v0.1.1

tunnels:

• HTTP subdomain reverse-proxy (WebSocket passthrough)
• raw TCP, auto-allocated public port
• WebTransport over h3: bidi + uni streams + datagrams
• MCP (opt-in, -tags mcp)

WT:

• per-session 1:1 datagram routing. each visitor gets own ephemeral UDP
  port on client, [tunnelID:4][sessionID:4][payload] envelope
• per-tunnel AllowedOrigins (default deny cross-origin)
• per-tunnel AllowedWTProtocols, echoed via WT-Protocol
• per-tunnel visitor cap (50) + per-IP WT cap (20)

protocol:

• single QUIC conn carries every tunnel for one client
• dual ALPN on UDP/443: rift-v1 + h3
• Hello frame: ProtocolVersion = 2, capability list (wt.dgram.v2)
• mixed v0.1.0 + older builds reject at hello

ops:

• TOML config (--config / RIFT_CONFIG), unknown keys reject
• --shutdown-timeout (default 10s)
• lipgloss banner (NO_COLOR / RIFT_NO_BANNER to silence)
• --version with goos/goarch/go runtime
• admin API: POST /_admin/tokens, DELETE /_admin/tokens/:name (revoke
  kills active sessions, client sees ErrTokenRevoked)
• /_rift/healthz over h3
• ACME issuance failures log Warn (was silent), cache dir 0700
• dev cert valid 30 days

library API:

• rift.NewServer / rift.NewClient + functional options
• slog-shaped Logger, no zap forced on consumers
• sentinels: ErrAuthFailed, ErrTokenExpired, ErrTokenRevoked,
  ErrIPBlocked, ErrSubdomainTaken, ErrPortsExhausted

security:

• tokens server-issued, SHA-256 at rest, constant-time admin bearer
• 0-RTT off, QUIC Retry on
• TCP port blocklist (SSH, MySQL, Redis...) + low-port guard
• WT UDP blocklist (DNS, NTP, SNMP, mDNS...)
• cross-tunnel datagram injection blocked (tunnel-ownership check)
• subdomain entropy 80 bits, reserved-name blocklist
• admin refuses X-Forwarded-For unless WithTrustProxyHeaders
• WT-Protocol echo validated (printable ASCII, length cap)
• relay watchdog sends stream-reset on idle (was silent EOF)
• TLS 1.3 on QUIC, TLS 1.2+ on HTTPS visitor leg

v0.0.4

Changelog

• edefeb3 MCP support for rift client (#2)
• f10236b added config loaded test cases
• bc4eef4 added startup banner
• d4f6e76 feat: add TOML config file and --version aliases
• b1b9fbe updated git ignore (#1)
• 69e5384 updated startup banner

v0.0.3

Changelog

• edefeb3 MCP support for rift client (#2)
• 325cbd8 added support for mcp server tunneling
• 5331c31 fixed module import path
• eaae54f updated git ignore
• b1b9fbe updated git ignore (#1)
• 9aa7436 updated readme

v0.0.2

Changelog

• bd5714b fixed few security issues and removed fly.io related code
• 350f4d6 removed local files

v0.0.1

Changelog

• a5c3739 fixed retry on client , fixed db lock issues , exposed api for issuing tokens
• c570ee8 initial build
• 079f091 updated git ignore
• 86661a7 updated readme
• 6f7a2e7 updated readme and added license file