release ships the fix.

Install or update

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation

• Exact candidate tested on Linux (VM218), Windows 11 (VM219, signed-in desktop) and macOS Sonoma (VM221): fresh install with automatic browser opening, owner setup, a first native AI task on a free OpenCode model, update from 1.1.0, repair, stopped Docker, stopped-PostgreSQL upgrade from 1.0.34, small/medium/large profile changes, doctor --fix, and a real guest restart with the same containers.
• After publication, run-spaceapp@next was installed fresh and used to upgrade a retained 1.0.35 installation on all three systems, running the exact published GHCR digests with data preserved.
• After promotion to latest, npx --yes run-spaceapp@latest update (no explicit version, no local images) upgraded another retained 1.0.35 installation on all three systems to the exact published digests, with database, files, secrets and workspaces preserved.
• Release workflow: https://github.com/oll4com/spaceapp/actions/runs/38131634267

Known limitations

• The free model for the first OpenCode session is chosen by a plain completion check. A model that passes it can still fail upstream during tool calls; switch models in OpenCode if a free model stops responding.
• --access host-root is unchanged from 1.1.0.

spaceapp setup 1.1.0

SpaceApp 1.1.0

Highlights & Changes

• Companion Skills & AI Superpowers: Integrated the new companion skills ecosystem (Superpowers, UI-UX Pro Max, Taste Skill, No AI Slop).
• Plugins & MCP Enhancements:
  • Redesigned Plugins & MCP UI with high-contrast status badges (preview, connect, connected, disconnect).
  • Comprehensive tool summaries, GitHub repository links, and live version tracking for installed MCP plugins.
  • One-click "Upgrade All" capability for outdated MCP plugins.
• Security & Stability:
  • AST-enforced route rate limits for sensitive configuration endpoints (/api/configuration/inspect and /import).
  • Strict immutable multi-arch candidate verification with verified SBOM and provenance v1 attestations.
  • Clean high/critical vulnerability scanning across all containers.

Installation & Update Commands

• Fresh installation:

  npx --yes run-spaceapp@latest install

• Update existing installation:

  npx --yes run-spaceapp@latest update

Release Verification & Artifacts

• Workflow Run: GitHub Actions Run #37003368945
• Container Images (GHCR):
  • ghcr.io/oll4com/spaceapp-core:1.1.0 (linux/amd64, linux/arm64)
  • ghcr.io/oll4com/spaceapp-cli:1.1.0 (linux/amd64, linux/arm64)
  • ghcr.io/oll4com/spaceapp-browser:1.1.0 (linux/amd64, linux/arm64)
• npm Registry:
  • Package: run-spaceapp@1.1.0
  • Tags: latest: 1.1.0, next: 1.1.0

spaceapp setup 1.0.36

SpaceApp 1.0.36 introduces privacy protection for operator credentials, automatic default bundled Google OAuth authentication, and ensures the starter room presents a single OpenCode CLI terminal pane.

• Mask operator email in Settings Google Account card with sensitive-masked tagging and an eye/eye-off toggle to reveal or hide the address.
• Preconfigure bundled Google OAuth Client credentials by default so users can sign in without being prompted for missing credentials.
• Set the initial "Getting Started" room to automatically open with a single, centered OpenCode CLI pane at /etc.
• Modernize documentation, quick start guides, and architectural diagrams.

Install or update:

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation: All 159 public suite tests passed cleanly across Linux, Windows 11, and macOS runbooks. Multi-architecture (amd64/arm64) containers for core, cli, and browser passed all security scan, SBOM, and provenance attestation gates. npm package run-spaceapp@1.0.36 was published via verified OIDC pipeline and promoted to @latest with maintainer 2FA.

Release workflow:
https://github.com/oll4com/spaceapp/actions/runs/36966724115

spaceapp setup 1.0.35

SpaceApp 1.0.35 fixes upgrades that retained an old Compose startup override, which could modify the compiled API configuration. Updates now apply the current Compose template after preserving the previous configuration in a recovery checkpoint.

• Start and wait for PostgreSQL before upgrade checkpoints, including when the database was stopped.
• Start the core using its image entrypoint without rewriting compiled configuration.
• Update gRPC to 1.14.5 to address the release audit findings.

Install or update:

npx --yes run-spaceapp@latest install
npx --yes run-spaceapp@latest update

Validation: 18 mandatory and 21 supplementary checks passed across Linux, Windows 11 and macOS, including fresh installation, upgrades, repair, stopped Docker, native AI onboarding, resource profiles and real guest restarts with preserved data. Public npm next fresh installs and upgrades passed on all three platforms. After promotion, actual @latest upgrades from retained 1.0.30 installations also passed on all three platforms, preserving database markers, files, secrets and workspaces. AMD64 and ARM64 images passed the release security gates and include SBOM/provenance attestations.

Release workflow: https://github.com/oll4com/spaceapp/actions/runs/36836660377

The workflow's post-publication metadata polling timed out after npm publication succeeded. Subsequent independent verification confirmed the exact package version, git commit, provenance, byte-for-byte CI tarball match and published container digests. npm latest was promoted using maintainer 2FA.

Cold installation time including network downloads has not been demonstrated to be under 90 seconds.

spaceapp setup 1.0.31

SpaceApp setup 1.0.31

Known issue: upgrades using run-spaceapp update fail in this version because the temporary staging directory is missing its base compose.yml. Existing installations should wait for a corrected version before upgrading. Fresh installations passed validation on Linux, Windows 11 and macOS Intel.

Install

For a new installation:

npx --yes run-spaceapp@1.0.31 install

The npm latest and next tags currently point to 1.0.31.

Published artifacts

• npm: run-spaceapp 1.0.31
• Container images: ghcr.io/oll4com/spaceapp-core:1.0.31, ghcr.io/oll4com/spaceapp-cli:1.0.31, ghcr.io/oll4com/spaceapp-browser:1.0.31
• All three images include linux/amd64 and linux/arm64 manifests, SBOMs and provenance.
• Published source commit: 2769d82e1077c9316c6452f40c4996e0290ce083.
• npm tarball SHA256: 3930c254305195988e14fc7456383638d795c2440c9f053062b97a10d153e060; matches the accepted CI artifact.

Changes and validation

Dependency JavaScript/CSS source maps are removed after compilation to keep the ARM64 core image within the existing 900 MiB limit. Runtime code and licenses are preserved. Core ARM64 is 879.0 MiB; CLI ARM64 is 1049.2 MiB; browser ARM64 is 1544.3 MiB.

Source checks and all six architecture/container checks passed, including the existing size and fixable MEDIUM/HIGH/CRITICAL vulnerability gates. Published npm package integrity, source commit and provenance were checked. Public npm fresh installations passed on Linux, Windows 11 and macOS Intel. ARM64 image validation does not constitute Apple Silicon or Windows ARM host testing.

Post-publication registry upgrades from retained older installations failed on all three tested operating systems because of the staging Compose issue above. Earlier local-image tests did not exercise the real image-pull path. The failures occurred before checkpoint/cutover; the original lab installations were restored and verified with preserved secrets and workspaces. Upgrade acceptance remains incomplete.

Workflow status

Release workflow 36748438249 successfully published the images and npm package. Its final npm metadata check timed out during registry propagation, leaving the workflow marked failed. The registry metadata and published tarball were subsequently verified independently. This release does not change that workflow result.

spaceapp setup 1.0.2

spaceapp setup 1.0.2

Source commit: 6622b0516407632e2a1cc5fe14932d51aae3e95b (661 exported files, sanitized).

Install with: npx --yes run-spaceapp@1.0.2 install