sbox-ns 0.5.4

sbox-ns 0.5.4: macOS installs (CI-only)

Installer and CLI release. No wire, API, auth, save/endpoint/query, migration or default change; client surface class None per docs/compatibility.md, released --allow-ci-only. No s&box editor re-certification is required or claimed.

What's changed

• macOS installs work end to end (#91). install.sh now installs and starts the launchd service once setup has run: a LaunchDaemon with sudo (/opt/sbox-ns), a per-user LaunchAgent otherwise (~/.local). SBOX_NS_TUNNEL=1 and SBOX_NS_DNS=1 work on macOS through it; DNS still needs public ports 80 and 443 and says so. Fixes error: SBOX_NS_DNS=1 requires root and the systemd service on a Mac.
• sbox-ns service start / restart on macOS pick launchctl kickstart -k when the job is loaded and bootstrap when it is not, so re-running the installer (an upgrade) restarts on the new binary instead of failing with Bootstrap failed: 5.
• A per-user LaunchAgent needs a GUI login; SSH-only sessions now fail clearly and point at sudo.
• Install matrix: new macOS (arm64, launchd) job (fresh root install, upgrade re-run, idempotent re-run, uninstall).
• Test-only: tests that pass the owner export gate no longer run in parallel (#92); this removes an intermittent 409 in CI.

Home Mac without open ports:

curl -fsSL https://github.com/sbox-cool/sbox-network-storage-server/releases/latest/download/install.sh \
  | env SBOX_NS_PROJECT="My Game" SBOX_NS_TUNNEL=1 sh

Verified

• Published installer on a real Mac (Apple Silicon), as the user: signature and checksum verified, LaunchAgent running 0.5.4, owner console with the lime theme; re-run without errors; tunnel install served /health 0.5.4 over its public HTTPS name, then disabled and removed.
• CI on the release commit (SQLite, PostgreSQL 13-18, Windows, macOS), HTTP smoke, SQLite/PostgreSQL differential, install matrix on Ubuntu 22.04/24.04/arm64, Debian 12, Windows PS 5.1/7 and macOS. One Windows-only PowerShell installer test timed out (known flake, same as 0.5.3) and passed on rerun.

Compatibility evidence: CI-only

Tested with

Library	Revision	Engine	OS	Database	Result	Evidence
1.1.0	unknown	-	-	sqlite, postgres	ci-only	#91, #92

CI-only release: this commit has not passed the real s&box editor gate.

Rollback compatibility

No preserved-data rollback target certified for this release. Older pre-compatibility binaries require backup restore.

Upgrade / rollback

No migration (schema unchanged from 0.5.3); drop-in upgrade. sbox-ns rollback --keep-data to 0.5.3 is schema-safe.

sbox-ns 0.5.3

sbox-ns 0.5.3 — owner console visual system (CI-only)

Owner-only visual release. No wire, API, auth, save/endpoint/query, migration,
or default change: request/response bytes the library sees are identical to
0.5.2, so no s&box editor re-certification is required or claimed. Client
surface class None per docs/compatibility.md; released --allow-ci-only.

What's changed (server PR #89)

Owner console shared visual system with the approved lime brand, matching the
live website (sboxns.com#7) and the library source asset (sbox-network-storage#13, open):

• Near-black Dark, white Light, and black High-contrast themes; lime fills
  (#70e000) with darker lime text on light (#3b7600).
• Retired hue keys map forward (cooldark/slate/mint/warm → dark,
  coollight → light); saved-theme migration is constrained so the approved
  body brand is kept.
• Compact 48px breadcrumb topbar with sized Discord mark and owner-menu theme
  selection; solid vendored nav icons (Heroicons, license vendored).
• Full-colour centered smug cube with adaptive/static favicons and new raster
  asset (sbox-network-storage-icon-512.png).
• Token-driven outlined content, filled controls, and raised overlays across
  management and workbench; docs/ui-guidelines.md rewritten around the tokens.
• Test-only fix: the Linux root-ownership regression isolates UID-bound runtime
  env (XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS) for its unprivileged
  setpriv child. No product code changed for this; ownership assertions intact.

Links: server sbox-network-storage-server#89 (merged 6bf5b2a),
website sbox-cool/sboxns.com#7 (merged b4f2c1f),
library sbox-cool/sbox-network-storage#13 (open).

