v2.21.9

Changed

• DESIGN.md §5 Corrected for v2.21.8: Still described only the WS-command trigger and a "rotation/invalidation event pushed down the channel" that was never actually implemented separately from that command. Updated to list both real triggers (the signed command, and the v2.21.8 connect-time pull) and the backup/PEM-validation safety behavior added alongside it. No code change.

v2.21.8

Added

• Agent-Pulled Configuration: Connect-Time Secrets Pull: The agent now renders its configured secret templates (secrets.go) on every successful WebSocket connect, not only when an operator sends a signed render_secrets command — so a target that drifted while the agent was offline (or was never rendered because the command arrived before enrollment finished) self-heals on reconnect instead of waiting for someone to notice and push again. Gated by the same secrets capability as the existing command; backgrounded so a slow secrets fetch can never delay the WS session establishing.

Fixed

• Secret Render Could Silently Destroy a Working Cert With No Recovery Path: renderOne had no content validation and kept no backup, so a template referencing a secret path that doesn't exist yet — previously harmless since rendering only ever ran on an explicit operator command — would render an empty string over a live PEM file with nothing to restore. Now: rendered content that looks like PEM (-----BEGIN) must actually decode as non-empty PEM or the render is rejected (old file kept, reload skipped), and any successful render backs up what it's replacing to <target>.bak first. Non-PEM targets are unvalidated, exactly as before — this covers Proxy/TLS material, not config validation in general.

v2.21.7

v2.21.7

Fixed

• Desktop Tray Flapping Between Home and Away With No Network Change: localSiteSeen() mirrored the raw result of the single most recent 30s mDNS poll, so one dropped multicast response (ordinary WiFi driver power-save / IGMP snooping loss, unrelated to which network the host is on) instantly flipped cached "home" state to "away." If the 60s home-monitor tick sampled during that transient gap, it pushed a yellow tray update that self-corrected on the next tick 30-60s later — a visible flap with no underlying network change. The last positive sighting is now tracked separately from the last poll, so a single missed poll no longer clears it; sustained absence (site actually gone) still reads as away within the existing 90s window.
• WireGuard Tray State Stale After Remote wireguard_remove: The wireguard_remove WebSocket command cleared VPNActive but, unlike wireguard_apply, never triggered an immediate tray status push — so the tray could show a stale VPN-active state for up to 60s after a directory-initiated tunnel removal.

v2.21.6

[v2.21.6] - 2026-08-30

Fixed

• WireGuard Interface Teardown on Daemon Shutdown: Added active WireGuard cleanup (defaultPlatformOps.RemoveWireGuard()) when daemon receives SIGTERM/SIGINT or stops, preventing lingering kernel interfaces and broken default routes after the agent is stopped.
• Systemd Service Post-Stop Cleanup: Added ExecStopPost=-/usr/bin/wg-quick down theta-mesh to theta-agent.service unit definition.
• Desktop Companion Config Access: Updated install.sh to add the active desktop user ($SUDO_USER) to the theta-secrets group and set configuration file permissions so non-root desktop applications and "Open Config" in the tray companion work seamlessly.

v2.21.5

[v2.21.5] - 2026-08-30

Fixed

• Site Name and Brand Synchronization: Added site_name extraction and dynamic site name resolution to homeState, automatically reflecting the home directory site branding in the desktop tray status.
• Config Message Tray Refresh: Triggered immediate tray status recalculation whenever the directory pushes initial/reconnected config payloads.

v2.21.4

[v2.21.4] - 2026-08-30

Fixed

• Tray IPC Permissions: Fixed tray IPC peer credential gating (peer euid != 0) that erroneously blocked the desktop user from disconnecting VPN, toggling auto-vpn, or changing internet exits from the tray UI. Root check is now strictly reserved for privileged admin CLI commands (reinit, register_service, unregister_service).
• Remote Exit & Auto-VPN Tunnel Coordination: Enabled explicit remote exit selection in wantWireGuardUp() so selecting a remote exit brings up the tunnel regardless of auto-vpn preference, while selecting local breakout cleanly disconnects and keeps the tunnel down at home.
• Immediate Tray UI Synchronization: Added proactive status broadcast upon all tray commands (set_auto_vpn, vpn_connect, vpn_disconnect, set_exit) and config pushes so the UI immediately reflects current WireGuard state.

v2.21.3

[v2.21.3] - 2026-08-30

Fixed

• Passive mDNS Home Sensing: Enabled background mDNS browsing loop unconditionally so home detection can sense the local site broadcast domain on the LAN without requiring local_discovery: true (hosts override).
• Config Payload Processing: Fixed early return on enrolled: true in the WebSocket config handler, ensuring site_lan_endpoint, site_public_ip, and organization_name are extracted and applied on initial enrollment.
• Multiple LAN Endpoints Support: homeEndpoints now supports comma-separated LAN endpoint lists, probing both the stack host reverse proxy and local DNS resolver.

v2.21.2

[v2.21.2] - 2026-08-30

Fixed

• Ignore unknown / none / default location values when sending site hint: When location in agent.yml is set to unknown or default (from default installation), resolveSiteHint now treats it as no site specified rather than sending ?site=unknown to the directory during self-enrollment.
• Default install configuration: install.sh now sets location: "default" instead of location: "unknown" and ignores placeholder locations.

v2.21.1

Merge pull request #42 from theta42/release/v2.21.1

Release v2.21.1: fix Windows build broken by SO_PEERCRED enforcement

v2.21.0

[v2.21.0] - 2026-08-29

Fixed

• Local IPC privilege escalation hardening (H6): Enforced SO_PEERCRED checks on /run/theta/tray.sock requiring mutating commands (restart, update, reload) to originate from EUID 0 (root).
• Cryptographic command envelope verification (H7): Implemented strict Ed25519 signature verification across all desktop control actions, service restarts, and update binary payloads over {type, payload} canonical envelope (Contract G-1).
• Service name validation and config permissions (H9): Added service name character allowlist ([a-zA-Z0-9_-]+), explicit 0600 permissions when writing agent.yml, and literal string replacements for /etc/hosts entries.
• WebSocket limits and deadlines (M13): Set 1 MiB message read limits, explicit pong handlers, read deadlines, and timeouts on binary downloads.
• Connection backoff on superseded code (M14): Added backoff jitter when receiving close code 4002 (superseded connection).
• Tray socket multi-path binding (M15): Dial and bind sequentially across /run/theta/tray.sock, /run/user/<uid>/theta-agent/tray.sock, and %LOCALAPPDATA%\ThetaAgent\tray.sock.
• Nil dereference protection (M16): Added nil checks across discovery data gathering and WebSocket URL parsing.
• Cron probe path traversal protection (M30): Validated service names before probing /etc/cron.* to prevent directory traversal.
• Zpool scrub support (M31): Implemented verified zpool_scrub control handler.
• Verbose logging flag (L4): Guarded high-volume debug logs behind verbose_logging configuration option.
• WebSocket Authorization Header (L5): Added Authorization: Bearer <token> HTTP header during WebSocket handshake.