v0.2.1.0-beta

Changed

• Wired and wireless machines are served at the same time. The access point keeps its own small network for wireless machines while the wired network stays as it was.
• When the wireless access point starts, the server keeps the wired connection as its main path. An open remote session or dashboard page no longer drops when the Wi-Fi card reconnects.
• The address range in Settings now covers larger networks, not only a small block. The first and last address of a network are always kept free.
• External DHCP now works instead of staying off as in the previous build. On a network that already has its own address service, choose this mode and SEZOY serves startup files only, handing out no addresses. The app checks the connection first and lets you enable it only when every check passes.
• The server no longer pins one CPU core while serving clients: an already-open database connection is now reused instead of being reopened for every request, so Linux computers booting over the network no longer run slowly and start faster and more smoothly.
• How computers fetch installation files over the network was rebuilt for speed and reliability: files now stream on demand instead of going through Windows shared folders, and the old limit of 20 computers at a time no longer applies.
• Adding a new OS image is now just copying one ISO file — the server reads straight from the file while computers boot, with no mounting, sharing, or extracting step.
• First step toward a native Linux server: the app can now be built as a Debian (.deb) package with all required folders included (beta).
• Enrolling the MOK hash for an unsigned ISO now delivers the kernel through an in-RAM iPXE volume instead of a mounted MOK disk, so in MokManager you select the "iPXE" volume and press Enter once on "./" to list the files.

Added

• New ISO Library page at https://localhost:5893/isos: browse the boot menu, walk folders, search files, download a single file or the whole ISO, and copy deep links. The page is read-only, never mounts or extracts the ISO, and stays available while the Boot Server is running.
• A new switch in Settings → WiFi Network turns the wireless access point on or off. Switch it off and the server stays on the wired network even when a Wi-Fi card is present. The choice is saved and takes effect the next time the Boot Server starts.
• The startup permission check now behaves the same on Windows and Linux, with a clear message telling you to run as administrator or with sudo.
• New Linux Distro tab in the ISO step: pick a distro → edition → version and download directly, with automatic mirror failover, pause/resume, and progress that survives tab switches.
• New Get File button in a client's fullscreen view: enter the file path to fetch and the save folder on the server (leave empty to use the default logs folder); text/log files are saved on the server for viewing.
• On Linux the first start asks which HTTPS certificate to use — your own certificate or one SEZOY creates — the same choice you get on Windows. With no terminal it uses the certificate you place in the Keys folder, and stops with clear instructions when none is found.

Fixed

• Windows now finds Wi-Fi cards and hotspots whatever language Windows is set to. Before, a card name in Vietnamese or Japanese could make the check miss it.
• An invalid address range, router address or name server is now refused on the spot with a clear message instead of being saved as a setup that leaves machines offline.
• Booting an unsigned Linux ISO with Secure Boot no longer freezes at MokManager's "Enroll hash from disk" on some physical machines, where the previous mounted-disk method could hang the firmware indefinitely.

Security

• The built-in startup file service now serves files only from the app's own boot folder. Requests that point anywhere else are refused, so a client cannot read other files on the server.

v0.2.0.6-beta

Fixed

• Ubuntu 24.04 and newer now show the Try or Install choice and the desktop installer icon when network-booted, and no longer show the first-run Welcome tour on live sessions.
• Kali Live now signs straight in to the live desktop with no username or password typing at the login screen, and USB persistence entries are kept.
• Deepin now shows its setup wizard before the desktop, keeps only the installer icon on the desktop, and clicking it opens the installer.
• Choosing Install on Kali entries now starts the real installer with on-screen menus instead of landing on a login screen.
• The Kali installer no longer asks for manual network setup and keeps using the working connection from boot.
• The boot menu now continues by itself after 15 seconds and picks the requested entry instead of waiting forever or booting the wrong one.
• Boot menu entries no longer show stray ^ characters in their names.
• Linux installer boots no longer fail while attaching system layers; the missing driver modules are now included.
• Stopping and restarting the boot server no longer breaks client boots with a missing-account error: the temporary access account is now kept, so a full app restart is no longer needed.

