v1.2.0

Orion Belt v1.2.0

Highlights

• curl|bash server installer (scripts/install-server.sh): distro packages, optional local Postgres (reuse / recreate / DSN), public URL + WebAuthn prompts, systemd/OpenRC, osh client.yaml for the installing user.
• server.public_url / public SSH advertise with gateway-info defaults for Add agent and setup wizard.
• Docker quickstart: GHCR images or build-from-source.
• In-app notifications for access-request events; admins also get a notice when WebAuthn is enabled in config but fails to initialize.
• Hard-delete agents/users no longer blocked by session/permission FKs; schema self-repairs on migrate.

Installer & ops

• Scheme-based public URL ports (http→80, https→443); API listen port aligned.
• Postgres already present: reuse, recreate orionbelt, or paste a DSN (--recreate-db for unattended).
• WebAuthn: dotted domain required; LAN-only names warned; bad lab config soft-fails so the gateway stays up.
• Writes ~/.orion-belt/client.yaml with a readable admin key (not /root/... for sudo users); best-effort orion-belt-tools install.

Fixes

• Delete agent after recorded sessions (sessions_machine_id_fkey / related FKs).
• Delete user with sessions/grants; attribution columns SET NULL where appropriate.
• API agent delete removes synthetic agent_id user (matches CLI).
• Startup/CLI migrate repairs drifted FK ON DELETE rules and granted_by nullability only when needed.

Notes / known limitations

• Revoke/pause/archive can still be cleared when an agent reconnects (IsActive forced true) — follow-up.
• Public POST /public/register/client still accepts is_admin (lab bootstrap); lock down or disable in production.
• OpenFGA (if enabled): grant sync/TTL drift vs Postgres is not fully closed in this release.
• Archiving an agent keeps the name reserved (UNIQUE); re-use the same name only after hard-delete.
• Recording retention still targets cast files by mtime and may leave .enc / DB session rows.

Upgrade

1. Install/restart v1.2.0 (migrate runs on start and repairs FKs).
2. Re-run or refresh installer script if you rely on curl|bash / osh client.yaml improvements.
3. After upgrade, revoke → delete for agents with history should succeed.

v1.1.0

Orion Belt v1.1.0

Highlights

• OpenTelemetry tracing for gateway and agent hops with OTLP export
• Admin notification policy that bounds user notification preferences
• Usage analytics dashboard endpoints and console views
• Report export (PDF / CSV / SIEM) from backend and UI
• Multi-language SDKs (Go, Python, JS, .NET) for the public API
• Public package mirror for Add-agent installs via GitHub Pages

Features

• Trace SSH sessions end-to-end (server + agent) with configurable OTLP export
• Persist and enforce an org-wide notification policy; expose bounds in the console and SDK
• Usage-based dashboard APIs and UI for operational analytics
• Export audit/security reports as PDF, CSV, or SIEM-oriented formats
• First-pass client SDKs plus a multi-language generator
• Default Add-agent package base URL to https://orion-belt-dev.github.io/packages, with make serve-packages for local mirrors
• Gateway performance benchmark suite and CI perf check helpers

Fixes

• Web UI authentication / quickstart docs and Docker quickstart script
• Notification policy normalization on database read
• Command redaction and OTLP config validation in tracing
• CVE gate no longer skipped by a stale govulncheck install
• Bump grpc to v1.82.1 (GO-2026-6061)

Docs & ops

• Tracing setup, span shape, and cost notes
• Notification policy behaviour and clamping docs
• Packaging / Setup docs for the Pages package mirror and local serve
• CODEOWNERS added
• Coverage baselines updated (incl. tracing); SDK build artifacts ignored

Install / upgrade

• Agent packages: https://orion-belt-dev.github.io/packages (version 1.1.0 after this release is published)
• Local package server: make packages && make serve-packages
• Refresh the Pages mirror after release: make publish-packages-pages FROM_RELEASE=1 PUSH=1

