v0.3.0

Changelog

• 0b43065 fix(seo): drop "files never touch the server" overclaim from in-app UI copy
• cd28ca4 fix(seo): point SPA mode-route hreflang at their own localized pages
• fb0697a fix(seo): correct "never touches the server" overclaim on the homepage
• c2c34ba fix(cli-page): hero badge "Free & open source" → "Free P2P"
• b27f8d1 fix(cli-page): make the intro match all five modes, and fix hero accuracy
• e7f2ffc docs(self-host): add a CLI-install note before the "point the CLI" step
• d343a4b docs(cli-guides): add "install the CLI first" section to guides that lacked one
• 8e83d7b fix(cli): make relayium login device-code prompt English
• 9d870c8 docs(cloud-async): add install + account prerequisites before relayium login
• 53683e6 docs(offline-transfer): note CLI+web workflow, link cloud-async guide
• 6fc66e1 docs(cli-page): document cloud async (login/up/down) section + flags
• 1d7905e docs(guides): add cloud async transfer guide (up/down, 6 langs)
• f0ff6f1 docs(spec+plan): document CLI cloud async transfer (frontend + tutorial)
• 01a2d74 fix(account): close frozen-account session-issuing bypass (reset/verify + central guard)
• 2845bb9 feat(account): GC hard-purge due accounts + pre-purge reminders + usage archive
• c5f3ee5 feat(account): frozen login + reactivation + register guard for pending-delete
• c70603e fix(account): issue reactivate token before scheduling + best-effort scheduled email
• 17b227a feat(account): account-deletion request+confirm with transient purge
• f5e67e4 test(account): full delete + shell-survival coverage for PurgeTransientUserData
• 441eb9d feat(account): PurgeTransientUserData for deletion confirmation
• f815b3f feat(account): user deletion lifecycle columns + usage_archive + grace settings
• 4760bf5 docs(plan): account self-deletion implementation plan
• 544c394 docs(spec): account self-deletion with 30-day grace (sub-project A)
• bec5b1a fix(account): reclaim cli_device_auth rows and throttle device/start
• ae45f17 test(cli): end-to-end cloud up/down with retention enforcement
• 992e9b4 harden(cli): down — refuse symlink escapes out of destDir
• d90fd57 feat(cli): down — fetch and decrypt from cloud
• 4d13d9b fix(cli): up download link uses #k= fragment + effective server
• 4a2fab2 feat(cli): up — encrypt and upload to cloud
• cd9f307 feat(cli): login/logout/whoami commands
• 5b0c29d fix(cloud): bound login poll loop when server sends expires_in<=0
• cf252d2 feat(cloud): device-code login driver
• 0c2eebe fix(cloud): enforce credentials perms unconditionally in Save
• d1eff3f feat(cloud): CLI credential store
• 6da2eeb feat(account): /device browser approval page for CLI login
• 2a60651 fix(account): cascade-delete cli_tokens on device delete (revocation path)
• f36ec95 feat(account): RequireAuth cookie-or-bearer; CLI can use /api/files
• f92dd44 fix(account): validate device-code before minting CLI device/token
• 88e85c7 feat(account): device-code authorization endpoints
• 45a50d4 feat(account): device-code + CLI-token persistence
• 1778373 style(main): gofmt alignment of account.Config literal
• 3a36878 feat(admin): configurable default retention policy + per-upload clamp
• ccd86fc fix(files): run max_downloads burn backfill unconditionally on boot
• 490ec56 feat(files): generalize burn-after-read into max-downloads retention
• d331464 test(storecrypto): cross-language Go<->web interop vector
• 273b629 feat(storecrypto): Go mirror of the zero-knowledge store crypto
• 4ea69f5 docs(plan): CLI cloud async transfer implementation plan
• c6af3d6 docs(spec): CLI cloud async transfer (account-bound up/down)
