opsdeck 0.4.0

A new interface — a menu that stays short as opsdeck grows, a violet that marks the agent,
resources picked by product, and appearance you can customize. Claude Code, Codex, Cursor
or any MCP client can now work through opsdeck, with the same approvals and audit as
opsdeck's own agent; releases are signed, and the file formats are versioned.

Other agents use opsdeck

• opsdeck is an MCP server for the agent you already use. Claude Code, Codex, Cursor,
  Gemini CLI, VS Code or any MCP client gets a workspace's tools at
  http://127.0.0.1:7788/mcp/ext (or over stdio with opsdeck mcp, which finds the
  running app). App settings › Agent access makes a key per agent and workspace
  (read-only, ask or auto) and shows the setup for that agent. Every call goes through
  the same risk checks, permission rules, approvals, redaction and audit as the built-in
  agent's, in a session of its own on the Agent page; a change waits there for your
  approval. Keys are stored hashed and can be revoked at once. See
  docs/agents.md.
• The opsdeck skill teaches such an agent to work through opsdeck: look first, prefer
  the specific tools, expect approvals, leave a report. For Claude Code it comes as a
  plugin (/plugin marketplace add vahidid/opsdeck, /plugin install opsdeck@opsdeck)
  that also connects the MCP server; opsdeck skill install claude-code|codex|gemini|cursor
  writes it for other agents.

Stability and security

• Stable file formats. Workspace folders now say apiVersion: opsdeck/v1; an opsdeck
  refuses a folder or vault from a newer version instead of misreading it, and upgrades
  older ones on save. docs/schema.md documents every resource kind,
  docs/compatibility.md what stays compatible and how anything is
  deprecated.
• Signed releases. SHA256SUMS.txt is signed with the opsdeck release key
  (minisign). The updater installs nothing that is not signed by that key for that
  version; install.sh checks the signature too when minisign is installed. With
  certificates configured, the macOS app is notarized and the Windows .exe files are
  Authenticode-signed. See docs/releasing.md.
• A wrong master password now says so instead of sending you to the "open the link from
  your terminal" screen.
• Dialogs and drawers are announced as dialogs to screen readers.

Testing

• Browser tests (Playwright, e2e/) drive the real UI against a real opsdeck with
  SSH hosts and a scripted model, in CI: unlocking, adding a resource, search,
  customizing, the phone layout, an agent change that waits for approval, connecting an
  outside agent. The README screenshots are made the same way (e2e/screenshots).

Interface

• New layout — a rail of icons for the five groups (Workspace, Infrastructure, Deploy,
  Library, Security) opens their sections in a panel beside it, so the menu shows a handful
  of entries instead of every section at once; sections can be pinned to the top. The top
  bar holds the tabs, search (Ctrl/⌘+K, now with actions such as Add resource) and the
  agent (Ctrl/⌘+J). Each pane scrolls on its own and the window never does.
• The agent has its own colour — violet marks everything that hands work to the agent:
  the rail and top-bar buttons, Ask the agent on the overview (with a draft box), the
  composer and Ask the agent / Explain errors on Docker, Logs, VPN, Kubernetes,
  Databases, Domains, Certificates, Deployments, Ansible and the resource editor.
• Add resource by product — the picker lists the products you know (Cisco AnyConnect,
  GlobalProtect, FortiGate, PostgreSQL, Redis, Grafana, GitLab, Argo CD…) with their logos
  and colours, searchable and by category, and opens the form already set up for that
  product (an OpenConnect resource with protocol: gp for GlobalProtect). The editor is a
  wider dialog with a live YAML preview; resources show their product's logo in the list.
• Customize — theme (dark, light, system), accent (the workspace colour or a fixed one),
  density, interface size and corners, the menu layout (icons + panel or icons only), the
  pinned sections and which sections the menu shows; saved in the browser.
• A modern Overview (health, the non-empty resource kinds, topology, networks, activity),
  Inter and JetBrains Mono bundled, and narrower windows stack list/detail pages.

Workbench

• Deployments — a workspace's Portainer, Argo CD and Komodo become resources
  of the workspace (DeployPlatform: URL, a token in the workspace's vault, reached through
  its VPN or jump host like any resource; targets limits a shared platform to the
  workspace's own stacks or applications). A Deployments page lists what each deploys —
  Portainer stacks, Argo CD applications, Komodo stacks and deployments — with health, sync
  status, services, history, logs and what a deploy would change (Argo CD's live vs Git,
  Komodo's deployed vs latest files), and runs deploy / sync, stack file updates, rollback,
  refresh, restart, start, stop and pull, each confirmed (the name typed on a protected
  environment or with prune) and recorded in the activity journal.

Agent

• deploy tool — reads the workspace's deployment platforms (platforms, targets, status,
  logs, diff, file) and deploys, rolls back, restarts or updates a stack file after approval,
  with the target's state and what changes on the card; a sync with prune is destructive.

Install

System	Download
Windows 10/11 (x64)	opsdeck-0.4.0-windows-x64-setup.exe (or the portable .exe)
macOS 12+ (Apple silicon and Intel)	opsdeck-0.4.0-macos-universal.dmg
Debian / Ubuntu (x86_64)	opsdeck_0.4.0_amd64.deb
Fedora / RHEL / openSUSE (x86_64)	opsdeck-0.4.0-1.x86_64.rpm
CLI only (opsdeck serve, opens in the browser)	opsdeck-cli-0.4.0-<os>-<arch>

Or run the install script — see Install.
Already installed? opsdeck shows the update in its sidebar and installs it for you.

SHA256SUMS.txt is signed with the opsdeck release key. To check a download yourself:

minisign -Vm SHA256SUMS.txt -P RWRns3uLxhaLFYGyA2gOUMh1YqtebJGtbVhNL1qWwsaoi2g6Mk6g4+XN
sha256sum --check --ignore-missing SHA256SUMS.txt