Compatibility evidence — CI-only, exact source 6bf5b2a

• compat/library-matrix.json tested rows are unchanged since 0.5.0 (single
  ci-only row for 1.1.0); no editor pass row exists for this commit.
  A detached evidence artifact adding the 0.5.3 row validates with
  scripts/compat-release.py --allow-ci-only (exit 0). The published release
  is immutable so the artifact file cannot be attached; its Tested-with table
  is reproduced here and repo bookkeeping is follow-up (as with 0.5.1/0.5.2).

  Library	Revision	Engine	OS	Database	Result	Evidence
  1.1.0	unknown	-	-	sqlite, postgres	ci-only	PR CI 38482447722, main CI 38483016911, smoke 38483016789, install matrix 38483044853, sbox-cool/sbox-network-storage-server#89

  CI-only release: this commit has not passed the real s&box editor gate.

• PR checks on 5dce5b0 (contained in 6bf5b2a): all 17 green, incl. PG13–18,
  Windows/macOS, differential + stable smoke, security, JS guards, CodeQL —
  notably Test Linux root ownership on PG18.

• Main-source CI on 6bf5b2a and the Install matrix on main (6bf5b2a):
  CI 38483016911, smoke 38483016789, install matrix 38483044853
  (all jobs success: fresh + upgrade on Ubuntu 22.04/24.04/ARM, Debian 12,
  Windows PS5.1/7).

• Parity: tests/parity/stable-reference.json untouched; release workflow
  re-runs the HTTP smoke gate and the approved stable-reference diff.

Upgrade / rollback

• No migration: SqliteMigrations/PostgresMigrations identical to 0.5.2
  (empty diff), no config/data folder move, no setting renamed or removed.
  Patch bump only (0.5.2 → 0.5.3).
• Upgrade: drop-in; static owner-console assets (CSS/JS/icons) are served from
  the new binary. Clear browser cache if the old console theme persists.
• Rollback: sbox-ns rollback --keep-data to 0.5.2 is schema-safe (same
  schema); operator-formed theme preference stored by the new console keeps
  its forward-mapped value on the old binary. No preserved-data rollback
  target is certified beyond this schema identity (no --rollback-report).
• Install-matrix note: .github/workflows/install-matrix.yml PREVIOUS is
  still 0.4.0; bumping it to 0.5.2 needs a workflow edit, which this
  release does not make — tracked as follow-up.

Verify

See docs/self-hosting.md: check SHA256SUMS, SHA256SUMS.p256.sig, SBOMs,
and provenance attestations. Feed: release.json carries 0.5.3.

What's Changed (auto)

• Add owner console redesign proposal and design system by @kngsly in #88
• Owner console shared visual system with approved lime brand by @kngsly in #89

Full Changelog: v0.5.2...v0.5.3

sbox-ns 0.5.2

What's Changed

• service start/restart: wait until the server answers (fixes the remaining #55 install race) by @kngsly in #85
• Release 0.5.2 by @kngsly in #86

Full Changelog: v0.5.1...v0.5.2

sbox-ns 0.5.1

What's Changed

• Record 0.5.0 ci-only evidence; make schema-mismatch CLI tests hermetic by @kngsly in #76
• DNS enable: publish only the address families the server serves (#55, #56) by @kngsly in #78
• Server monitoring: live host stats, alert rules and notification channels (#72, first slice) by @kngsly in #77
• Version policy, modules and integrity monitoring, alert providers, demo data (#47, #72) by @kngsly in #79
• Docs: editor tests are required by client-visible surface, with proof for the exemption by @kngsly in #80
• Release 0.5.1 by @kngsly in #81
• Settings read: emit version-policy keys only when set (release parity gate) by @kngsly in #83

Full Changelog: v0.5.0...v0.5.1

sbox-ns 0.5.0

Operator action required. This release changes the Linux file layout, the runtime (.NET 10, non-root container) and the direct document API access rules. Read Upgrade notes before updating and take a backup (sbox-ns db backup). Release feed: migrationRequired: true, security: true.

CI-only release. No real s&box editor run has been recorded for this commit. Evidence: CI (SQLite, PostgreSQL 13-18), HTTP smoke, SQLite/PostgreSQL differential gate and the install matrix (fresh install, upgrade, update and rollback on Ubuntu 22.04/24.04, arm64, Debian 12, Windows) on af11ab6.