• a70e458 harden(db): enforce foreign keys (referential integrity)
• a4bc65d harden(recv): reject writes through a symlinked directory under destDir
• f9281ff harden(release): keyless (Sigstore) signing of release checksums
• 96d29f7 test(nodes): end-to-end TURN allocation cap enforcement
• 76d8050 perf(db): WAL + separate read pool so admin queries don't block writes
• 2edad18 harden(cli): concurrent serve, O_NOFOLLOW receive writes, warn on empty push
• 2c1c54e harden(nodes): node-local traffic + disk cap enforcement (cost-guardrails B)
• 307c33f harden(billing): per-month relay accounting, fixing cross-month drift (cost-guardrails C)
• 56462d7 harden(nodes): bound self-reported relay usage (cost-guardrails A)
• 60b73a8 harden: email CRLF guard, Windows identity load, turnserver.conf 0600, strip tokens from URL
• 50c7d26 harden(account): login timing, orphan-blob GC, sqlite busy_timeout + indexes
• 4cbb3f7 harden(web): sanitize peer paths in the ZIP fallback (Zip Slip)
• 6c24510 harden(serve): time-bound the unauthenticated TLS handshake
• 00b191e fix(files): roll back burn-after-read claim on incomplete delivery
• 31dcf51 harden(nodes): block SSRF via user-controlled node StorageURL
• ccde1ec harden(web): add CSP + clickjacking/hardening response headers
• 1570b06 fix(cli): repair default-"." receive, panic-proof serve, block ssh option injection
• 8bc9216 docs(guide): sync BYO node safety FAQ to all locales + add uninstall steps
• b478d98 harden(node): install-node.sh generates a sandboxed non-root unit
• c16c6fd harden(node): 0700 blob dirs + storage-node hardening runbook
• 52b9b20 fix(web): widen desktop content to ~90% + fix mobile horizontal overflow
• 38308c8 Merge feat/admin-official-relay-nodes: admin-managed official relay nodes + per-node hard limits
• 6b51592 fix(admin): count only fleet nodes in the official-nodes heading
• a4734e3 feat(admin): official-nodes dashboard section — mint, limits, delete, revoke
• 7c3151b fix(admin): cap limit GB input, scope SetNodeLimits to fleet, cover revoke route
• 9064d88 feat(admin): mint/limit/delete/revoke routes for official relay nodes
• 9d07271 test(nodes): fix capfull fixture to exercise the disk-cap boundary (4.5 GiB, not 22.5)
• 467c189 feat(nodes): hard-cap disk usage per fleet node in StorageNodes placement
• a9f5d4b feat(nodes): hard-cap monthly relay traffic per fleet node in handleICE
• 4d8d0bb feat(nodes): resolve + bind admin-minted fleet tokens at register/heartbeat
• 713e2c4 feat(nodes): NodeRelayedSince — per-node monthly relayed bytes
• fc19bb4 feat(nodes): per-node traffic/disk limit columns + SetNodeLimits + DeleteFleetNode
• 84e8a9c feat(nodes): fleet_tokens table + store CRUD for admin-minted official tokens
• ee538f0 docs(plan): admin-managed official relay nodes + per-node hard limits
• ac32f6f docs(spec): admin-managed official relay nodes + per-node hard limits
• b879ba6 chore(web): regenerate always-on-service guide pages + sitemap
• 5cdf63c docs(guides): add macOS launchd always-on section to the serve guide
• 7ff19be chore(web): regenerate prerendered pages + sitemap for bring-your-own-node guide
• 905d6ca feat(nodes): sudo+ports in node tutorial, "why account" explainer, BYO-node guide
• 07c4869 fix(nodes): BYO-node tutorial now installs relayium-node instead of assuming it's on PATH
• 88b29ac Merge C-γ: SEO landing pages for cross-network & offline-transfer
• f99b51c fix(seo): restore home meta description + per-route canonical/og:url for mode routes; BCP47 html lang
• e771e34 feat(web): per-route title + meta description for cross-network/offline-transfer
• 39d8f87 feat(seo): localized offline-transfer landing pages + sitemap