Changed

• The file archiving tool in the rescue image was switched back from 1.14.4 to 1.14.3 because antivirus software flags 1.14.4, which got the app rejected from the Windows package manager (winget).

v0.2.0.5-beta

Added

• Step 3 Start Boot Server asks once via modal when the Add-on is missing (Download & Install runs the same steps as Settings), with Cancel and a Do-not-ask-again checkbox; declining aborts the start instead of silently running without Wi-Fi.
• Stage 3 architecture guard: a 32-bit ISO on 64-bit UEFI (or any arch mismatch) now shows an explanatory screen with ENTER to return to the ISO menu instead of crashing the firmware.
• New UEFI bootloader setting (Settings > UEFI bootloader): auto (SNP-first), SNP-only, or Full iPXE. One choice covers wired PXE, Wi-Fi PXE, and UEFI HTTP Boot; BIOS still receives ipxe.pxe, and it applies to the next boot with no restart.
• Per-MAC bootloader table: pin auto, SNP-only, or Full per machine. A machine that boots 3 times without reaching the boot menu is automatically moved to Full iPXE and locked; the reason is shown in the table, and clearing the pin returns it to SNP.

Fixed

• Wi-Fi readiness check no longer rejects valid installed driver files; verified files are now accepted.
• Parallel Add-on installs no longer fail with WinError 5 (file replacement is retried).
• WinError 10038 socket noise during Boot Services cleanup lowered to debug level.
• Legacy BIOS boot menu failed with 'cpair: command not found' (BIOS iPXE has no such command); color commands now run on UEFI only.
• ARM64 UEFI machines could receive the wrong (x64) bootloader; each architecture now gets its matching build.
• Deepin 25 failed to boot over the network because the system could not find its data layers; layer names are now read correctly.
• Slax modules could load with wrong names, which could break module loading; module names are now read correctly.
• Some Ubuntu setups could load unneeded language data packs; only the needed system layers are used now.
• The boot script could crash right at startup on some ISOs, forcing the machine back to a rescue shell; startup is now validated.

Changed

• WinDivert is now Wi-Fi-only: wired LAN (both isolated Full DHCP and shared-router ProxyDHCP) needs no driver, and the kernel driver is opened only for Wi-Fi Hotspot.
• Network boot now shows clear progress steps (5% to 100%) instead of technical messages.

Security

• New code-signing certificate for a clean publisher identity (TekDT / SEZOY, replacing the old TekDT BMC Pro name) now that the app ships driver-free. Public cert SHA-256 for independent verification: 586df918e8fdade97a8ca6fff78b3fc736bbd3f2b63ed02c61a0ef1a14059778.
• Wi-Fi no longer starts without its packet filter: if the WinDivert driver is required but unavailable, startup aborts instead of running unprotected.

IMPORTANT

If you wanna try PRO / ENTERPRISE license, please send the fingerprint (get it from https://localhost:5893/settings -> About ) to email admin@tekdt.xyz or dinhtrungtek@gmail.com. This is FREE!

Full Changelog: v0.2.0.2-beta...v0.2.0.5-beta

v0.2.0.4-beta

Fixed

• Temporary SMB accounts (TekDT_*) sometimes left behind after shutdown: cleanup now closes SMB sessions first, retries, and verifies deletion instead of silently reporting success.
• Stale WinDivert 1.x DLLs vendored in pydivert\windivert_dll broke the built EXE ("WinDivertHelperCompileFilter not found"); refreshed to the WinDivert 2.x pair with a build-time guard in sign.bat.
• Light theme: Close Application / Stop Boot Server buttons, gateway card titles, content tabs and the Add Command button were unreadable (pale pink, forced white, blue-on-blue, or missing background).
• Dark theme: input-group icons and .form-text hints (e.g. in the Create Profile modal) were invisible on light backgrounds.
• Self-update always reported a new version for identical beta builds because the manifest stripped "-beta"; version comparison now keeps the suffix (stable v1.0.0.0+ outranks beta).
• WinDivert driver failing to start ([WinError 2]) on machines where the installed service entry went stale: Boot Server now reinstalls the service cleanly from the driver bundled with the app and retries, with diagnostics in the log. The driver is always loaded from the app install directory, never copied elsewhere without explicit user consent.