What's Changed

• add report export capabilities both from a backend and frontend persp… by @SvenNellerz in #75
• Add CODEOWNERS file with designated owner by @zrougamed in #76
• add usage based dashboard endpoints, updated tests and documentation … by @SvenNellerz in #77
• add the first pass at the go common SDK as a starting point by @SvenNellerz in #78
• coverage increase to above 86% by @OtchereDev in #79
• Feature/FR 8.1 by @OtchereDev in #81
• Feature/FR 8.3 by @OtchereDev in #80
• FR-8.9: add gateway performance benchmark suite by @OtchereDev in #82
• Fix web UI auth docs and make quickstart land signed in by @zrougamed in #84
• Default Add-agent package URL to public GitHub Pages mirror by @zrougamed in #85
• rebrand to org by @zrougamed in #87
• GHCR images, packages Pages publish, and prod compose on :latest by @zrougamed in #88

New Contributors

• @SvenNellerz made their first contribution in #75
• @OtchereDev made their first contribution in #79

Full Changelog: v1.0.0...v1.1.0

v1.0.0

Orion Belt v1.0.0

First release we’re calling stable for the SSH PAM/bastion: CA, MFA, JIT, ReBAC, recording, live watch, packages, and a documented /api/v1 compatibility promise. Not a new protocol or IdP — OIDC, HA, and RDP/VNC come later.

Highlights

• Permissions editor: all grants, edit remotes/TTL, upsert (GET/PATCH /admin/permissions)
• Recording compression (gzip / OBGZ1; recording.compression)
• Live session watch (GET /sessions/:id/watch + Sessions → Watch)
• Notification templates + per-user prefs
• JIT: optional access_type, reject notifications, stale pending expiry
• Password + TOTP login (console / CLI); key-login MFA only when auth.mfa_required
• JSON logs, Prometheus alert examples, hardening + observability docs
• make release-smoke + docs/V1_RELEASE_CRITERIA.md

Compatibility

• /api/v1 is the stable contract for v1.x — see API_STABILITY.md
• Plaintext casts still play; new flushes default to gzip unless compression: none

Upgrade

• Restart the gateway after config changes
• From source: make build-ui if you need the latest console assets embedded

What’s next

OIDC, HA, multi-protocol proxies, SDKs, compliance packs — see the roadmap.

Full Changelog: v0.9.0...v1.0.0

v0.9.0

Orion Belt v0.9.0

Ops and console depth on the v0.8 SSH CA / MFA baseline: richer permissions, compressed recordings, live session watch, notification prefs, and JIT hygiene.

Highlights

• Permissions editor — list all grants; edit remotes/TTL; upsert on grant (GET/PATCH /admin/permissions)
• Recording compression — default gzip with OBGZ1 magic (recording.compression); playback auto-decompresses
• Live session watch — GET /sessions/:id/watch WebSocket + Sessions Watch in the console
• Notifications — templates; per-user prefs API + Security → Notifications
• JIT polish — optional access_type on requests; reject notifications; stale pending expiry
• Observability — JSON slog (+ request_id); Prometheus alert examples; hardening + ADR docs

Fixes (since v0.8.1)

• Key-login MFA only when auth.mfa_required; WebAuthn Backup Eligible/State persisted and aligned for older creds

Config / ops

• recording.compression: gzip | none (see config/server.example.yaml)
• Docs: docs/OBSERVABILITY.md, docs/DEPLOYMENT_HARDENING.md, docs/adr/0001-recording-compression.md
• OpenAPI bumped to 0.9.0

Upgrade notes

• Existing plaintext .cast files still play; new flushes use gzip unless compression: none
• Restart the gateway after config changes; rebuild/redeploy UI static assets if you build from source (make build-ui)

Full Changelog: v0.8.1...v0.9.0

v0.8.1

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Orion Belt v0.8.0

Release date: 2026-07-14
Site: orion-belt.dev
License: Apache 2.0 + Commons Clause — enterprise PAM features as open source you self-host

SSH Certificate Authority, stronger pubkey API login, in-app notifications, and CLI/console quality-of-life — on top of the packaging, plugin platform, and console theming already on master.