Upgrade notes

• On Linux, operator configuration stays in /etc/sbox-ns while generated
  secrets, managed overlays and connector binaries move to the data
  directory's state/ folder. The installer and sbox-ns update --auto run
  the migration on upgrade; manual installs run sudo sbox-ns layout migrate. sbox-ns rollback reverts the layout before restoring an older
  binary, and layout migrate --revert moves the files back by hand.
• The server targets .NET 10, and the container image runs as non-root UID
  1654 on the chiseled runtime.
• The direct document API answers 403 ENDPOINT_ONLY to public game keys
  unless the collection declares accessMode: public. Games that write
  documents directly from the client must add it.
• Release updates require a pinned ECDSA P-256 signature on the checksum
  manifest. updates.github_repo and updates.feed_url are no longer
  settings; the release sources are compiled into the binary.
• Schema migrations run on start. Take a sbox-ns db backup before updating
  to a release that needs a database migration.

Security

• Updates and installers require a pinned ECDSA P-256 signature on the
  release checksum manifest. Unattended updates use compiled release sources;
  updates.github_repo and updates.feed_url are ignored.
• Linux operator configuration is root-owned and read-only to the service.
  Runtime secrets, managed overlays and connector binaries move to the data
  directory's state/ folder through sbox-ns layout migrate; rollback
  reverts this layout when restoring an older binary.
• HTTP requests have route-specific body limits and per-client rate limits.
  Management and heartbeat authentication runs before reading request bodies;
  unauthenticated requests do not generate usage rows.
• The direct document API (/v3/storage/{projectId}/{collection}/{key})
  enforces the collection access model for public game keys: accessMode: endpoint (also the default when unset) answers 403 ENDPOINT_ONLY,
  deletes need allowRecordDelete (403 RECORD_DELETE_DISABLED), and
  projects that require s&box auth verify the player and only let them change
  their own documents. Public keys could previously read, overwrite and
  delete any document. Secret keys are unchanged. Collections that game
  clients write directly must declare accessMode: public.
• Owner sign-in over plain HTTP from another machine is refused; use an SSH
  port forward, sbox-ns tunnel enable or TLS, or set
  adminpanel.allow_insecure_http. Logout ends every session, and exporting
  with secrets asks for the password (and the authenticator code when set).
• config get redacts secret settings unless --show-secrets is passed, and
  MCP config_set refuses secret keys.
• API keys only resolve against rows of the matching key type, and project
  archives reject key rows the server would never write.

Changed

• The runtime targets .NET 10 with a non-root chiseled container, signed
  release manifests, CycloneDX SBOMs and release provenance verification.
• Cached project metadata, bounded batched analytics, atomic endpoint writes
  and SQLite indexes; request and error logs retain events that share a
  timestamp. Analytics retention defaults to 90 days.
• Built-in legacy player repair and leaderboard projections are opt-in for
  new projects. Existing projects retain them after migration; the dashboard
  exposes the legacyPlayerProjections setting.
• Unattended update timers run hourly, with up to 15 minutes of randomized
  delay.
• Hosted-service X-Sboxcool-* debug response headers are no longer sent.
• Public-key query calls are served from a shared result cache that writes
  and definition changes invalidate; only secret keys can force a live run.
• Operator alerts are deduplicated and rate-limited across all sources, with
  a held-back count.
• The release-feed library overlay only tightens reported status and never
  refuses a request. Requests without a parseable library version are never
  refused by any rule.
• A database that is newer only through additive migrations now runs instead
  of being refused; a breaking gap is still refused with the existing error.
• The MCP data_records argument is now keyPrefix and matches the start of
  the key.
• Owner console themes are reworked: Deep emerald is the default dark theme,
  Mint and orchid the alternate dark theme, Paper the default light theme,
  and system follows the OS setting. Slate and Warm remain.

