v1.6.0

• Canonical Browser WebSocket Bridge (htdocs/axil-bridge.js):
  • Shipped single-source, zero-dependency browser WebSocket bus with auto-reconnect, exponential backoff, port-scoped channel routing, and telemetry logging.
• WebSocket Channel Multiplexing (include/ttypt/axil-ws.h):
  • Standardized channel multiplexing definitions: Stream 0 (Text/ANSI TTY), Stream 1 (Binary BCP #b), Stream 2 (JSON/RPC).
• Capability Allowlist & Dynamic Module Imports:
  • Updated WASM allowed imports (wasm-allowed-imports.lst) ensuring strict guest/host boundaries.

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.5.0

• Framed responses: Content-Length + Connection: close on every axil_respond(). Responses previously carried no body framing, so a client could only delimit the body by connection close -- over TLS that requires close_notify, which was never sent either. Strict clients (OpenSSL 3.5+, modern browsers) discarded such responses as truncated, dropping Set-Cookie with them. 1xx/204/304 stay length-free per RFC 9110, and 101 upgrade paths bypass axil_respond() untouched. Explicitly set lengths are respected, never duplicated.
• Best-effort TLS close_notify on teardown. axil_ssl_drop() now runs up to two non-blocking SSL_shutdown() calls before SSL_free(), ensuring clean TLS connection termination.
• Teardown is ungated: unauthenticated connection cleanup (SECURITY S5.4). axil_disconnect() no longer requires DF_AUTHENTICATED and axil_close() no longer requires DF_CONNECTED. Resolves socket and PTY leakage vulnerabilities where unauthenticated descriptors outlived their TCP connection.
• Per-connection generation tracking: Generational tracking on connection descriptors to eliminate stale hook dispatch and race conditions during rapid reconnects.
• Fixed 303 Redirect Connection Teardown: Fixed connection closing and cookie persistence issues on HTTP 303 See Other redirects.
• Post-Chroot Module Loading: Improved path canonicalization and search mechanics for dynamic modules running post-chroot.
  kept as a regression: an AUTHENTICATED PTY connection killed abruptly must
  still leave no live child, no PTY master, and clean HTTP on recycled fds.
• Per-connection generation: axil_generation(). struct descr grows a
  monotonic generation bumped on every accept, so fd-keyed module state can
  reject stale entries. axil-tty's mux_state and NAWS entry carry it and
  mux_get()/mux_wsz_get() refuse a mismatch — even a leaked entry is inert
  on a recycled descriptor, which closes the whole class rather than the one
  instance above.
• DF_AUTH_AUTO (flag 4096): -A publishes an identity, it does not prove
  one. AXIL_AUTOAUTH authenticates every connection as the server's own
  account, so under -A a name comparison cannot tell an asserted identity
  from a published one. The flag is set only by AXIL_AUTOAUTH (so it cannot
  survive descriptor reuse), drop_priviledges() refuses to spawn a child
  under it — a child would otherwise run as the operator while the request
  proved nothing — and any downstream authorization that trusts REMOTE_USER
  must refuse a descriptor carrying it (SECURITY.md S5.8).
• FD_VALID(fd) before any [FD_SETSIZE] table. One macro, checked
  before the first index rather than after the frame has already been touched,
  covering descr_map, io, frame_map and ws_flags; on Windows
  socket_t is the unsigned SOCKET, so >= 0 would be a tautology and
  INVALID_SOCKET (~0) is rejected by the < FD_SETSIZE half. Accept now
  spells the sentinel out (fd == INVALID_SOCKET || fd == 0) instead of the
  fd <= 0 test that never fires for an unsigned ~0, and every teardown path
  closes with axil_sock_close() (closesocket() on Winsock) instead of
  close() on a CRT fd.
• Tests: test-auth, test.sh and test-ws.py gain the teardown,
  recycled-fd, DF_AUTH_AUTO and FD_VALID assertions; SECURITY.md records
  S5.4 and S5.5.

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.4.1

1.4.1

Version Info

• Version: 1.4.1
• Commit: cb094ab
• Build date: 2026-10-02

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.4.0

• Renamed libndc → axil: the ndc_* API and include/ttypt/ndc.h became axil_* / include/ttypt/axil.h (ndc.pc → axil.pc, lib renamed accordingly). XY hooks are now axil_* (on_axil_exit, on_axil_vim, on_axil_command, on_axil_connect, on_axil_disconnect, on_axil_tick, on_axil_parse in include/ttypt/axil-xy.h).
• Unified request-parameter API: axil_req_param(fd, body, name, buf, len) plus _int/_bool variants read a parameter from a URL-encoded form body or the query string in a single call (handles quoted values); axil_param/axil_param_int/axil_param_bool cover the query-string path, with support for special characters in the URL.
• PUT, DELETE and HEAD support: new AXIL_PUT / AXIL_DELETE / AXIL_HEAD request flags, do_PUT/do_DELETE/do_HEAD handlers, and DF_HEAD to suppress the response body.
• Encoding helpers: axil_url_encode / axil_url_decode (percent-encoding, %XX and +), axil_json_escape, and axil_slugify for URL/filesystem-safe slugs.
• Static-file serving: axil_respond_file / axil_sendfile with auto-detected MIME type, ETag validator headers derived from the file stat, and an mmap-backed cache.allow caching policy (OpenBSD-compatible).
• Response conveniences: axil_respond_plain/axil_respond_json/axil_respond_json_ok/axil_respond_no_content, axil_redirect (303).
• Deferred responses: axil_respond_defer(fd, code) sends status + headers now; the body is completed later from the event loop via axil_respond_defer_finish/_done/_abort (streaming and long-poll style responses).
• Performance: optimised header conversion, cached HTTP date strings, TCP_NODELAY, single-write responses.
• Hardening: audit fixes, expanded test suite, OpenBSD (iconv) build fix, bmake compatibility, and the libqmap → libcorm rename in the build.
• TLS & HTTP/2 hardening: teardown no longer calls SSL_shutdown (no close_notify on a dead peer); the HTTP/2 prior-knowledge preface (PRI * HTTP/2.0) is dropped, not treated as a GET; ALPN advertises http/1.1 only (not a protocol freeze — add h2 when HTTP/2 exists).

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.3.1

1.3.1

Version Info

• Version: 1.3.1
• Commit: cf3dd38
• Build date: 2026-05-03

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.3.0

1.3.0

Version Info

• Version: 1.3.0
• Commit: c10e6a4
• Build date: 2026-04-28

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.2.0

1.2.0

Version Info

• Version: 1.2.0
• Commit: 2f9e3e6
• Build date: 2026-04-27

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS

v1.1.0

1.1.0

Version Info

• Version: 1.1.0
• Commit: e59538e
• Build date: 2026-04-20

Verification

gpg --verify CHECKSUMS.asc
sha256sum -c CHECKSUMS