Highlights

SSH Certificate Authority

• Optional internal User CA and Host CA (ssh_ca.enabled + required ssh_ca.master_key)
• Short-lived User certificates for operators (POST /api/v1/ssh-cert); clients auto-detect via GET /api/v1/ssh-cert/ca
• Host certificates for the gateway and agents — new agents no longer need a synthetic user row when CA is on
• Agent Host-cert auto-renewal over SSH global request orion-renew-cert@orionbelt
• Admin lifecycle: oadmin ca export|list-certs|revoke and matching /api/v1/admin/ca/* / /ssh-certificates/* routes
• Revocation cache refresh loop for multi-instance awareness
• Guide: docs/SSH_CA.md

Auth hardening

• Pubkey HTTP login (/login, /login/key, /login/token) now requires challenge-response proof-of-possession (POST /api/v1/public/auth/challenge)
• Browser bootstrap codes: CLI-authenticated users can issue a one-time code for the web console (POST /auth/browser-bootstrap → redeem publicly)

Notifications

• In-app notification store + API (GET /notifications, unread count, mark read)
• Console notification bell (e.g. access-request approved)

CLI UX

• Shared flags across osh / ocp / oadmin: --user, --api-endpoint, -i/--identity, --verbose, --timeout, plus --proxy / --insecure on SSH tools — see docs/CLIENT-CLI.md
• First-run wizard when client.yaml is missing: prompts for host/API/user/key, checks the key and API reachability
• osh login opens the browser by default; osh login --code prints the code/URL for headless use

Console

• Collapsible sidebar, cleaner account footer, clearer page copy
• Dashboard setup banner uses real /setup/status (complete / next) so online agents are not misreported as missing

Docs & packaging helpers

• OpenAPI bumped to 0.8.0 (SSH CA, challenge login, bootstrap, notifications)
• README / ROADMAP / SETUP / SERVER-CLI / OpenSSH clients / Architecture aligned with CA behavior
• Version milestones documented in docs/ROADMAP.md (v0.1 → v0.8)
• macOS signing/notarization + Homebrew formula scripts: docs/MACOS_DISTRIBUTION.md

Upgrade notes

1. Optional: enable CA in server.yaml:

   ssh_ca:
     enabled: true
     master_key: "<32-byte secret, raw or base64>"
     host_principals:
       - your.gateway.example.com

2. Export Host CA material for clients/agents: oadmin ca export → set auth.host_ca_public_key.

3. Re-register (or re-run install script) for new agents so they receive a Host cert; existing synthetic-user agents keep working until migrated.

4. CLI/tools that call login endpoints must obtain a challenge and sign it — stock osh / ocp / oadmin already do this.

5. Losing ssh_ca.master_key makes encrypted CA private keys unusable — back it up like any other high-value secret.

6. First CLI run without ~/.orion-belt/client.yaml starts the setup wizard (or create the file manually).

7. osh login opens a browser; use osh login --code when headless.

8. macOS: Darwin tools from GitHub Releases are not Apple-notarized yet. If Gatekeeper blocks them: right-click → Open, or xattr -dr com.apple.quarantine ./osh ./ocp ./oadmin.

Compatibility

• CA off: behavior matches prior releases (legacy agent synthetic users, TOFU host keys).
• CA on: legacy pubkey SSH auth and old agents still work; new registration paths issue Host certs.