• f7e14cf fix(seo): correct cross-network copy — relayed-but-E2E, not direct-P2P; free within relay allowance
• 8325f23 feat(seo): localized cross-network landing pages + sitemap
• e127cce feat(seo): mode-landing page builder + sitemap support (mechanism)
• 40503f5 docs: C-gamma SEO mode landing pages implementation plan (4 tasks)
• 328a5f7 docs: C-gamma SEO landing pages for cross-network/offline-transfer design
• 39f8b39 Merge C-β: frontend polish sweep
• 513a6f9 feat(web): client-local recent-transfers history panel
• 148f296 feat(web): inline device rename propagated to peers via opaque signal
• f4befc8 feat: public GET /api/config + upload max-size hint
• 5a81ae8 refactor(web): extract shared PageFooter from OfflinePage/CrossPage
• 5956e0c feat(web): reusable confirm modal replacing native confirm() in MePage
• 360d634 docs: C-beta frontend polish sweep implementation plan (5 tasks)
• c3747a8 docs: C-beta frontend polish sweep design (confirm modal, footer, config, rename, history)
• d5352fe Merge C-α: realtime pairing-code guess hardening
• e13b7ea feat(web): confirm before sending to a code-room joiner (guess-code payoff removal)
• a2e36fa feat(signal): global pairing-code guess breaker; shed invalid /ws joins when open
• 5cfbd48 docs: C-alpha realtime guess-code hardening implementation plan (2 tasks)
• b80b5d6 docs: C-alpha realtime guess-code hardening design (confirmation gate + global breaker)
• 308995e Merge SP3: BYO user self-hosted nodes (account-bound relay+storage)
• ac1d37b fix(sp3): wire EnableUserNodes (feature was inert) + reject node-ID takeover on register
• c0e3386 feat(web): My Nodes section — add/list/delete BYO nodes + strict-mode toggle
• 6200644 feat(gc): evict pending_node_deletes older than 7d (SP2 M6)
• 8410b64 feat(account): user node API (provision/mine/delete/strict) + owner-scoped DeleteNode
• d8ce7ef test(upload): verify strict user with offline node gets 503, no infra fallback
• eaa6720 feat(account): uploads prefer user's own storage node (free, quota-exempt); strict 503
• b22e013 test(ice): verify strict mode withholds top-level TURN, not just the fleet pool
• 698a383 feat(ice): route owner's own nodes; strict mode withholds fleet + our TURN
• 8d43348 feat(account): only_own_nodes user flag + UserNodes/UserStorageNodes queries
• 2a95fb5 fix(metering): mark coturn relay usage billable (quota regression from SP3)
• 68e3dde feat(account): usage billable derived from node owner; own-node relay free; cross-user reject
• dcceca1 docs(plan): SP3 Task 3 also fixes heartbeat auth for user nodes (own-node 403)
• 7174590 feat(account): resolve node owner from fleet-or-user token; register user-owned nodes
• 43ae9da feat(account): node_tokens table + per-user token store methods
• 06c1e9e docs: SP3 BYO user self-hosted nodes implementation plan (9 tasks)
• 392661a docs: SP3 BYO user self-hosted nodes design (account-bound relay+storage)
• 9b87dda Merge SP2: node storage (distributed blob, central-proxy)
• 6893bea fix(sp2): stored_bytes gauge (SET not MAX), reclaim node blob on Put/burn-cleanup error, guard errCapturingReader race
• f439bed feat(admin): show node storage used/free/total in the Nodes section
• 0766630 feat(node): start blob server + report storage URL/secret/free/total
• c55b47f fix(node): check http.Do error in blob-handler test helper (go vet clean)
• 60fb191 feat(node): DiskStore-backed blob HTTP server + storage config/secret
• 53e3ae2 feat(account): GC routes blob deletes by node_id + drains orphan retry queue
• 671693e feat(account): route download/delete by node_id; 503 on offline; open-then-claim burn
