v0.18.0

Security

No new advisories.

Added

• Agents connecting to Pando over MCP are given instructions for building apps here (R-424): Pando's
  guidance on using its sign-in, keeping secrets out of the repository, storing data in volumes and
  writing secure code, then your organization's own instructions, which win where the two differ.
  Administrators with install.policy.manage write them under System → Agents, with
  pando instructions set, or with PUT /api/v1/instructions. Anyone signed in reads them with
  pando instructions show, GET /api/v1/instructions or the pando_get_instructions tool.

Fixed

• A Cloudflare tunnel deleted in Cloudflare is made again (#374). Pando kept its tunnel's ID
  after the tunnel was deleted in Cloudflare's dashboard, and every deploy on the Cloudflare routing
  option failed with "Configuration for tunnel not found (code 1055)" until Pando restarted. Pando
  now makes its own tunnel again, points its DNS records at it and gives cloudflared the new token.
  A tunnel named in the routing option's settings is not replaced; the error says it was deleted.