Verify

go test ./...
orion-belt-server --version
curl -s localhost:8080/api/v1/version
curl -s localhost:8080/api/v1/openapi.yaml | head
osh login --code   # or: osh login  (opens browser)

What's Changed

• feat(ssh-ca): ship v0.8.0 SSH CA, challenge login, and notifications by @zrougamed in #10
• feat(cli,console): first-run client wizard, shared flags, and shell polish

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Orion Belt v0.7.0

Plugins are now a real, live-configurable platform — not a build-time afterthought.

Previously, plugins existed as a dynamic .so-loading mechanism that was never wired into any shipped artifact (Docker image, packages, or the QEMU lab), and had no UI or API to manage. This release replaces that entirely.

Plugin platform

• Plugins compile directly into orion-belt-server — no .so files, no CGO, no per-arch/libc build matrix. The server binary is fully static again.
• Enable, disable, and reconfigure any plugin from the Plugins page in the web console — takes effect immediately, no restart.
• Config is schema-driven: real form fields per plugin, not raw JSON. Secret fields show a partial reveal (xoxb****9f2c) so you can tell what's set without exposing it, and saving no longer requires retyping every credential — untouched secrets are safely preserved server-side.
• Shipped plugins: audit-logger (enabled and working out of the box), slack-notifications, email-notifications, webhook-notifications, and the new chatops-access-request.

New: chatops-access-request

Get access-request approvals where you already work:

• Slack & Discord — native interactive Approve/Deny buttons, with full request-signature verification on the way back in.
• Microsoft Teams & Rocket.Chat — signed, time-limited magic links (no bot/app registration required to get started).

Security

• WebAuthn/FIDO2 is now enabled by default (Docker, QEMU lab, lab compose configs). Note: the RP ID must match the hostname you actually access the console through — this is a WebAuthn spec constraint, not configurable away.

Console

• Dark and light themes — a toggle on both the login page and the main app shell, defaulting to light.
• Nav icons are now inline SVGs (thin outline, no fills) instead of static PNGs, so they render correctly in both themes and pick up an active-state glow via CSS instead of separate color variants.

Build & release

• make build-server, the QEMU lab scripts, and the GoReleaser release pipeline all rebuild the embedded web console before producing a server binary — the shipped UI can never lag behind a stale, previously-committed snapshot again.

Upgrade notes

• server.yaml's plugin_dir setting is removed (plugins are no longer loaded from disk). A plugins: block in server.yaml still works as a one-time seed on first boot; after that, use the Plugins page or admin API — the database is the source of truth.

Full Changelog: v0.6.0...v0.7.0

v0.6.0

Security fixes (upgrade recommended)

• Critical: command injection in the web file browser. Path parameters
  passed to filesList/filesDownload/filesUpload/filesMkdir/filesDelete
  were interpolated into shell commands using Go's %q, which escapes
  Go-string syntax only — not shell metacharacters — so $(...) command
  substitution still expanded. A crafted path could execute arbitrary
  commands on any agent the caller had SSH access to. Fixed with proper
  POSIX single-quote escaping.
• Privilege escalation via file/CLI exec. exec requests to the agent
  never carried the granted remote user, so file-browser operations and CLI
  exec always ran as the agent's own (root) identity regardless of which
  unprivileged remote user was actually granted access. Now impersonates the
  correct user end-to-end.
• Agent session spawning no longer shells out to su -. Replaced with a
  direct privilege drop (setuid/setgid via syscall.Credential),
  resolving the target user's real login shell from /etc/passwd instead of
  assuming /bin/bash exists — fixes hard failures on minimal distro images.
• Plugin hooks now have panic recovery and a bounded timeout, so a stuck or
  panicking plugin can no longer stall every login or crash the server.
• Fixed a plugin config-loading bug that could wire configuration to the
  wrong plugin when more than one was already loaded.
• Expired HTTP sessions are now cleaned up on a periodic loop instead of
  growing the sessions table unbounded.