• ae77568 feat(account): route uploads to a placed storage node, record node_id
• 998f9f2 feat(account): blobFor resolver + random placeUpload node selection
• 18de31f feat(account): node register/heartbeat carry storage URL/secret/free/total
• 5c53ea5 feat(account): SP2 persistence — node storage cols, stored_files.node_id, pending-delete queue
• 5945267 feat(storage): RemoteBlobStore — central-side blob proxy over HTTP
• 9e66483 docs: SP2 node-storage implementation plan (10 tasks)
• 7c8801f docs: SP2 node-storage design (distributed blob, central-proxy)
• f29b440 Merge SP1: self-reporting relay node (foundation + relay + fleet telemetry)
• 581b447 fix(node): unique per-alloc IDs + evict closed allocations; installer checksum + trust-boundary doc
• 3da6551 feat(dist): relayium-node goreleaser build + one-command install-node.sh
• 9d5e628 feat(node): pion/turn relay wiring with per-alloc attribution + report loop
• 5534fc6 feat(node): register/heartbeat report agent (HTTPS client)
• f50543f feat(node): per-allocation byte-counting PacketConn wrapper + registry
• 7511d1a feat(node): relayium-node config parsing + persistent state.json
• d1f00a3 feat(admin): read-only relay-nodes telemetry section
• c4c9587 feat(ice): dynamic TURN pool from online fleet nodes, union with static relays
• b4ae894 feat(account): node register/heartbeat API reusing RecordUsage; wire NodeToken
• 2b7e199 feat(account): nodes table + Upsert/Touch/Online/List store methods
• c10027d refactor(metering): extract TURN-username parsing into shared relayusage pkg
• 88ab73c docs: SP1 relay-node implementation plan (10 tasks) + resolve pion attribution
• 4418dd2 docs: SP1 self-reporting relay node design (foundation + relay + fleet telemetry)
• a1914f7 docs: Phase 0 default-on relay metering design (C1 fix)
• 857905a fix(metering): gate zero-events watchdog warning on process uptime
• 4fa01e7 style: gofmt register_dedupe_test.go
• 1b9b4d9 M3b: global blob-volume disk soft cap (configurable high-water → 503)
• 7aa22a0 M3a: minimum billable upload size (64 KiB) against DailyQuota
• f53388b M2: metering observability watchdog + reconcile hook; verify cumulative keep-max idempotency
• ebeaed2 M1: per-account in-flight upload concurrency cap (5)
• 756d3a1 fix(account): close H2b register TOCTOU race via atomic canonical-email insert
• 7ccc875 H2b: anti-Sybil canonical-email dedupe on register (col + backfill + lookup)
• a5b5ac1 H2a: rate-limit POST /api/auth/register at 5/min/IP
• a88c291 H1: rate-limit /api/ice at 5/min/IP
• 89e7196 H3: inject trusted-proxy client-IP extractor into account rate limits
• 8f2ebb5 signal: debounce roster broadcasts per room to 200ms (M4)
• 0d858d2 main: cap per-IP /ws connections and LAN room peers (H4)
• 985febd signal: cap total rooms at maxRooms in JoinLimited (H4)
• 56cb055 signal: add IPConnLimiter (H4 per-IP concurrent conn cap)
• 5bc5994 signal: enforce C2 read limit + signal budget/rate in ServeWS
• beffead signal: add per-connection connLimiter (C2 byte budget + rate)
• e850f5b docs(plan): abuse-hardening implementation plans (signaling + account/storage/metering)
• 112ad66 docs(spec): abuse-surface hardening round 2 (signaling relay cap, rate limits, storage caps, metering robustness)
• 271bfc3 docs(spec): fix Goals-summary STUN claim to match corrected Layer 0 (shared coturn daemon)
• 027d6f0 docs(coturn): correct Layer 0 — stopping a relay host also stops its co-located STUN; system STUN survives via default/other servers
• 1d4559c docs(coturn): egress budget alarm runbook as the monthly relay cost ceiling
• 06f4e29 chore(test): mark coturn-conf-test.sh executable, matching run-tests.sh
