TubeMatic v2.0.0

A major release because it is not backward compatible: the dashboard now needs a password, and
the API and the MCP server refuse any request without their token. Every part of Tubematic sends the
right credential by itself after the upgrade, but a script or tool of your own that talks to port
4000 or 4100 will be refused until it does too. It also makes an OpenAI API key required and a
Gemini key optional. Read Upgrade notes before upgrading — the upgrade will not start until a
dashboard password is set and an OpenAI key is stored.

Added

• Tubematic is open source, and this is its first public release. The source, the releases and
  the container images are public at github.com/teja156/tubematic,
  under the Apache License 2.0, and bug reports go to that repository's issues. Every 1.x release
  was internal beta testing. Rendering uses Remotion, which has its own licence: a for-profit company
  with more than three employees needs a
  Remotion company licence to run
  Tubematic.
• The dashboard asks for a password. Every page now needs a sign-in, and a sign-in lasts seven
  days. Before, anyone who could reach port 3000 — anyone on your network, on a development
  checkout — could change settings, approve paid work and publish. Sign out is at the right of
  the top bar. There is one password for the install, set on the host; there is no sign-up and no
  reset in the browser.
• The API (port 4000) and the MCP server (port 4100) require a token on every request, apart
  from their /health probes. Before, any program on the machine — or a web page in your browser,
  through DNS rebinding — could call them, and the MCP server can spend money on paid APIs and run
  code. Onboarding creates the tokens in ~/.tubematic-data/secrets/, and every part of Tubematic
  that calls either server sends the right one automatically: the dashboard, the poller, and each
  installed agent, which reads the token from its file rather than keeping a copy.
• Connect social accounts from the Socials page. A Connect button for YouTube, Instagram,
  TikTok and Facebook opens the platform's consent page in a new tab. Finish there — it ends on
  postforme.dev — then come back and press Refresh accounts list. Accounts connected this way
  always grant the analytics permission (feeds). Before, accounts had to be connected on
  postforme.dev itself, where that permission is off by default, and such an account published
  normally while every view, like and comment stayed empty with no error saying why. A platform not
  enabled on your postforme project shows postforme's message saying where to enable it.
• python onboard.py --set-password sets or changes the dashboard password. Changing it signs every
  browser out.
• python onboard.py --rotate-tokens replaces all three tokens and restarts the services that use
  them. It waits for running work first, like an upgrade.
• After five wrong passwords in a row, the login makes you wait — 2 seconds, then 4, doubling up to
  15 minutes. Restarting the API clears the wait.
• python upgrade.py --check also reports the password, the tokens, whether the MCP server really
  refuses a request without its token, and whether each agent is registered to send it.
• Every domain has a topic cap: how many topics it may ever hold, from 25 to 750 and 100 by
  default, set in a new Topic cap field on each row of the Topics page. Beside it, "N filed"
  counts every topic the domain has had, deleted and rejected ones included. A domain that reaches
  its cap shows EXPIRED, and scheduled research files nothing more into it until you raise the
  cap. Topics you submit yourself — the New Video page or /tubematic-submit-new-job — still go
  through.
• A redacted diagnostics report for bug reports. python3 scripts/collect_diagnostics.py
  gathers the version, container state, agent and settings summary and the recent warnings from
  every log into one report.md in a new folder in your home directory. It first removes your
  stored API keys and tokens, anything shaped like a credential or cookie, emails, IP addresses,
  your host and user names, account and voice ids, and — unless you pass --include-content — your
  topics, scripts, comments and preferences. If a stored secret would still get through, it writes nothing. Read the
  report before posting it; the end of it lists what code cannot catch.
• A troubleshooting skill, tubematic-troubleshooting, walks through a problem with you, follows
  the troubleshooting guide, runs the diagnostics report and drafts a bug report in the issue form's
  layout. It never posts anything — filing is yours — and it only runs when you ask for it by name:
  /tubematic-troubleshooting in Claude Code, $tubematic-troubleshooting in Codex, or "use the
  tubematic-troubleshooting skill" in OpenCode. Scheduled runs never start it.
• Install Tubematic as a Kasm Workspace. If you run Kasm Workspaces, add the Tubematic workspace
  from its registry and launch a session. The launch form asks for a version and an install method
  (release, or source), then a terminal opens by itself, downloads that version, checks the release's
  checksum before unpacking it, and runs onboarding for you to finish there. On a later launch it
  finds the existing install and leaves it alone, and it refuses to install a different version on
  top of it — upgrade that from inside the session as usual. The session's clock is UTC, so
  Tubematic's times there are in UTC. See
  Installing in Kasm Workspaces.
• The dashboard tells you when a newer release is out. A banner under the top bar names the new
  version and links its release notes and the upgrade guide. ✕ hides it until a still newer release
  comes out. Only stable releases are announced, never a prerelease such as -rc.1 or -beta. To
  do this, the dashboard asks GitHub's public releases API for this project's releases at most once
  every two hours while a page is open, and sends nothing about your install. If GitHub cannot be
  reached, no banner shows; there is no setting to turn the check off. A checkout of the
  development branch never shows it. See
  Dashboard — The update banner.
• Prerelease versions are published as GitHub prereleases. A version such as 2.1.0-rc.1 is
  marked as a prerelease on GitHub's Releases page and is never listed as the latest release.
• A new install comes with two ElevenLabs voices, so you can voice a video without looking up
  voice IDs first: Teja, on Eleven v4, as the default voice, and Adam, on Eleven v3. Remove or
  replace them on Settings → Voice like any other voice.
• Eleven v4 (eleven_v4) can be picked as a voice's model. It takes the same script markup as
  Eleven v3: exact IPA pronunciations and [pause]-style pause tags, and no <break> tags. Its
  [pause] right after a sentence ends adds very little silence, so scripts use [long pause] for a
  pause that has to be heard.
• Guides for using the dashboard from another machine. A new
  Remote Access page walks through three ways in: Twingate, a
  private network that needs no domain and opens no port, and HTTPS with Caddy or nginx. Each comes
  with a configuration that was tested in front of a real dashboard, plus a short checklist that it
  works.
• A guide to installing Docker on Ubuntu. Installing
  now walks through Docker Engine and the Compose plugin from Docker's own repository, adding your
  user to the docker group, and a check that it all works without sudo. On other distributions,
  follow Docker's instructions for yours.