Added

• Library version detection on every request with an embedded compatibility
  matrix. Responses carry x-ns-server-version and x-ns-library-status
  (plus latest and sunset headers when relevant), /v3/server-info gains a
  compat block, and the request log records library version, client type
  and engine build.
• Client-version analytics with a dashboard Clients page, sbox-ns project clients and a read-only project_clients MCP tool, grouping library,
  package and game revisions with request counts and compatibility impact.
• Optional per-project library minimum: older clients are refused with HTTP
  426 LIBRARY_UNSUPPORTED, and matrix-blocked libraries with
  LIBRARY_BLOCKED. Clients that report no version are never blocked.
• Rollback-safe migrations: each migration is tagged additive or breaking,
  sbox-ns rollback --keep-data swaps the binary back without touching the
  database when safe, and sbox-ns update --version X.Y.Z --allow-downgrade
  installs a pinned older release through the same check.
• Dashboard project hub with single-link cards, create, import and export
  dialogs, a ?q= filter and an empty state.
• Hosting profiles (player-hosted, dedicated, hybrid) through project
  create, settings and project create --hosting, plus an advisory authority
  check as an overview card, sbox-ns project authority, doctor --project
  and a read-only MCP tool. It never runs on the request path.
• Staged publishing: endpoint and collection pushes can target the next
  revision, staged entries list with revisionTarget=next, test runners
  resolve staged definitions first, and package sync promotes them. Sync
  pushes support explicit endpoint replacement.
• MCP development loop: sbox-ns dev <tool> runs definition, testing,
  debugging and gated write tools with JSON over stdin, plus embedded guides,
  prompts and a Claude Code plugin. Writes stay opt-in behind
  mcp.allow_writes, mcp.allow_data_writes and mcp.allow_destructive.
• Real data on the dashboard Logs and Errors tabs, with per-project budgets
  and error-code explanations, and a Connect your game card with a filled-in
  Configure line and a setup checklist. New dashboard projects get a public
  game key by default.
• Compact owner console with a guided block editor and integration examples;
  resource list pages with stats and quick preview, and dedicated resource
  pages with Overview, Edit and Code tabs. Old ?id= and ?draft= links
  redirect.
• Project colour with generated tile icons and a fluid left-aligned layout.
• Paged data browser with key-prefix search, Find player across per-player
  collections, game-call snippets in the resource editor, and a Use with a
  coding agent card on All projects.
• sbox-ns doctor --project and the authority check report records damaged
  by the 0.4.0 update-ops bug: documents holding only an ops field. Restore
  a backup or have the player save again; the data is not recoverable.
• Sync preflight reports steps that fail at run time as warnings with code,
  message, resource and path. Pushes still store what they are given.
• Dashboard resource definitions are YAML-first with guided endpoint and
  collection builders: the editor shows YAML, saves keep YAML source text,
  and raw JSON is deprecated but still accepted. Record payloads stay JSON.
• tls.hsts sends Strict-Transport-Security on HTTPS responses when TLS is
  enabled. Plain-HTTP installs never send it.
• Endpoint collection scans are capped at 1000 rows per request
  (SCAN_TOO_LARGE beyond that) instead of reading unbounded collections on
  every game call.
• Visual editor guards (precision loss, duplicate keys, sourceText) are
  covered by node --test tests/js/, wired into CI.
• The s&box client E2E harness (tools/sbox-client-e2e/run.sh) runs the real
  client library against a local server inside a headless s&box engine, plus
  a dedicated-server project.

Fixed

• Player ledger reads include analytics queued by earlier writes, so a record
  or entry written a moment ago is visible to the next read.
• A body over its limit on a known route is read and discarded when its
  declared length is at most 4 MiB, so the client receives the 413 response
  instead of a connection reset. Larger declared bodies are rejected without
  being read.
• revision-init leaves out unknown revisions instead of sending null. The
  s&box client library failed its startup handshake on projects without a
  synced game package.
• 413 and 429 error bodies carry message next to detail, so the
  editor sync tool shows the reason instead of only the error code.
• Management validate reports the public key the library sends instead of
  always answering Not provided.
• Auto-test resolves {{values.*}} like test-endpoint and live calls.
• The CLI prints a clean error when the dat...

sbox-ns 0.4.0

Full Changelog: v0.3.0...v0.4.0

sbox-ns 0.3.0

Full Changelog: v0.2.0...v0.3.0

sbox-ns 0.2.0

Full Changelog: v0.1.0...v0.2.0

sbox-ns 0.1.0

Full Changelog: https://github.com/sbox-cool/sbox-network-storage-server/commits/v0.1.0