Changed

• Login page visual refresh (flat card, technical grid, no glow) with a Japanese language option.
• Monitor page redesigned to the project style with Light/Dark themes and a theme toggle.
• ENTERPRISE-locked Settings views now show full content and docs preview; interactions show an upgrade toast while enforcement stays in the backend middleware (HTTP 403).
• Locked views allow sub-tab switching and docs accordions; changing language no longer wipes view content.

Added

• WinDivert in the tool manager (check/update from basil00/WinDivert, skipped while the Boot Server holds the driver, export verification before replacing files).
• Full multilingual UI (EN/VI/CN/JP) for Client Logs, Reports, Audit Logs and the Create Profile modal, with English fallback.

Security

• Settings preview opened only for non-secret reads (Wi-Fi SSID without password, DHCP mode, backup/schedule metadata, encryption status); API key material and all writes stay ENTERPRISE-gated at the router (fail-closed), so direct API calls cannot bypass the UI lock.

v0.2.0.3-beta

Added

• Mandatory Wi-Fi driver pack (DP_WLAN-WiFi_*.7z): auto-downloaded before the boot server starts, so wireless-booted clients can reconnect to the server Wi-Fi access point inside WinPE.
• Client Profiles panel in workflow Step 2 for Network Boot: shows which profiles serve each deployment mode with a Manage Profiles shortcut. USB boot keeps the per-ISO preset picker.
• TLS certificate import in Prepare environment: PKCS#12 (.pfx/.p12) bundles and bring-your-own-key (BYOK) key pairs.- Environment revert (Remove tab): roll firewall, LSA, SMB, certificate, WinDivert and driver changes back to their original values.
• Changes Log page in Settings with full version history, newest first.

Changed

• Step 1 device label renamed from “PXE Server” to “Network Boot” (covers both PXE and UEFI HTTP boot).
• ISO downloads now resume after interruption and show clearer live status in the workflow UI.
• Server console and log output standardized to English (web UI stays multilingual).
• TLS first-run dialog is private-key-only (public key derived, certificate auto-minted with full SAN); full cert pairs and PFX bundles remain as automatic fallback.
• TLS alias private_key2.pem removed — canonical tls_private_key.pem only, with one-time automatic migration.
• WinError 10053 client-disconnect noise lowered to debug level in server logs.
• Secure-delete for the source private key (encrypted-DB vault kept, fileless mode with silent re-materialize at startup), offered at first run and in Prepare environment.
• Certificate transparency in Prepare environment status: SAN list, missing-SAN warning, and a reproducible openssl command.
  Changed

Fixed

• DEMO/FREE license could open Profiles, Clients and Reports but create/edit returned HTTP 403 (those writes were gated as PRO). Writes now work on DEMO; Settings password, Wi-Fi, DHCP, backup and API keys stay ENTERPRISE.
• Duplicate ISO entries are blocked; externally added ISO files are handled gracefully.
• Clear diagnostics when no desktop packages are selected, explaining why Install-Applications.ps1 is skipped - in both the server log and the WinPE log.
• Orphan Start-InstallApps.cmd is no longer written when Install-Applications.ps1 was not generated.
• SQLite temporary files are cleaned up; lxml dependency added.
• FirstLogon task launchers now use an ONLOGON schedule instead of ONCE/00:00, so Install-Applications and the remote poller reliably start at first logon; launch results are logged with error levels.
• Unattend WLAN profile now uses the correct schema (setup.exe rejected the old namespaced component); the desktop Wi-Fi fallback retries after enabling machine Location on Windows 11 24H2.
• Standard-setup clients now receive tekdt_state.json, so the persistent remote poller heartbeats instead of exiting after 15 minutes.
• WinGet REST source returns valid manifests even with no local .yaml files (0x8A150039 fixed); empty publishers now default and the response envelope is corrected.
• Product keys: well-formed keys use OnError for a recoverable prompt instead of a dead end; malformed keys are ignored with a validation warning.
• Netboot launches sources\setup.exe first (the root setup.exe stub exits immediately with no evidence).
• ISO product keys only override presets in SEZOY mode; standard-setup always uses the preset key, stopping cross-ISO key leaks in multi-ISO menus.

Security

• Keys and licenses moved to an encrypted database vault as the primary store; embedded keys rotated.
• License database recovery prompt with atomic state commits.
• LSA handling is verify-only (no token-policy relaxation); TLS private key is stored separately from the certificate.

v0.2.0.2-beta

Initial commit