Changed

• Onboarding has a new step, Dashboard password and service tokens, before the API keys. It asks
  for the password once; a re-run never changes it.
• An OpenAI API key is now required, and a Gemini key is optional. Every scene image is now
  drawn by OpenAI (gpt-image-2.5-flare by default, or gpt-image-2.5-sunburst); Gemini no longer
  draws images, and the image-provider choice is gone from onboarding, Settings → Images and the
  settings API. Onboarding asks for the OpenAI key until you give one, and accepts a blank Gemini key.
  OpenAI grants model access per project, so the key's project must be allowed to use the image
  model you pick — a key without it is refused at the first image, with an error naming the project
  and the model.
• Scene images come in three shapes: 9:16, 1:1 and 16:9. The agent was always told to leave the
  default 9:16; a request for any other ratio is now refused rather than drawn.
• Mining needs a Gemini key, and is off without one. With no Gemini key stored, the Topics page
  greys out the Mining toggle (hover it for why), scheduled research leaves mining out, and turning
  it on is refused. Add a key on Settings → API Keys and mining comes back as it was — no need to
  tick it again. An install whose only research mode was mining runs no research until then.
• AI review is off by default on new installs, and labelled experimental on Settings → AI Review.
  It needs a Gemini key, and if the review itself fails, the video still reaches your review as if
  it had passed — the note beside the switch says so.
• Rendered videos and voice previews are served only to a signed-in browser, and are no longer
  cached by anything shared between the browser and the server.
• The GIF capability is removed: the write_gif_script tool, the GifFX scene component and the
  tubematic-gif-creator skill. The tool ran any Python an agent wrote, inside the server that holds
  your API keys, and nothing in the pipeline depended on it. A `.g...