• 84013bb feat(coturn): add max-bps + allocation quotas; extract testable conf generator
• 594a22d feat(relay): log an alert when relay metering read fails (fail-open preserved)
• 83af377 feat(relay): require verified email before issuing TURN relay creds
• e968d2f docs(plan): relay cost-hardening implementation plan (4 tasks, TDD)
• 504a2ac docs(spec): relay cost-hardening design (3-layer: cloud egress cap + coturn rate limit + app guards)
• 9c81eb8 fix(account): add Date + Message-ID email headers so amavis stops quarantining
• 606bf81 feat(web): guide users to check spam folder when verification/reset email is missing
• acb526a fix(account): wire email-token GC, validate register email, drop dead i18n key
• bdc24a6 docs(env): SMTP now powers email verification + password reset
• b3f3418 feat(web): /verify-email and /reset-password pages + routing
• 73b02c3 feat(web): register verification + unverified login + forgot-password UI
• ee192a6 feat(web): auth client verify/resend/forgot/reset + unverified login handling
• af7d38a feat(account): verify/resend/forgot/reset endpoints + expose emailVerified
• 12de565 feat(account): mark email verified on magic-link and Google login
• 660538d feat(account): forgot-password + reset (revokes sessions, marks verified)
• 16fd4fa feat(account): register sends verification, login blocked until verified
• 43cc764 feat(account): verify/reset TTL config + throttles; SMTP independent of magic
• 5a6ed18 feat(account): extend Mailer with verify + reset emails (text+HTML)
• 77d0e4d feat(account): email_tokens table + store methods (verify/reset, atomic single-use)
• ca1aed8 test(account): grandfather test exercises real pre-migration path
• 0a6e81f feat(account): email_verified column + grandfather migration + store methods
• d65f04c docs(plan): email verification + password reset implementation plan
• 140e80c docs(spec): email verification + password reset design
• a0368a6 content(web): add 15 more articles (batch 2)
• 2185117 docs(spec): batch 2 — 15 more articles (QR/receive/folder/service/backups, localsend/scp/wormhole/nextcloud/dropbox, airdrop-win/mac-win/wifi, p2p/safety)
• 2d954eb content(web): add 8 articles — async link/self-host/encryption/browser-crossnet + croc/rsync/google-drive/firefox-send compares
• 29124be docs(spec): 8 new articles batch design (async/self-host/encryption/compares)
• 3d61969 docs(web): scope tar-fallback claim to push; pull always needs relayium on the remote
• 7303f9e chore(web): regenerate static pages after copy corrections
• 9a84c25 docs: mark cross-network/TURN as shipped; fix account-requirement claims in README + SECURITY
• 2e8cb8e fix(web): correct account-requirement and file-count claims in SEO copy
• 5f64391 fix(web): correct SPA copy/code mismatches on CLI, async, and crossnet pages
• a9fadcd fix(web): correct factual errors in legal pages (account reqs, relay attribution, expiry options)
• 6fd9f8b docs(plan): correct landing-footer Guides link placement to match article footer
• 8c46347 feat(web): replace scattered footer links with one Guides entry
• 30c4c39 test(web): lock Guides footer link position against regression
• 9e73837 feat(web): link the Guides hub from article + landing footers
• 422e392 feat(web): generate /guides hub pages + list them in sitemap
• 41d6105 feat(web): add Guides hub page content + renderer
• 5ab0a56 feat(web): group articles by category for the Guides hub
• d3f8877 docs(plan): guides hub page + footer entry implementation plan
• 897bc97 docs(spec): guides hub page + footer entry design
• e457731 docs(web): add "sync a large folder between servers" guide (6 langs)