Self-hosting: simple Docker Compose setup

• New docker-compose.server.yml / docker-compose.agent.yml, replacing the
  old image-pinned compose file. Env-driven, built locally, documented with
  copy-paste steps and .env.*.example files.
• scripts/docker-quickstart.sh — one command that generates secrets, brings
  up the server, and bootstraps the first admin login.
• Fixed two real issues in the Docker images: the SSH host key was
  previously baked into the image at build time, so every container built
  from a given image tag shared the same key, defeating host-key
  verification — it's now generated uniquely on first run and persisted in a
  volume. The agent image also ran an unnecessary internal sshd with a
  hardcoded root:password and password auth enabled — removed entirely,
  the agent never needed it.

Web console

• Permissions page: revoking access now requires confirmation (previously
  the only destructive action in the console that didn't), and the page
  moved to the shared paginated/searchable table with a by-machine view in
  addition to by-user.
• New self-service API key management UI (create, list, revoke, delete) —
  previously only reachable via the API.
• Fixed the Setup/onboarding page reading response fields that didn't exist
  in the real /setup/status payload, which left most onboarding steps
  stuck showing "todo" regardless of actual progress.

Documentation

• OpenAPI spec now documents the agent-disconnect endpoint.
• SETUP.md now points to config/server.example.yaml for the
  WebAuthn/OpenFGA/MFA/rate-limit/recording-encryption options that were
  previously undiscoverable from it.
• Fixed the SREVER-CLI.md filename typo (now SERVER-CLI.md).
• Corrected the web console SRS's page inventory.
• Clarified that there is no browser-based "setup wizard" — auth is
  SSH-public-key based with no self-registration page — and documented the
  real first-admin bootstrap flow instead.

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Orion Belt v0.5.0

Release date: July 2026
Status: Alpha

Privileged access management with a React web console embedded in the gateway, agent lifecycle controls, packaging/CVE lab work, and timed session recordings.

---

Highlights

• React console — Vite + React 19 + TypeScript UI at /ui/, built into web/static/ and embedded in orion-belt-server via go:embed (vanilla SPA removed)
• Operator UX — command palette, permissions editor, agent health dashboard, file manager parity, MFA QR, WebAuthn register, SSH key store, table filter/sort/pagination
• Agent ops — pause/resume, disconnect, restart (orion:restart), revoke/archive/delete; Add agent with distro logos and install scripts
• Auth fixes for web PTY/files — effective-role admin/operator bypass, WebSocket JWT/token auth, Vite ws proxy for local UI
• Packaging & lab (since v0.4) — multi-distro packages, 0-CVE gate, QEMU/Compose labs, artifact signing/versioning
• Session recording — asciinema-compatible .cast playback in the console; web terminal sessions recorded

---

What's new

Web console (/ui)

• Role-aware React shell (admin / operator / auditor / user)
• Login: SSH public key, TOTP, WebAuthn
• Pages: Dashboard, Setup, Requests, Machines, Terminal, Files, Sessions (+ cast player), Users (edit), Permissions, Agents, Add agent, Audit, Security
• Icons8 nav + distro assets; setup guide clarifies machines vs agents
• make build-ui → embedded assets; Docker builder installs Node so images ship the UI

Gateway / agents

• POST /admin/agents/:id/disconnect, agent orion:restart
• Terminal/files permission checks honor EffectiveRole (admin/operator)
• Middleware: ?access_token= validated as JWT for WebSocket

Packaging / quality (post–v0.4)

• nfpm packages, repos, signing; multi-distro QEMU lab; e2e helpers
• Version injected via ldflags (pkg/version)

---

Upgrade notes

1. Rebuild with Node available: make build (runs build-ui then server).
2. Open http://<gateway>:8080/ui/ — no separate static host required.
3. For Vite dev (:5173), include that origin under auth.webauthn.origins if using WebAuthn.
4. Alpine/file browser: use the correct remote user (e.g. alpine), not always root.

---

Install / verify

make build
./bin/orion-belt-server -c /etc/orion-belt/server.yaml
# → http://localhost:8080/ui/

What's Changed

• Feature/packaging CVE lab by @zrougamed in #8
• feat: ship React web console (v0.5) by @zrougamed in #9

Full Changelog: v0.4.0...v0.5.0

Orion Belt v0.4.0

Release date: July 2026
Status: Alpha

Privileged access management with MFA/WebAuthn, vanilla OpenSSH clients, a role-aware web console, optional OpenFGA, and encrypted session recordings.

---

Highlights

• MFA — TOTP enrollment and enforcement on API login; org-wide auth.mfa_required
• YubiKey / FIDO2 — WebAuthn for the web console; SSH security keys (sk-ssh-ed25519@openssh.com, etc.)
• OpenSSH agentless clients — connect with stock ssh via user+machine@gateway (no osh required)
• Web console (/ui) — role-aware ops UI with live terminal, file browser, approvals, and security settings
• OpenFGA — optional external authorization with ReBAC fallback
• Recording hardening — AES-256-GCM at rest + retention cleanup

---

What's new

Authentication & access

• TOTP: POST /api/v1/mfa/enroll|confirm|disable, GET /mfa/status; backup codes
• WebAuthn register/login APIs; config under auth.webauthn
• Multiple SSH public keys per user (including FIDO sk-*) via /api/v1/ssh-keys
• JWT, API keys, and session auth retained from earlier releases
• User roles: admin, operator, auditor, user (admin/operator for approvals)

OpenSSH clients

• Interactive: ssh alice+web-01@gateway, ssh alice+bob%web-01@gateway
• Exec: ssh alice@gateway 'bob@web-01' / remote commands
• PTY / window-change forwarding for interactive sessions
• Guide: docs/openssh-clients.md

Web console

• Embedded SPA at / → /ui
• Dashboard, access requests, machines, sessions/playback, users, audit
• Live web terminal (WebSocket + xterm)
• File browser (list, upload, download, mkdir, delete)
• Security: TOTP, WebAuthn, SSH keys

Authorization & recording

• Optional OpenFGA client (auth.openfga); example model in docs/openfga-model.fga
• Recording AES-GCM via recording.encryption_key
• Retention via recording.retention_days (periodic cleanup)

Docs

• Updated README, ROADMAP, ARCHITECTURE
• New OpenSSH and OpenFGA docs

---

Upgrade notes

1. Migrate — restart server so Postgres migrations add MFA, roles, SSH keys, and WebAuthn tables.
2. Config — review config/server.example.yaml:
   • auth.jwt_secret, auth.mfa_required
   • auth.webauthn (rp_id, origins must match your public URL)
   • recording.encryption_key / retention_days
   • auth.openfga if using OpenFGA
3. WebAuthn — rp_id / origins must match the host users open (e.g. not localhost in production).
4. Recordings — existing plaintext files still play back; new sessions encrypt only when encryption_key is set.
5. Breaking-ish — API login with MFA enabled requires totp_code (or WebAuthn login path). SSH with mfa_required denies users who have not enrolled MFA.

---

Compatibility

Area	Notes
Agents	Still required on targets (reverse tunnels)
osh / ocp / oadmin	Still supported
OpenSSH	Preferred for interactive shells without installing CLI
DB	PostgreSQL

---

Known limitations

• No ProxyJump / direct-tcpip to targets (session-on-agent model)
• SFTP subsystem not implemented (use ocp or web file browser)
• WebAuthn needs correct rp_id / HTTPS in real deployments
• OpenAPI spec and HA / IdP integrations still upcoming

What's Changed

• Adding docker compose for local dev by @zrougamed in #5
• feat: Phase 1 hardening by @zrougamed in #6
• feat: v0.4 — MFA/WebAuthn, OpenSSH clients, web console, OpenFGA, recording encryption by @zrougamed in #7

Full Changelog: v0.3.0...v0.4.0